3072cc4ed1097b559375b0f089d52a7211d651453c326db98664eb5f3a84d95b

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

49a987be5efdace7a58ec0416f1491a0_NeikiAnalytics.exe
Size

203KB
MD5

49a987be5efdace7a58ec0416f1491a0
SHA1

a6043bc44f76071c586b2f7a92b6865afe001442
SHA256

3072cc4ed1097b559375b0f089d52a7211d651453c326db98664eb5f3a84d95b
SHA512

8ecf609d37c58274b71b464451cd3eac8ebeb65c03b305d6f82ddedc688dc07f881a2541519828a080642f97c0f4db0403cac23044669dd9a889357ef897f883
SSDEEP

6144:+L1DGCW87ldOibtnJfKXqPTX7D7FM6234lKm3mo8YG:+L0CW67OwtJCXqP77D7FB24lwT

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bomkcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbhboolf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmbphg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iomoenej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nclbpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhhpop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boeebnhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cpbjkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fngcmcfe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofhknodl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmiikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnjqmpgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oghghb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kgiiiidd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahkih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmadco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifmqfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Illfdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ipoheakj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jmbhoeid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jedccfqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kpcjgnhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmhocd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fefedmil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncnofeof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pfandnla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjdpelnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nmfcok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emjgim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ebimgcfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipoheakj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmbhoeid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lfeljd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lomqcjie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mfeeabda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgbpaipl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bpkdjofm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnfkdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ckjknfnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dgcihgaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dodjjimm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hfcnpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mokmdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njmqnobn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaifpi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qodeajbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apaadpng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnfaohbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eifaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dnmaea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cglbhhga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjmba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gbeejp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Klcekpdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lncjlq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mnmmboed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oabhfg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cponen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chnlgjlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Klhnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Apaadpng.exe

Executes dropped EXE 64 IoCs

pid	Process
2956	Boeebnhp.exe
2484	Bepmoh32.exe
4564	Blielbfi.exe
4652	Bklfgo32.exe
1136	Bhpfqcln.exe
2416	Bahkih32.exe
2088	Bhbcfbjk.exe
3520	Bomkcm32.exe
2692	Bdickcpo.exe
2532	Ckclhn32.exe
2020	Cfipef32.exe
5056	Ckeimm32.exe
2280	Cdnmfclj.exe
4548	Cnfaohbj.exe
3736	Cfnjpfcl.exe
1800	Ckjbhmad.exe
3684	Cdbfab32.exe
996	Cljobphg.exe
4608	Cnkkjh32.exe
2356	Cfbcke32.exe
1084	Dokgdkeh.exe
2616	Dfdpad32.exe
3676	Dmohno32.exe
116	Domdjj32.exe
3036	Dbkqfe32.exe
3844	Ddjmba32.exe
4872	Dmadco32.exe
400	Dfiildio.exe
4580	Ddligq32.exe
1016	Digehphc.exe
4072	Doaneiop.exe
2708	Dndnpf32.exe
4476	Dijbno32.exe
2500	Dkhnjk32.exe
2736	Dodjjimm.exe
2948	Dngjff32.exe
1664	Dfnbgc32.exe
920	Deqcbpld.exe
4884	Eiloco32.exe
2188	Emhkdmlg.exe
4980	Ebdcld32.exe
732	Eecphp32.exe
4288	Eiokinbk.exe
2488	Emjgim32.exe
1488	Eiahnnph.exe
636	Ebimgcfi.exe
4804	Eehicoel.exe
4336	Ekaapi32.exe
4772	Epmmqheb.exe
1924	Efgemb32.exe
1080	Eifaim32.exe
4320	Ekdnei32.exe
4192	Enbjad32.exe
3148	Efjbcakl.exe
1724	Fmcjpl32.exe
4364	Fbpchb32.exe
3104	Fmfgek32.exe
2400	Fngcmcfe.exe
1076	Fealin32.exe
1520	Flkdfh32.exe
372	Fnipbc32.exe
2700	Fechomko.exe
4596	Flmqlg32.exe
3648	Fbgihaji.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mmjpbc32.dll	Bhbcfbjk.exe
File created	C:\Windows\SysWOW64\Emhkdmlg.exe	Eiloco32.exe
File opened for modification	C:\Windows\SysWOW64\Hlpfhe32.exe	Hfcnpn32.exe
File created	C:\Windows\SysWOW64\Pbegml32.dll	Hmbphg32.exe
File created	C:\Windows\SysWOW64\Lblldc32.dll	Ibfnqmpf.exe
File created	C:\Windows\SysWOW64\Jllokajf.exe	Jinboekc.exe
File created	C:\Windows\SysWOW64\Aooold32.dll	Lckiihok.exe
File opened for modification	C:\Windows\SysWOW64\Onkidm32.exe	Ojomcopk.exe
File created	C:\Windows\SysWOW64\Godcje32.dll	Qhjmdp32.exe
File created	C:\Windows\SysWOW64\Igcnla32.dll	Hiipmhmk.exe
File created	C:\Windows\SysWOW64\Kigcfhbi.dll	Hoeieolb.exe
File created	C:\Windows\SysWOW64\Mmacdg32.dll	Knnhjcog.exe
File opened for modification	C:\Windows\SysWOW64\Lobjni32.exe	Lmdnbn32.exe
File opened for modification	C:\Windows\SysWOW64\Qfkqjmdg.exe	Qhhpop32.exe
File created	C:\Windows\SysWOW64\Hedafk32.exe	Gbeejp32.exe
File created	C:\Windows\SysWOW64\Knnhjcog.exe	Kegpifod.exe
File opened for modification	C:\Windows\SysWOW64\Qmgelf32.exe	Qodeajbg.exe
File created	C:\Windows\SysWOW64\Chnlgjlb.exe	Cpfcfmlp.exe
File created	C:\Windows\SysWOW64\Gbqcnc32.dll	Gncchb32.exe
File created	C:\Windows\SysWOW64\Fmggcl32.dll	Kcidmkpq.exe
File created	C:\Windows\SysWOW64\Qmfqknfm.dll	Ljeafb32.exe
File created	C:\Windows\SysWOW64\Lncjlq32.exe	Ljhnlb32.exe
File created	C:\Windows\SysWOW64\Bhqndghj.dll	Cpmapodj.exe
File opened for modification	C:\Windows\SysWOW64\Dfdpad32.exe	Dokgdkeh.exe
File created	C:\Windows\SysWOW64\Hpidaqmj.dll	Jinboekc.exe
File created	C:\Windows\SysWOW64\Fcokoohi.dll	Ncnofeof.exe
File created	C:\Windows\SysWOW64\Aepjgm32.dll	Ngqagcag.exe
File created	C:\Windows\SysWOW64\Aoioli32.exe	Afbgkl32.exe
File opened for modification	C:\Windows\SysWOW64\Bgbpaipl.exe	Bddcenpi.exe
File created	C:\Windows\SysWOW64\Gepgfb32.dll	Fealin32.exe
File opened for modification	C:\Windows\SysWOW64\Ibfnqmpf.exe	Ipgbdbqb.exe
File created	C:\Windows\SysWOW64\Ifenan32.dll	Jnlkedai.exe
File created	C:\Windows\SysWOW64\Idefqiag.dll	Lfeljd32.exe
File created	C:\Windows\SysWOW64\Monjjgkb.exe	Mmpmnl32.exe
File created	C:\Windows\SysWOW64\Nnfpinmi.exe	Nfohgqlg.exe
File created	C:\Windows\SysWOW64\Pjbcplpe.exe	Phcgcqab.exe
File created	C:\Windows\SysWOW64\Fomnhddq.dll	Cnhgjaml.exe
File opened for modification	C:\Windows\SysWOW64\Ifmqfm32.exe	Hoeieolb.exe
File created	C:\Windows\SysWOW64\Ocgbld32.exe	Oplfkeob.exe
File opened for modification	C:\Windows\SysWOW64\Emhkdmlg.exe	Eiloco32.exe
File created	C:\Windows\SysWOW64\Bgaclkia.dll	Hpqldc32.exe
File created	C:\Windows\SysWOW64\Bjokon32.dll	Mmhgmmbf.exe
File created	C:\Windows\SysWOW64\Mmmqhl32.exe	Mnjqmpgg.exe
File opened for modification	C:\Windows\SysWOW64\Bhkfkmmg.exe	Bpdnjple.exe
File created	C:\Windows\SysWOW64\Oclknk32.dll	Fefedmil.exe
File created	C:\Windows\SysWOW64\Lfmmaj32.dll	Gfodeohd.exe
File opened for modification	C:\Windows\SysWOW64\Hpnoncim.exe	Hmpcbhji.exe
File opened for modification	C:\Windows\SysWOW64\Jcfggkac.exe	Jphkkpbp.exe
File opened for modification	C:\Windows\SysWOW64\Ljeafb32.exe	Lfjfecno.exe
File created	C:\Windows\SysWOW64\Ckbemgcp.exe	Chdialdl.exe
File opened for modification	C:\Windows\SysWOW64\Fbgihaji.exe	Flmqlg32.exe
File created	C:\Windows\SysWOW64\Fdahdiml.dll	Iedjmioj.exe
File opened for modification	C:\Windows\SysWOW64\Lgbloglj.exe	Lokdnjkg.exe
File created	C:\Windows\SysWOW64\Pplobcpp.exe	Pmnbfhal.exe
File opened for modification	C:\Windows\SysWOW64\Boeebnhp.exe	49a987be5efdace7a58ec0416f1491a0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Dodjjimm.exe	Dkhnjk32.exe
File opened for modification	C:\Windows\SysWOW64\Joahqn32.exe	Ipoheakj.exe
File opened for modification	C:\Windows\SysWOW64\Monjjgkb.exe	Mmpmnl32.exe
File created	C:\Windows\SysWOW64\Apaadpng.exe	Amcehdod.exe
File created	C:\Windows\SysWOW64\Pipeabep.dll	Cnfkdb32.exe
File created	C:\Windows\SysWOW64\Cdbfab32.exe	Ckjbhmad.exe
File opened for modification	C:\Windows\SysWOW64\Bkphhgfc.exe	Bpkdjofm.exe
File opened for modification	C:\Windows\SysWOW64\Blielbfi.exe	Bepmoh32.exe
File opened for modification	C:\Windows\SysWOW64\Cnfaohbj.exe	Cdnmfclj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9848	9404	WerFault.exe	443

