1f7f26a7eba37b27b1a556eb8cd8b1a2f6dcb52b8dc81a4215442b69f37bc666

Analysis

max time kernel
139s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80103a095bd40eba9c71d6f80ba8c4a0_NeikiAnalytics.exe
Size

62KB
MD5

80103a095bd40eba9c71d6f80ba8c4a0
SHA1

6d3642ab81e5a7f1cec3d23d08732f1fd3296a53
SHA256

1f7f26a7eba37b27b1a556eb8cd8b1a2f6dcb52b8dc81a4215442b69f37bc666
SHA512

d7da712557104223699581748c3ceaa9b31b39ceeef7fb72927f5e707d5206f9b646d57a7b99aecc851c4219aea494fdf247dfcb5dea88e620453a317ef09e3b
SSDEEP

1536:swskhbARGcDyao/xSYCDicc2yP0ve8Cy:f9bpQyao/0tS2Bve8

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbioei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekcpbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndfqbhia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hihicplj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qkmhlekj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifgbnlmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmioonpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkdnpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcbiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Angddopp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Becifhfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eleiam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Domfgpca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbgkfg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcqjfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckpjfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlopkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlcifmbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lilanioo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgjfkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjhbgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbcilkjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odocigqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dboigi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Paegjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlednamo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afoeiklb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffbnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fflaff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iiffen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmdina32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgkjhe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipnalhii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kinemkko.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glebhjlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qceiaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odbgim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alhhhcal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Idacmfkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abkjdnoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceaehfjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jehokgge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Migjoaaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gqfooodg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibojncfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifjfnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhfonc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Faihkbci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calhnpgn.exe