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	49a987be5efdace7a58ec0416f1491a0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgncclck.dll"	Ckjknfnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jpcapp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnffoibg.dll"	Omgmeigd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ppgegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbobifpp.dll"	Chfegk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dgcihgaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dbkqfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dijbno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gnepna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lfeljd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nmbjcljl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Amnlme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Coqncejg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dfdpad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcokoohi.dll"	Ncnofeof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Paeelgnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ljeafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpolbbim.dll"	Nqpcjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eehnaq32.dll"	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdgccn32.dll"	Ebimgcfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Flkdfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jcfggkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nqpcjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nadleilm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hahqkaaa.dll"	Bepmoh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cdnmfclj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dngjff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iafphi32.dll"	Pjdpelnc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gbalopbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jekqmhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdmlme32.dll"	Mokmdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fopjdidn.dll"	Monjjgkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ohlqcagj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qhjmdp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hlglidlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jinboekc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kpmdfonj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fihgkk32.dll"	Lmdnbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qpcecb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Baannc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgihjf32.dll"	Dahmfpap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cdbfab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekoglqie.dll"	Kgiiiidd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Famkjfqd.dll"	Lqmmmmph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njmqnobn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Offnhpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpkhqmjb.dll"	Cncnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mmpmnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nglhld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Domdjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egljbmnm.dll"	Dmadco32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jekqmhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Eifaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Keimof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Adcjop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Digehphc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dejncidp.dll"	Dkhnjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Eiloco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hpiecd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfcfimfi.dll"	Pnkbkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pneall32.dll"	Pfiddm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gnepna32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2956	2408	49a987be5efdace7a58ec0416f1491a0_NeikiAnalytics.exe	90
PID 2408 wrote to memory of 2956	2408	49a987be5efdace7a58ec0416f1491a0_NeikiAnalytics.exe	90
PID 2408 wrote to memory of 2956	2408	49a987be5efdace7a58ec0416f1491a0_NeikiAnalytics.exe	90
PID 2956 wrote to memory of 2484	2956	Boeebnhp.exe	91
PID 2956 wrote to memory of 2484	2956	Boeebnhp.exe	91
PID 2956 wrote to memory of 2484	2956	Boeebnhp.exe	91
PID 2484 wrote to memory of 4564	2484	Bepmoh32.exe	92
PID 2484 wrote to memory of 4564	2484	Bepmoh32.exe	92
PID 2484 wrote to memory of 4564	2484	Bepmoh32.exe	92
PID 4564 wrote to memory of 4652	4564	Blielbfi.exe	93
PID 4564 wrote to memory of 4652	4564	Blielbfi.exe	93
PID 4564 wrote to memory of 4652	4564	Blielbfi.exe	93
PID 4652 wrote to memory of 1136	4652	Bklfgo32.exe	94
PID 4652 wrote to memory of 1136	4652	Bklfgo32.exe	94
PID 4652 wrote to memory of 1136	4652	Bklfgo32.exe	94
PID 1136 wrote to memory of 2416	1136	Bhpfqcln.exe	95
PID 1136 wrote to memory of 2416	1136	Bhpfqcln.exe	95
PID 1136 wrote to memory of 2416	1136	Bhpfqcln.exe	95
PID 2416 wrote to memory of 2088	2416	Bahkih32.exe	96
PID 2416 wrote to memory of 2088	2416	Bahkih32.exe	96
PID 2416 wrote to memory of 2088	2416	Bahkih32.exe	96
PID 2088 wrote to memory of 3520	2088	Bhbcfbjk.exe	97
PID 2088 wrote to memory of 3520	2088	Bhbcfbjk.exe	97
PID 2088 wrote to memory of 3520	2088	Bhbcfbjk.exe	97
PID 3520 wrote to memory of 2692	3520	Bomkcm32.exe	98
PID 3520 wrote to memory of 2692	3520	Bomkcm32.exe	98
PID 3520 wrote to memory of 2692	3520	Bomkcm32.exe	98
PID 2692 wrote to memory of 2532	2692	Bdickcpo.exe	99
PID 2692 wrote to memory of 2532	2692	Bdickcpo.exe	99
PID 2692 wrote to memory of 2532	2692	Bdickcpo.exe	99
PID 2532 wrote to memory of 2020	2532	Ckclhn32.exe	101
PID 2532 wrote to memory of 2020	2532	Ckclhn32.exe	101
PID 2532 wrote to memory of 2020	2532	Ckclhn32.exe	101
PID 2020 wrote to memory of 5056	2020	Cfipef32.exe	102
PID 2020 wrote to memory of 5056	2020	Cfipef32.exe	102
PID 2020 wrote to memory of 5056	2020	Cfipef32.exe	102
PID 5056 wrote to memory of 2280	5056	Ckeimm32.exe	103
PID 5056 wrote to memory of 2280	5056	Ckeimm32.exe	103
PID 5056 wrote to memory of 2280	5056	Ckeimm32.exe	103
PID 2280 wrote to memory of 4548	2280	Cdnmfclj.exe	105
PID 2280 wrote to memory of 4548	2280	Cdnmfclj.exe	105
PID 2280 wrote to memory of 4548	2280	Cdnmfclj.exe	105
PID 4548 wrote to memory of 3736	4548	Cnfaohbj.exe	106
PID 4548 wrote to memory of 3736	4548	Cnfaohbj.exe	106
PID 4548 wrote to memory of 3736	4548	Cnfaohbj.exe	106
PID 3736 wrote to memory of 1800	3736	Cfnjpfcl.exe	107
PID 3736 wrote to memory of 1800	3736	Cfnjpfcl.exe	107
PID 3736 wrote to memory of 1800	3736	Cfnjpfcl.exe	107
PID 1800 wrote to memory of 3684	1800	Ckjbhmad.exe	108
PID 1800 wrote to memory of 3684	1800	Ckjbhmad.exe	108
PID 1800 wrote to memory of 3684	1800	Ckjbhmad.exe	108
PID 3684 wrote to memory of 996	3684	Cdbfab32.exe	109
PID 3684 wrote to memory of 996	3684	Cdbfab32.exe	109
PID 3684 wrote to memory of 996	3684	Cdbfab32.exe	109
PID 996 wrote to memory of 4608	996	Cljobphg.exe	110
PID 996 wrote to memory of 4608	996	Cljobphg.exe	110
PID 996 wrote to memory of 4608	996	Cljobphg.exe	110
PID 4608 wrote to memory of 2356	4608	Cnkkjh32.exe	111
PID 4608 wrote to memory of 2356	4608	Cnkkjh32.exe	111
PID 4608 wrote to memory of 2356	4608	Cnkkjh32.exe	111
PID 2356 wrote to memory of 1084	2356	Cfbcke32.exe	112
PID 2356 wrote to memory of 1084	2356	Cfbcke32.exe	112
PID 2356 wrote to memory of 1084	2356	Cfbcke32.exe	112
PID 1084 wrote to memory of 2616	1084	Dokgdkeh.exe	113

C:\Users\Admin\AppData\Local\Temp\49a987be5efdace7a58ec0416f1491a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\49a987be5efdace7a58ec0416f1491a0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\Boeebnhp.exe
  C:\Windows\system32\Boeebnhp.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\SysWOW64\Bepmoh32.exe
    C:\Windows\system32\Bepmoh32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Windows\SysWOW64\Blielbfi.exe
      C:\Windows\system32\Blielbfi.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4564
    - - C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4652
      - C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3520
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3736
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:996
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2356
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2616
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        24⤵
        Executes dropped EXE
        
        PID:3676
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:116
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3036
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3844
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4872
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        29⤵
        Executes dropped EXE
        
        PID:400
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        30⤵
        Executes dropped EXE
        
        PID:4580
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1016
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        32⤵
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        33⤵
        Executes dropped EXE
        
        PID:2708
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4476
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2500
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2736
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2948
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        38⤵
        Executes dropped EXE
        
        PID:1664
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        39⤵
        Executes dropped EXE
        
        PID:920
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4884
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        41⤵
        Executes dropped EXE
        
        PID:2188
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        42⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        43⤵
        Executes dropped EXE
        
        PID:732
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        44⤵
        Executes dropped EXE
        
        PID:4288
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2488
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        46⤵
        Executes dropped EXE
        
        PID:1488
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:636
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        48⤵
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        49⤵
        Executes dropped EXE
        
        PID:4336
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        50⤵
        Executes dropped EXE
        
        PID:4772
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        51⤵
        Executes dropped EXE
        
        PID:1924
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1080
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        53⤵
        Executes dropped EXE
        
        PID:4320
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        54⤵
        Executes dropped EXE
        
        PID:4192
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        55⤵
        Executes dropped EXE
        
        PID:3148
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        56⤵
        Executes dropped EXE
        
        PID:1724
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        57⤵
        Executes dropped EXE
        
        PID:4364
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        58⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2400
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1076
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1520
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        62⤵
        Executes dropped EXE
        
        PID:372
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        63⤵
        Executes dropped EXE
        
        PID:2700
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4596
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        65⤵
        Executes dropped EXE
        
        PID:3648
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3188
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        67⤵
        
        PID:384
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        68⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        69⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        70⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        71⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        72⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        73⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        74⤵
        Drops file in System32 directory
        
        PID:5396
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        75⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        76⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        77⤵
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        78⤵
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        79⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        80⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        81⤵
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        82⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5816
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        84⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        85⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        86⤵
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5976
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6016
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        89⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        90⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        91⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        92⤵
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        93⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5340
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        95⤵
        Drops file in System32 directory
        
        PID:5376
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        96⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        97⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        98⤵
        Drops file in System32 directory
        
        PID:5676
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        99⤵
        Modifies registry class
        
        PID:5764
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        100⤵
        Drops file in System32 directory
        
        PID:5876
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5956
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        102⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        103⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        104⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        105⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        106⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        107⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5904
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        109⤵
        Drops file in System32 directory
        
        PID:6008
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        110⤵
        Drops file in System32 directory
        
        PID:5172
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        111⤵
        Drops file in System32 directory
        
        PID:5384
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        112⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        113⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5468
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        115⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        116⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        117⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        118⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        119⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        120⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        121⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6456
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        123⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        124⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        125⤵
        Modifies registry class
        
        PID:6584
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6632
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        127⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        128⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        129⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        130⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        131⤵
        Modifies registry class
        
        PID:6864
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        132⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        133⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        134⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        135⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        136⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7112
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        137⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        138⤵
        Drops file in System32 directory
        
        PID:5964
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        139⤵
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6364
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        141⤵
        Drops file in System32 directory
        
        PID:6448
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        142⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        143⤵
        Drops file in System32 directory
        
        PID:6596
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        144⤵
        Drops file in System32 directory
        
        PID:6676
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        145⤵
        Drops file in System32 directory
        
        PID:6724
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        146⤵
        Modifies registry class
        
        PID:6816
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        147⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        148⤵
        Modifies registry class
        
        PID:6940
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7040
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        150⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6164
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        152⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        153⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        154⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6668
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6796
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        157⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        158⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        159⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        160⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        161⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        162⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        163⤵
        Drops file in System32 directory
        
        PID:6872
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        164⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6252
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        166⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        167⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6248
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        169⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        170⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        171⤵
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        172⤵
        Drops file in System32 directory
        
        PID:7172
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        173⤵
        Drops file in System32 directory
        
        PID:7220
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        174⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7264
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        175⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7300
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        176⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        177⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        178⤵
        Drops file in System32 directory
        
        PID:7456
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7500
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        180⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        181⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        182⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        183⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        184⤵
        Drops file in System32 directory
        
        PID:7716
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        185⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        186⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        187⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        188⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        189⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        190⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        191⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        192⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8080
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        194⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8160
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        196⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7256
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7324
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        199⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7416
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        200⤵
        Modifies registry class
        
        PID:7496
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        201⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        202⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        203⤵
        Modifies registry class
        
        PID:7700
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        204⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7832
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        206⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        207⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        208⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        209⤵
        Modifies registry class
        
        PID:8148
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7248
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        211⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        212⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7576
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        214⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        215⤵
        Modifies registry class
        
        PID:7820
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        216⤵
        Drops file in System32 directory
        
        PID:7996
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        217⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        218⤵
        Modifies registry class
        
        PID:7228
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5324
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        220⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        221⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        222⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        223⤵
        Drops file in System32 directory
        
        PID:8088
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        224⤵
        Drops file in System32 directory
        
        PID:7208
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        225⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7964
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        227⤵
        Drops file in System32 directory
        
        PID:7988
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        228⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        229⤵
        Modifies registry class
        
        PID:7892
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        230⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        231⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        232⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        233⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8244
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        235⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        236⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        237⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        238⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8460
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        240⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        241⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        242⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        243⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        244⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        245⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        246⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        247⤵
        Modifies registry class
        
        PID:8816
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8860
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        249⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        250⤵
        Modifies registry class
        
        PID:8940
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        251⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9024
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        253⤵
        Modifies registry class
        