Executes dropped EXE 64 IoCs

pid	Process
3192	Dhcnke32.exe
1848	Domfgpca.exe
4848	Dchbhn32.exe
1436	Efgodj32.exe
2800	Elagacbk.exe
2404	Eoocmoao.exe
3972	Efikji32.exe
3920	Epopgbia.exe
1640	Ecmlcmhe.exe
3968	Eflhoigi.exe
3464	Ehjdldfl.exe
4224	Ecphimfb.exe
3244	Efneehef.exe
4376	Ehlaaddj.exe
1972	Eofinnkf.exe
4360	Ebeejijj.exe
4772	Ejlmkgkl.exe
3172	Eoifcnid.exe
1824	Ffbnph32.exe
3292	Fjnjqfij.exe
4988	Fqhbmqqg.exe
4180	Fbioei32.exe
624	Ficgacna.exe
1440	Fcikolnh.exe
3456	Fjcclf32.exe
2248	Fqmlhpla.exe
5104	Fckhdk32.exe
3264	Fihqmb32.exe
2676	Fqohnp32.exe
3708	Fobiilai.exe
2360	Fflaff32.exe
1304	Fqaeco32.exe
4768	Fodeolof.exe
3936	Gfnnlffc.exe
3852	Gimjhafg.exe
5012	Gogbdl32.exe
3236	Gcbnejem.exe
4664	Giofnacd.exe
2264	Gqfooodg.exe
3408	Gcekkjcj.exe
384	Gbgkfg32.exe
3524	Gjocgdkg.exe
3496	Gmmocpjk.exe
4392	Gcggpj32.exe
3152	Gfedle32.exe
4076	Gidphq32.exe
400	Gqkhjn32.exe
2364	Gcidfi32.exe
3652	Gjclbc32.exe
1744	Gifmnpnl.exe
1844	Gameonno.exe
4272	Hboagf32.exe
4340	Hihicplj.exe
4864	Hmdedo32.exe
4936	Hpbaqj32.exe
228	Hfljmdjc.exe
4512	Hikfip32.exe
4352	Hmfbjnbp.exe
3436	Hcqjfh32.exe
4552	Hfofbd32.exe
2400	Himcoo32.exe
2432	Hmioonpn.exe
4468	Hadkpm32.exe
4420	Hccglh32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Obfhba32.exe	Ojopad32.exe
File opened for modification	C:\Windows\SysWOW64\Aealah32.exe	Abbpem32.exe
File opened for modification	C:\Windows\SysWOW64\Eeidoc32.exe	Eamhodmf.exe
File created	C:\Windows\SysWOW64\Ecandfpd.exe	Elgfgl32.exe
File created	C:\Windows\SysWOW64\Ijlbqboa.dll	Helfik32.exe
File opened for modification	C:\Windows\SysWOW64\Qjpiha32.exe	Qkmhlekj.exe
File opened for modification	C:\Windows\SysWOW64\Immapg32.exe	Hfcicmqp.exe
File opened for modification	C:\Windows\SysWOW64\Acqimo32.exe	Amgapeea.exe
File created	C:\Windows\SysWOW64\Iblilb32.dll	Fqohnp32.exe
File opened for modification	C:\Windows\SysWOW64\Ipqnahgf.exe	Iiffen32.exe
File opened for modification	C:\Windows\SysWOW64\Jmnaakne.exe	Jjpeepnb.exe
File created	C:\Windows\SysWOW64\Mglack32.exe	Mcpebmkb.exe
File opened for modification	C:\Windows\SysWOW64\Lgkhlnbn.exe	Ldmlpbbj.exe
File created	C:\Windows\SysWOW64\Dnapla32.dll	Lilanioo.exe
File created	C:\Windows\SysWOW64\Nnaikd32.exe	Nggqoj32.exe
File opened for modification	C:\Windows\SysWOW64\Pkaiqf32.exe	Pcjapi32.exe
File created	C:\Windows\SysWOW64\Cpaqkn32.dll	Ecandfpd.exe
File opened for modification	C:\Windows\SysWOW64\Gqkhjn32.exe	Gidphq32.exe
File created	C:\Windows\SysWOW64\Jpjphglm.dll	Bdhfhe32.exe
File opened for modification	C:\Windows\SysWOW64\Pjcbbmif.exe	Pgefeajb.exe
File opened for modification	C:\Windows\SysWOW64\Mciobn32.exe	Mpkbebbf.exe
File created	C:\Windows\SysWOW64\Qdldlm32.dll	Pnfkma32.exe
File created	C:\Windows\SysWOW64\Klqmnp32.dll	Pgopffec.exe
File created	C:\Windows\SysWOW64\Dedkdcie.exe	Dkoggkjo.exe
File created	C:\Windows\SysWOW64\Belebq32.exe	Bmemac32.exe
File opened for modification	C:\Windows\SysWOW64\Jagqlj32.exe	Jmkdlkph.exe
File created	C:\Windows\SysWOW64\Apignbdf.dll	Ffkjlp32.exe
File created	C:\Windows\SysWOW64\Allebf32.dll	Ligqhc32.exe
File created	C:\Windows\SysWOW64\Qceiaa32.exe	Qqfmde32.exe
File created	C:\Windows\SysWOW64\Gcekkjcj.exe	Gqfooodg.exe
File created	C:\Windows\SysWOW64\Hfgefhai.dll	Hkfoeega.exe
File opened for modification	C:\Windows\SysWOW64\Mlhbal32.exe	Mgkjhe32.exe
File created	C:\Windows\SysWOW64\Njefqo32.exe	Nckndeni.exe
File opened for modification	C:\Windows\SysWOW64\Kpgfooop.exe	Kmijbcpl.exe
File created	C:\Windows\SysWOW64\Odocigqg.exe	Olhlhjpd.exe
File opened for modification	C:\Windows\SysWOW64\Daqbip32.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Jaedgjjd.exe	Iinlemia.exe
File opened for modification	C:\Windows\SysWOW64\Lcbiao32.exe	Ldohebqh.exe
File created	C:\Windows\SysWOW64\Ikbnacmd.exe	Iehfdi32.exe
File created	C:\Windows\SysWOW64\Ohfjnoma.dll	Imakkfdg.exe
File opened for modification	C:\Windows\SysWOW64\Idacmfkj.exe	Ipegmg32.exe
File opened for modification	C:\Windows\SysWOW64\Oboaabga.exe	Ojhiqefo.exe
File created	C:\Windows\SysWOW64\Bhoilahe.dll	Jeklag32.exe
File created	C:\Windows\SysWOW64\Hhqeiena.dll	Bgehcmmm.exe
File created	C:\Windows\SysWOW64\Gmdkpdef.dll	Olmeci32.exe
File created	C:\Windows\SysWOW64\Eqbmje32.dll	Lpappc32.exe
File created	C:\Windows\SysWOW64\Bbnpqk32.exe	Bjghpn32.exe
File created	C:\Windows\SysWOW64\Cdfbibnb.exe	Chpada32.exe
File created	C:\Windows\SysWOW64\Lmbmibhb.exe	Ligqhc32.exe
File created	C:\Windows\SysWOW64\Mncmjfmk.exe	Mkepnjng.exe
File opened for modification	C:\Windows\SysWOW64\Dkoggkjo.exe	Dhpjkojk.exe
File created	C:\Windows\SysWOW64\Jpnchp32.exe	Jehokgge.exe
File opened for modification	C:\Windows\SysWOW64\Kpjjod32.exe	Kmlnbi32.exe
File opened for modification	C:\Windows\SysWOW64\Pjeoglgc.exe	Pggbkagp.exe
File created	C:\Windows\SysWOW64\Hlkefpan.dll	Pkaiqf32.exe
File created	C:\Windows\SysWOW64\Anphnl32.dll	Glebhjlg.exe
File created	C:\Windows\SysWOW64\Ngknngal.dll	Gododflk.exe
File created	C:\Windows\SysWOW64\Qgppolie.dll	Ojaelm32.exe
File created	C:\Windows\SysWOW64\Ndninjfg.dll	Jagqlj32.exe
File opened for modification	C:\Windows\SysWOW64\Mkpgck32.exe	Mciobn32.exe
File created	C:\Windows\SysWOW64\Jaimbj32.exe	Jmnaakne.exe
File created	C:\Windows\SysWOW64\Lgokmgjm.exe	Lljfpnjg.exe
File opened for modification	C:\Windows\SysWOW64\Bgcknmop.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Ifjfnb32.exe	Ibojncfj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
13228	12968	WerFault.exe	663

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mipcob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afjlnk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbifelba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfhdlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bejkjg32.dll"	Hikfip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbgkjl32.dll"	Ldaeka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agoabn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Andgoobc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnicfelf.dll"	Qecppkdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpflfc32.dll"