        PID:9076
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        254⤵
        Modifies registry class
        
        PID:9116
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        255⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9200
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        257⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        258⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        259⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        260⤵
        Modifies registry class
        
        PID:8416
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        261⤵
        Drops file in System32 directory
        
        PID:8488
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        262⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        263⤵
        Drops file in System32 directory
        
        PID:8628
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        264⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        265⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        266⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        267⤵
        Modifies registry class
        
        PID:8892
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8960
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        269⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        270⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9176
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        272⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        273⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        274⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        275⤵
        Modifies registry class
        
        PID:8524
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        276⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8624
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        277⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8856
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        279⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        280⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        281⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        282⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        283⤵
        Modifies registry class
        
        PID:8476
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8680
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        285⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        286⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        287⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        288⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        289⤵
        Modifies registry class
        
        PID:8620
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        290⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        291⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        292⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        293⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        294⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        295⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        296⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        297⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        298⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9312
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9356
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        300⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        301⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        302⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        303⤵
        Modifies registry class
        
        PID:9520
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        304⤵
        Drops file in System32 directory
        
        PID:9568
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        305⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9652
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        307⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        308⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        309⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        310⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        311⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        312⤵
        Drops file in System32 directory
        
        PID:9908
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9948
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        314⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10032
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        316⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        317⤵
        Modifies registry class
        
        PID:10120
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        318⤵
        Drops file in System32 directory
        
        PID:10184
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        319⤵
        Drops file in System32 directory
        
        PID:8504
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        320⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        321⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9424
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        323⤵
        Modifies registry class
        
        PID:9500
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        324⤵
        Modifies registry class
        
        PID:9556
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        325⤵
        Modifies registry class
        
        PID:9608
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9692
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9760
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        328⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9904
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        330⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        331⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10104
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10224
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        334⤵
        Drops file in System32 directory
        
        PID:9260
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9420
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        336⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9632
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        338⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9860
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9968
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        341⤵
        Modifies registry class
        
        PID:10072
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        342⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        343⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9404 -s 412
        344⤵
        Program crash
        
        PID:9848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3768,i,14486271492189381216,15799931579469722648,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
1⤵
PID:6964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 9404 -ip 9404
1⤵
PID:9676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adcjop32.exe

Filesize
203KB

MD5
2d9df79202329b1b498fea6aae28dd1e

SHA1
5d5ecd39133f4066168df2a6fd8a7d8fdec8ae4b

SHA256
2e25050a0f7f395ce5b57af10626f288a8820008a79e2c22a1deb5240b4465ab

SHA512
bd2be2fbc688d14ea8196125e475e25413e9d208cbced86d1f1d07d2e8747ff9f5ad5c87a123d59494e313d0e6285fcfc60229fc3cb0ec8c57058b7e25392635

Download Submit
C:\Windows\SysWOW64\Aggpfkjj.exe

Filesize
203KB

MD5
3909eb0d3bf504125d945040a995b323

SHA1
cc06e8df7cbe4ec4d4560746fd64f52fb279973a

SHA256
a902b01376a7b0042b7ee8623aea9f73be573079d96f6cf22c5560fd878b0eee

SHA512
3bf8b54adac61575b55ac2da2b3cce6efb08ffea2d3ddf4644026531963f785e2b1d1f2dd7ff44fb4171a51c4656c054b4c68b26835c61805bbfba90b615f529

Download Submit
C:\Windows\SysWOW64\Bacjdbch.exe

Filesize
203KB

MD5
d509152b0df9be8844bbe4c5f46a2b4d

SHA1
0c03e6ae002137d917a8275df6f5a244e7381066

SHA256
211c31592ae28ea4e057cd400a794fc763f45200ef782e6fb9ff1415fb5ea8e0

SHA512
afca33c69bd5bd902ec9350c1ef6dc7eabdb0262a499f898457a0758ad4a44536929414b7aa8cd994a76b2a45f0647ca6bb8d50aeefa356fa87c8d8488396388

Download Submit
C:\Windows\SysWOW64\Bahkih32.exe

Filesize
203KB

MD5
db65eda0a7c9c36d73b02656170b824e

SHA1
cb079e7250e9555576ffcb830fdca8c58dcca76e

SHA256
a5b128a85f6f0452cd7d031362bcbbf280d1cf260ef6cd558b73aa1229570859

SHA512
26c8c32964c2c883c4d176e7e2faace8ae57e8a4d4c3a319618b3646c97127d089617e213634ac283477c27160fefecdfa4885d6f77dc14c96aa6f8185fe5a40

Download Submit
C:\Windows\SysWOW64\Bdickcpo.exe

Filesize
203KB

MD5
ee94a01363f6d3580b323248eb7724c2

SHA1
16b5d61111080931b38354460790025b270695d7

SHA256
9fce3b0e5679516f5890e2f3120a8a760c7186e55e74753538b959ee7381fb8b

SHA512
daad560ae3dcbc825a4e52f733b4c2c02723f12d4a14c9811f97ad4e00d2cf1d7b04599aa29304f64338ad15a467112e5a206fcbaa0382f68d2a931af47443c5

Download Submit
C:\Windows\SysWOW64\Bepmoh32.exe

Filesize
203KB

MD5
7a7c89f2c6ebbe2c7476f60de103091e

SHA1
34ee8185cd7f98735251538bf2b028465f5183bd

SHA256
6bd22cd9b50eb655297d28a7bd684475088a3fef266fcb97f71d88f4e5d40176

SHA512
2ce4d32f41665f29ad801b066e8c652a15301617c6b9729225d7366cc8e16bd9d07fe49a9b34aa1c685c0e6ed44320c9e42ff72c9bd0562e26b8887c8ccc6c59

Download Submit
C:\Windows\SysWOW64\Bhbcfbjk.exe

Filesize
203KB

MD5
e2116a89ab21d4e0dd479b92f8d71bec

SHA1
87702f7722b64773c3a27327745357ee1c116169

SHA256
3cba527e4917f5885728fab32a69f2a79c47f86ae3b292688ace8739afb1987b

SHA512
bf6d13d60457d533489910382f57b5486fa9aa6878c553ee59d488753fcc38e645664dd73ed4e80fd2c6cd5e21a94b2449d8afcbe652136c44dc615dd50b265d

Download Submit
C:\Windows\SysWOW64\Bhpfqcln.exe

Filesize
203KB

MD5
efa4fc7f3e656dea10044982d4237abd

SHA1
4b5d4230802ed6df147f9658788a4c7062a1388b

SHA256
20b0a6ff9ceadf20ff91cf22b4f1c6cfa1c42ee0c36a03d34359b46ab01bd1c2

SHA512
df09a1b1cf0c4fafcb9b4be57f12d02936b202785129149b8090e4ee82b9b74f2c81bcab72af0c12ae6a18db55b964284dd4f9ae44be97d001395fd175a999e8

Download Submit
C:\Windows\SysWOW64\Bklfgo32.exe

Filesize
203KB

MD5
f0bdc3e99fc5e970762386b328c7baea

SHA1
a89a801c6f849b2623bdaa7ad4552093cfd58d32

SHA256
8573393d71eabd2057ed9da737c1e2bdb109ad1a1d0eea2e1d31ab2354344302

SHA512
ab29eccbeba1fec1e7751f4f9f02358c87e8ac4392248ec69af2ff7e201c675abb0f09c3e414b26ab210085da1e4de449c612fee3183c8aea88016414a343437

Download Submit
C:\Windows\SysWOW64\Blielbfi.exe

Filesize
203KB

MD5
4de65cf35c0be33f072fa53765e30d06

SHA1
87e413cd9281137d18ba5d50147a5e36eff9d286

SHA256
98108a7a0807f2e10ac440a5ae37fe5d7019c80cb5116751296860e6a5ba686c

SHA512
e8e5b22048fe4df6f0e37453bd0e15231de999d1d97ec3d40f42aa6d4ff476d508af400da07e185727dd175f1f36dc5e2d24334a84358c819d5bb0ff976a60a3

Download Submit
C:\Windows\SysWOW64\Boeebnhp.exe

Filesize
203KB

MD5
af8c8a29b6355fe09d4a08d300c8a3bc

SHA1
18ab6234ec04bb6b19d47802dfb6b24c2b2ec983

SHA256
cede1f95ef9f0452d88f58a28d38f299eb9a41340232d9d424b608ee57fa322a

SHA512
eee4950b16310fba5f3f4acd81db4c5ef8d4f4698191b70f878a4ac77ec838ae136ef4b204e92ca9cbf68427862ddae05ec19ce983f2706fb6f3e7b7b96258ab

Download Submit
C:\Windows\SysWOW64\Bomkcm32.exe

Filesize
203KB

MD5
64953478cb55ce5744ab0cca77d35953

SHA1
3a6e74ab981ff772a43b9b61e50763d0cc543f7d

SHA256
838aac39a8dc52914c7ba22ac8cf40216da8b9bb17eb06142c5a41471f83ab91

SHA512
f24e06f2e819173a41f588f4bdf5bfb18df919cabe6cdca9d06458f55c3162614e418ca977f456f40e0990f0875ced02819563de2477b3fbad6e9caa246026f4

Download Submit
C:\Windows\SysWOW64\Bpkdjofm.exe

Filesize
203KB

MD5
c6dc7ce2ea3c4049c4654d08a45dd911

SHA1
def1410eb2e76e2b1a8773043aac6096db8c12f2

SHA256
27418da485f015320bb1c92d5b224f9f07eb787826e5c39aaf8032fa2952d27a

SHA512
96bcf9c4906fb5d26db03a94895f04a5895d7fb2b473f813c4dc65a7aedcac09f06689285b4a968e30d93efdabc5391672eef69783719fbcee8c53df6e42a898

Download Submit
C:\Windows\SysWOW64\Cdbfab32.exe

Filesize
203KB

MD5
d194e9b0958a4f551a925ebfb56f45f0

SHA1
ffebf74df555c7048359a0cf2eadf56d747a6ee3

SHA256
df732c554c70f8d81e214de7ab5528837acfdef63da0b413075b375c14d395bd

SHA512
0e26710cdb6b22e32e09146333de451bfe65a46a98d10b9c15de808ca18efe95f5010958da5fc62243cc2347658914ac7c5f4d439809aaa504301efbeddff6de

Download Submit
C:\Windows\SysWOW64\Cdnmfclj.exe

Filesize
203KB

MD5
495f961c1fc78473299c8c4d48a455b2

SHA1
4a19a3945fafa73a0c8edc0d3f1762556414484d

SHA256
78f860d620e7d982e9569c822abcacdb705c477af8283a623c315d1473c344ee

SHA512
88c0f0df1d7510eaceef1b740cfe8c6205c8b1829549de0432f45a7ca7b3cdda3a399b4325b1f5fecc5f0ddb6b7e1b2b6c875b1fa6b607a4fa98ae941e0b3be3

Download Submit
C:\Windows\SysWOW64\Cdnmfclj.exe

Filesize
203KB

MD5
ae92fae49be455f39c180d1c45b0f7e8

SHA1
765b6efc6b15ccea5f2f88e53ea5902ab3081632

SHA256
0dd7e17bdc34f6a3ab5797aa0250e8fe0890b85857e2ba134c174de5e7bdac5e

SHA512
2d3b3414bd8a53e542f9183b6b0f5a920d9904b9f17c050463479d57dd38e5c95bbf49ad26d65c12c4038b6f1c47ae41b8da32e5408f2b79c7af4f2c3150dbbb

Download Submit
C:\Windows\SysWOW64\Cfbcke32.exe

Filesize
203KB

MD5
432cbeef2e0d5c0a4ae71e9f6c8bd391

SHA1
a0f54312316508d705ef8d0be7c137682b351397

SHA256
cf7b8d5f55e7b57c3f3473e27f173bf6e54cf8326717368f8b92e8bb66d88a70

SHA512
bef1b6017ddded18cf009b87ce7225fe128b569b546b73bcfafcb521e4d48c268cb501706fc6145fdd28deee61061bc8ad0d516af8a105ed181e2e09dc67e449

Download Submit
C:\Windows\SysWOW64\Cfipef32.exe

Filesize
203KB

MD5
e424c6ebde01167c96bc88be5baa69a9

SHA1
d76c8b153a68ea6cb7b94df7640aea34cecb63db

SHA256
a322310f9f2d779f8be610562594907552cbe84bd733a4df08f64e2f2456aa54

SHA512
86d4ac85c7c7a47555b8364183ed1ec41d9b383650783614d883f68cbab60fc66ecd0b34f1cb14a0b9f7946c33911fae165e6418f7dc71ae7be5750851774ad7

Download Submit
C:\Windows\SysWOW64\Cfnjpfcl.exe

Filesize
203KB

MD5
d4423cc3d08849243c91f48232a18e06

SHA1
6d9d6ce7bfd461deb4d7d0a08434287635aa023a

SHA256
34a1b1a2b3eda28efe3261431804823e3ea5eb6575388c3e695c75890ec17af0

SHA512
e3726e5a86527dd6599cc5c22a9654818adccb44a7bb30d4cb06c186448863e4a62c75bd5518ad29973e6ad143bb0a2953901897acef28effb3cadc547e3f18c

Download Submit
C:\Windows\SysWOW64\Chkobkod.exe

Filesize
203KB

MD5
1571d9d16b481382467a7011c65a19fe

SHA1
b26b54044b5d0abaf47d9758f645e9715b25c907

SHA256
96cc5d410eca39b80b0be1b8c78456719926eb9f2b13f71eefacfa0eb96ab218

SHA512
cf94b5e47176cd9bb9ab0f7beabd6b8c69bfe3416854c54bb6b54cc8d2168fdec6cffad531a8f642966c36025a1f83572a6045fbb44198804e1146716c9c96ed

Download Submit
C:\Windows\SysWOW64\Ckclhn32.exe

Filesize
203KB

MD5
0e1df830909e94f53bd067ee3984def9

SHA1
1812e310a4eb91f80f32d9e5c3f30c042929cb30

SHA256
715a6a885068ad17deed6bd1f754eb77322e90e9f18e4aef9cd6c34312c3b0c5

SHA512
ead85f7c8cc640e58611b305cea2e99396d89daafea68dd4646c6e7a61d8afba403a85c5a91d013971e30fc50392e3f594f2844bfd2f42cb208656b1f961928a

Download Submit
C:\Windows\SysWOW64\Ckeimm32.exe

Filesize
203KB

MD5
6ebff3ecece731aee7d83c548b560e76

SHA1
711dd67619d86f78fa6ef92535c6b840c99105fe

SHA256
54b7ad967be9ae59d39d4422f919be8d4372b0b2eada583308ebd7fadc650cc6

SHA512
18fd0e7d85513f599f7935b370e1955adac1e89547cdb2ec14166a03b686b54bdf5d467e8cf6e57499ff53931bbc8dcb9d885f98253706493f92db7d6677f7ce

Download Submit
C:\Windows\SysWOW64\Ckjbhmad.exe

Filesize
203KB

MD5
84d8d47b205d42e84bcf87f51777daf9

SHA1
e79dd8128415aa49998e665ed21316805db85fc1

SHA256
11d8c0e2d3940b6d8e26643a64c90542b7e6a2a1ac2592e9800ed17ae2645cb2

SHA512
80d492d91948e3bbeaa7850cd559546c2af9338babb27dc8ab0986333d77d8c3d45f461f2d463019ccbd97ec05c10b1ac3ce3847871bdf6e4b201516ac35c657

Download Submit
C:\Windows\SysWOW64\Cljobphg.exe

Filesize
203KB

MD5
6f4f9bbe76b89c002d07ec6473de50b7

SHA1
4dab1256bfa5dec7f26ed862c25e0b6cbd4342c1

SHA256
76f70a26d15d0e662f67da9de99d87da837240237e2dd3a5a84d772e7443ba53

SHA512
ef3676ed65bb759a6c5e7c5149357e68d0a2e895f89875f869cbda506b9b1aa3cd5638f0ee045275e4106e8d06651f6685624e6981bb13eb228112052e5a08a2

Download Submit
C:\Windows\SysWOW64\Cnfaohbj.exe

Filesize
203KB

MD5
d2dfead2ede5cb552b0987a2a8180896

SHA1
9c835b5942fb87b9503fc0edc4873e887b86cb12

SHA256
6498c4bba19ceab50af2977c64e6286dbaba8cb9117e10c770d5b3f3cea71a60

SHA512
2764076eca176e55077177db7a75279dda14df68ce03483d5bc3b98cc94df1b762a6009fd0206429489d623bfeabfba3b465ee929b79b09eead511f390c3e18f

Download Submit
C:\Windows\SysWOW64\Cnkkjh32.exe

Filesize
203KB

MD5
153ddfd5d42d29a39da46067a534d66b

SHA1
e4010a5d73ceed8aafbfca7a56f0f91359bdd568

SHA256
3ec537ed48b019b0f08d1a3df2fdf1b37cdcd4005a0674e17c14e19198dd65d7

SHA512
4dab925c52cf53f5b907f45b12431915f6d5d26ce9c824290fdc4b084c2171ec9d3955dd407b73980c2cc4cc8cec0b672489725459410ca9ccf5a8059d23df47

Download Submit
C:\Windows\SysWOW64\Cpbjkn32.exe

Filesize
203KB

MD5
b650f0f7183685402eba139c67c33768

SHA1
1ef303a33fc3cdfcb5d1dceebc83d432de66200b

SHA256
8693b3f139bda7c62a370a5aa2f484ac42095e326d1ca1d830aed483fa564480

SHA512
f89b091c51e369c8fdd819804d9ec2667599f30bbf04deb2b3893aea1ac80dfa783f743aec08283b481d45eb316ef424fa1d284c8562c0762ce72c42e2584c94

Download Submit
C:\Windows\SysWOW64\Cponen32.exe

Filesize
203KB

MD5
f28a1b1cb99bb9e0d86db4a8f6e4afa1

SHA1
860d07bcc6ef5cba0fd264df9f5c0639cc746f50

SHA256
6eb74daf985f572426e5eb91e4387b56fe74877ad4aea31287717fe3bcc2afbe

SHA512
741268c20a8e155ed6e0232f78977ee3d31329d9f1b3073eae76d1318055932d6c53070819f0619ceada00ca9121ab0d7192b99d54b2d0d29199e0b89c29c935

Download Submit
C:\Windows\SysWOW64\Dbkqfe32.exe

Filesize
203KB

MD5
7ed293b968e65d96586fd1aae2c4472b

SHA1
a704f50c5e97cde30543b673beb36179b360b16e

SHA256
36593736669129e7f5e4689d152d7e3bc9e5c6b2e800153c569edb0bc320ac15

SHA512
3be52064fb8857eb01cf60ea8405ae37ea01083f0bc9564658c6309a8544537699dcfb21a18003cf375cfef7a23c05d5055af2478bac20730ef246ed92eb156d

Download Submit
C:\Windows\SysWOW64\Ddjmba32.exe

Filesize
203KB

MD5
62710a2169e062c44bf12fe8760e6891

SHA1
f6250f1b9219d37d25428659876b67f7746ddac9

SHA256
7c7859788e7bda9f53686a583a994efeb058c50d756f730ed5d30310f8faa641

SHA512
39825da9ae521315b3e40037613deea033628896e532881a455086cb86886016032eeed44879e9c506a2031c9dd35f1bef9d55c5280bde7d54c236dabeac2c5f

Download Submit
C:\Windows\SysWOW64\Ddligq32.exe

Filesize
203KB

MD5
30db0b7865afaa5f77dd334fd26003b5

SHA1
c0890c4767935bdb16d1f3d6a5debfd7ede7da7b

SHA256
1433833130f60ffac86210d09ed2664f96239dd7fd8ee17dab9fb774c7e50f06

SHA512
ea013c52f96be64811938b04fc25fe420dad53aac5e34d5798452037b05a0227175d43ba9934a26e2cc437e44af0cb3a56c2f84332c861229a3ba6a56c4d0a44

Download Submit
C:\Windows\SysWOW64\Dfdpad32.exe

Filesize
203KB

MD5
0bbdbd831d15c6df3fb371f793271e69

SHA1
855ff7840dedca692f1ad3cbe8155e3b95e307c9

SHA256
f968cfca6524c89894b45769cf93fa880f4216c273ef09d14f93375ce97a405b

SHA512
54de5bba94a2240330a310f14d4d2fe70d1d9723241c814d7c2552e1b92d12b0b11b35cd6ab8d4a8887777cd5dde37b6fe2ddb8c3043988d5d2695922b6fac61

Download Submit
C:\Windows\SysWOW64\Dfiildio.exe

Filesize
203KB

MD5
9246e5e6e13eb63d525dc1361bae4847

SHA1
e9568f47a44c31ea54f1586127e7857d049e01f7

SHA256
6170d4e4c0039e2901d44509ce8598a97cf5b0cf8a04449afce45585145222ac

SHA512
c3e2e33638a9c2166edd7800a14114a5238d64265ac67079426d5c3bd71e7fd346ef005e166a8fd3845b29b837e0955b4d2fa57b05610d7388df8aafb447c157

Download Submit
C:\Windows\SysWOW64\Digehphc.exe

Filesize
203KB

MD5
f985d214c9126f2ca9abdb94c198e4e3

SHA1
7da11511df4adaf71a5f436153d213c13ecacc03

SHA256
7d4232b7962cbe27310cdd1b98fc56d28f53796088a5b0ae8ae248ae77d66969

SHA512
066aa2d11e7029e135c17ee629242d178677392fb33f174414d62f2af140229e1a7e5b52aecb033a722a4b8a2df95b455dc3799e69be9741c46b9b69533c3231

Download Submit
C:\Windows\SysWOW64\Dmadco32.exe

Filesize
203KB

MD5
dd50c7b16d3108cbd0bdbc6fb5efbc29

SHA1
7298152e8935aea1dd201e8054d17c74efa39820

SHA256
2846e71f483de0d7698d585a429d6b4371af8976cba92d4340d256596987ca1e

SHA512
5a81ebb18967770692608133009de012e8afdaed97bad0d3b5d98ba5ca08ab7fb16c773b77daeb9179051370118dcb5b97e4db9161822f495dc8e7ec2fb73f26

Download Submit
C:\Windows\SysWOW64\Dmohno32.exe

Filesize
203KB

MD5
c09899994dace42cbb1a4aa5f98d3550

SHA1
132f9dd907e629975bc2250a1f1af604425533b0

SHA256
3fe4c808b5b8f02a0d1c00e363b67dbf1ea4287f26c1059af5c822d7c8d2e980

SHA512
846d0f560088340b1621d68e09be7c9431a79677af1aeadb34d84794f9e296a7d77934f1aec8006d3a3b7a3743eed0c2af54a26d636324526420cf3c07a0b1dc

Download Submit
C:\Windows\SysWOW64\Dndnpf32.exe

Filesize
203KB

MD5
6ce2b93cd77370c818eb39814bb858a0

SHA1
8bc8aa57025868f9f163837eaf3eeac4ea271206

SHA256
07453dfc1c2998702e158df96319ac5434daa04769d97c7a5a42728e5376129a

SHA512
e2538027fc509fc9a54eef97bff986a18b49f460a5bfeceb88d0aef44dd4318b7f378c399761b0c69939079aa363931de426cd29ba5d9d7c154ddefb7c3a5911

Download Submit
C:\Windows\SysWOW64\Doaneiop.exe

Filesize
203KB

MD5
215f0faa013f3d7ef46ffe3294fd7107

SHA1
0729c1cc2489a3f23f81229a7f32a64faf2b005c

SHA256
25273856243a544602f045f5b325a31f1be66df1e064f4c4bf50c2cee753af11

SHA512
7bd35ff25bccd482103dd70241fea6a0157a3f190de2430b87ff91149aa5649d0a95faedbc6a3be80d973aafe4fa030a16fbafaaea4037de49601456ab22f58a

Download Submit
C:\Windows\SysWOW64\Dokgdkeh.exe

Filesize
203KB

MD5
e1f6f3114162e174bad332889bdac872

SHA1
3a9f4daa559eb2060b10fd38573943448e6e4601

SHA256
fe80e922cfaef5fdde6b17f881ea711812f63605b30937163fa4bfb142b0ae21

SHA512
77f17d93e5b74a688af7042ba005774509d746b7adf2716301e005d9acf8cf231d382863c606c6f0be58c4dc822392692b88f4f5ac238500e7c428e5d43113e9

Download Submit
C:\Windows\SysWOW64\Domdjj32.exe

Filesize
203KB

MD5
a431e429517675bb8c8f01a88673b70f

SHA1
3c13ccfa3f693e512b2f5f8bbe8165c6f78931bb

SHA256
6d3c18d4661d613e1055bc924eebd1a5e4fbb2f7cb7b3edbcbee7fd4b1dd21ae

SHA512
cae00de0f7463690b82cc44ce17473387dbde25aa17caf9685b37366eea90dc09ffc2a412a1079c27857c56e0febf7c8618e8cae85fefe1f95253e329b6b6455

Download Submit
C:\Windows\SysWOW64\Fefedmil.exe

Filesize
203KB

MD5
76257ad1d065c4f4f531eb3096eac97e

SHA1
44e5db54ae1153cff60eaeb810cd31a1d221c374

SHA256
cb11d417248a3cc6dd1a3e7efce5b588ade34a810d0351db87fd21631b76e2d4

SHA512
50640d9add964351859ec93066c13fdaf7bb95c509beecb0a73309a2c9d7f0ef7db0e9277538aa11eb5c5be24ca44e3a9fc70af6989f9e73b9c26e4f9d889322

Download Submit
C:\Windows\SysWOW64\Flmqlg32.exe

Filesize
203KB

MD5
a2f9b12a1f3d0c40826cab2d137a52ff

SHA1
71e997881e54a98eec7073c6c46026872a881171

SHA256
006f17d51ec8933f42ee5d7811bced7d632aac61abcc70bbd442d7d0da10bdf3

SHA512
bab444a0c53a8a25286397710edb9b5775e1c974fb58519b6c6f8e4331eccea2b0dae96103e26a0b8e55f0b1e88527315faef6cb819564bd430baece3d3b883c

Download Submit
C:\Windows\SysWOW64\Gfjkjo32.exe

Filesize
203KB

MD5
18f5f3238adf210f99cb01b9e581bef1

SHA1
e63500cacfc126bf06f6e641965721db2970f308

SHA256
307eaf541d78d730522c566d3bb4b4893b4a1cc5a34affe3d1a2dce761548100

SHA512
97108896197770d62c9799d57a44cdb34bbf612da0e682d95d691df303a321c3adcd397ab77f4c35b1d84fdbcc09c9a8609182f7c2e30ed6e31857b31af752f1

Download Submit
C:\Windows\SysWOW64\Glkmmefl.exe

Filesize
203KB

MD5
0a60868454c209b86ee977bb9390761a

SHA1
917c6fbb80f4ac7e0b579651b2e1871c8c2bc9ce

SHA256
554496728d580d4dda644c10501fef15bb7ad09655c24f9ffa11cb0faeeddc38

SHA512
66faf85672271c278e6c67e88797f1b88743f3f1c11f00237c4f109882947101e536b83b4a4562b81e844509989a7a8f2238bf017cf94323d8371b3189e8b0eb

Download Submit
C:\Windows\SysWOW64\Hbjoeojc.exe

Filesize
203KB

MD5
7a1ca3d27038d7063feeecba551d41dc

SHA1
9318b901a66dc0563995476fa6fdab2e6a2b4303

SHA256
b5a4a531fc4e7c98676ee1b9585eb00ab6776848393009c703877e2d351af031

SHA512
b35213393831b1c05a724a9021baa6d791c322df151b59cb9e101bee3ba12c5b4e6cbd3aa3d28befcc135370818d3210ebc44bbd6fba5a80dd45433cf0eae5e6

Download Submit
C:\Windows\SysWOW64\Hmbphg32.exe

Filesize
203KB

MD5
dfb28025e871ae697af85dcedfe509c7

SHA1
42090e9dfa78123fb04f0cdc4d715af11ef4f30d

SHA256
91954ccbfface78e660e5b19b202fd67d1e31840f6bedce2a9f8e1cb8d297319

SHA512
6e84c46ebc223d6d0016a03815f39a778f9af2c925b9caa39468ca9822431567e722ab98f226f4cf63d16b941117e7bbfb06ad116673be41d82be3f1732a92f1

Download Submit
C:\Windows\SysWOW64\Iikmbh32.exe

Filesize
203KB

MD5
5ae1edb248418dfbe607e1ab26b1328d

SHA1
61cc54a0e6d9c0d06bcdf12f5fb07ab6fe2b324e

SHA256
9c45873f1f063bfe2c7bd6871f372130972edce8280482de78f420144203870f

SHA512
74aaefb17b9a0527c257720a5ca16fe47b8b40e589a749e547da4caf1ff41152d69395eb1b6266943a1feaa9daf127832923b3f3e72aeb487ce36f90b4ffcdc8

Download Submit
C:\Windows\SysWOW64\Jepjhg32.exe

Filesize
203KB

MD5
93cd6219c09d0f78584e31d7ce386081

SHA1
7ca8892bd3c015b4caa123d9db74f475c02a8a44

SHA256
b96a236a0bebc348d4d0eb618688343addfe4b0f1d0d733706f444400dd6489c

SHA512
e4acda350f8c7b21d580f4ec4875f4868231610085cba01dfef208c69522f3f3b5cef386b931b097bb5aded48eb5987aecac983a85e17671012dd275b0614764

Download Submit
C:\Windows\SysWOW64\Keimof32.exe

Filesize
203KB

MD5
193eedfc00e8fe5a3709f0fe7292d761

SHA1
2459e747c2b84bd239e3db315d4f190fe05bb83e

SHA256
c6b842274985a356054d970c9cf776d7908bf2b867a101896da8f9ba656a3e26

SHA512
259a92b26e846cb5ca010dbfde21411697912453cb5aafffc8936e9d99d4f59b3c73af2581e5495065459eb504161eeac7c0dc1b6b536c5825af805b93a25b05

Download Submit
C:\Windows\SysWOW64\Lpfgmnfp.exe

Filesize
203KB

MD5
610c69e6ff9d8eaf0d826402bdd489dd

SHA1
0db568df18a75baf47452f00fae7a6eb7fd1add8

SHA256
f38562c173b567f00534d02cb7b74184af86eb5497f713a4c14edbe45022a54c

SHA512
b62e5590a1e6c0f1b537abb2dffce394924459eb46a9557224b935625bae96fa3f363e82046c50f6d046d4fc46ffe2ceeac66c962647b4d2efe85844e97a0c30

Download Submit
C:\Windows\SysWOW64\Mlgjal32.dll

Filesize
7KB

MD5
cc96cf127ceff7614ba899d49bcfd2b0

SHA1
1ac3299a387b7562c3f668dd5fd1e364aa846aa9

SHA256
86d7bfebd0e1d4ead38a431989a0b6f9075c06a769e2cbe6663a87d1c8e27995

SHA512
65c0ae8d94fd95f3b8419d5c217ffd17d97f6e937247a49db5aab776438d4d5c7a9621397faec2d63a5a605e2f936194d00fa21c5acd67a026067ef8f8d78915

Download Submit
C:\Windows\SysWOW64\Mmpmnl32.exe

Filesize
203KB

MD5
a1f78caac0374cc7d0e2128583474f47

SHA1
539ad6305116e00304c4564b3b07cc602fc845a6

SHA256
4da51089102fa3825a1e11073e00968fb80e5df5dd55a4c9c5c4536ca143dcf0

SHA512
7c69db74e44e13e0c25691c838e5dd191408e99c53d7f85b73c9524959f3c92d81d9faca50b3242915f21f86450a718c29c824fa05f14b7959ea24acda01a5e7

Download Submit
C:\Windows\SysWOW64\Nadleilm.exe

Filesize
203KB

MD5
d09873aeb25e617e8fae2f75d9e17b04

SHA1
947ad43b35290ca6c09b7f3b079f433897d9f2e5

SHA256
19c7967192951dd715578288008a8cb2c3de73c0f4691a1d11f2ea0abe138bcd

SHA512
671bbd01faabb5f52c2328c1cf5c4ade7e22b1de888eda9d191bcbd490b228358feee6d8ca28efebd61ebc6d724b9da6ad402f80e3c2893d4e92b51536b6908b

Download Submit
C:\Windows\SysWOW64\Oabhfg32.exe

Filesize
203KB

MD5
e32390fbacfef001f1248cf96525399b

SHA1
d33fd578c46e02ecbba7dba716b46f5ffd5ff9db

SHA256
45933b34b943921f8a441f0d9c055d76e417783508a4b2cf65b0e0c6f9108776

SHA512
736777db4cd13b4f713a19cd1b750f9dbd2f2cd6f043603504ee1a75058e0d78f1eb51e7f684446527de8d87ae4146ab5f67ae5ac0cd2f97d87dba2826e62129

Download Submit
C:\Windows\SysWOW64\Oakbehfe.exe

Filesize
203KB

MD5
a54c9885cdde6ae3c3565ee8c75a9e9d

SHA1
b69da471e784bfc45a4d0c3654a810378b6dbb7c

SHA256
42e1ef05b0b8ceae3aad9864db6d9b522fd263e614e2543920f2ef2e8920338f

SHA512
3727ffd47eba98359ebbf90a1267e7bcadbc3ce97f0939163d37bfc149be49caf4688712a927fe48ce0dc413aef7fec135380e905393ad765c87cc066a075e12

Download Submit
C:\Windows\SysWOW64\Phcgcqab.exe

Filesize
203KB

MD5
5968ee876f1deeaf3e098d5531cb20f4

SHA1
09b26b5c266841fbe7465495e504801dc297f66c

SHA256
39ca546def5310919ace98e081cf73bbfccd4a13fda1c90f6675e9b28c60d4b7

SHA512
bd601d87342e8d82a6bb2a9035e5dc3df35166e7d2132142018cf3d26a02d4227cb61554a4266943d159ae329eabe55c166c030f334b6a4693aaf546cdece607

Download Submit
C:\Windows\SysWOW64\Pmpolgoi.exe

Filesize
203KB

MD5
cdd0f0403f9839bae04b5ab059b90edd

SHA1
15e96b3f47c8cfcc95a5e5dc3954b6a40cc1b6a9

SHA256
4636924ddbe5ef60260dd730f85d51f0939c604a23bc8d4e82106bce57e3aa46

SHA512
b3fdabcd03bfb254c7e6db3772f414c8b5d14af40eb36882d4dcc42ec799d8b2ac1b10c6728b7eb5370d04130b2ba34ce9fca471e3d968bd589fd85e068a28b4

Download Submit
C:\Windows\SysWOW64\Pnifekmd.exe

Filesize
203KB

MD5
d75e37a5fcace65d71dc45e8fea6b41a

SHA1
4ced9aaffafe4ce8b1c4e2a5bc92c04af4fc1e7d

SHA256
22df0f9e3c1d3414b11edefff5308db54b32fbb7514233957f24eea8b39619ee

SHA512
74139343aa64b8a67209319c9bd92ee21fc2b6c91bb8eb715deb235842e5214c3e0382eff581c307e322f1b464417a4f3bd13a213970faebe5e5d6b842ec8e47

Download Submit
C:\Windows\SysWOW64\Qfmmplad.exe

Filesize
203KB

MD5
b48128bf5fb81ea6c8876cf4f14e86f2

SHA1
7358e49a5e7eb27048cfdf350dcec49feddef113

SHA256
67b9cacb0f2668e66f5b402932a2fd7943cfe38d3b781c501dbb6e73b52bef57

SHA512
e839615d31d6ca220f163ac4e5252ce04b0756919e24ab0a6414d2a50a7ece83a19ec43d7ff622a5dd4af56e2940d7c0f7fac9e58b9a158371520777a71a0fbe

Download Submit
C:\Windows\SysWOW64\Qmeigg32.exe

Filesize
203KB

MD5
34fcef176390204175d72615dd7320bd

SHA1
139d58913b246841e3efb38e95a814da15fa0beb

SHA256
c779354a363b8de3890b4e1293ebf67420f0a2e05dd3171cdd5f5159413ddb58

SHA512
ddf449492c51244ab29077a36c11e69a5fbcd649187382ae664f92217ba3ff4bd0380a62c3ae49cb5974098b09ef158ddc6d8c2aead5402ecd165355313de3fd

Download Submit
C:\Windows\SysWOW64\Qpcecb32.exe

Filesize
203KB

MD5
baad4d61083a3f4b4c4420e271f3e42d

SHA1
dff3f0a27f694300559c8c935c60fe04ee9a7da0

SHA256
bb1884557a11bedfd39bce874534da5b2d618657aa246fe2de8881433a060cf7

SHA512
5a1757e5cea36137448e37ef3cc2f84f484117e650c1baec291b2cc6c3b085397777bf200401d0f43bdf8f9fc382d3cc6fdbd6e6e90be9150eb21e739b7a0b01

Download Submit
memory/116-197-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/372-430-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/384-460-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/400-236-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/636-344-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/732-325-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/920-301-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/996-149-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1016-244-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1076-418-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1080-374-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1084-168-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1136-40-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1488-334-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1520-424-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1664-300-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1724-394-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1800-128-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1924-368-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2020-87-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2088-56-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2188-304-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2280-103-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2356-160-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2400-412-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2408-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2408-610-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2416-48-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2484-20-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2484-624-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2488-328-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2500-297-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2532-84-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2616-180-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2692-72-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2700-436-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2708-260-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2736-298-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2948-299-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2956-617-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2956-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3036-211-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3104-407-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3148-388-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3188-454-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3520-64-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3648-448-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3676-183-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3684-136-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3736-120-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3844-212-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4072-248-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4192-382-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4288-326-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4320-381-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4336-352-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4364-400-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4476-296-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4548-112-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4564-27-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4580-237-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4596-446-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4608-156-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4652-36-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4772-358-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4804-346-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4872-235-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4884-302-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4980-324-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5056-95-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5156-466-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5180-615-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5196-472-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5236-483-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5256-618-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5268-484-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5316-490-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5356-496-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5396-503-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5440-508-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5480-518-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5516-525-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5572-526-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5628-532-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5688-538-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5728-544-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5776-550-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5816-560-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5852-566-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5892-572-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5936-578-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5976-584-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/6016-586-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/6056-596-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/6096-598-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/6136-604-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads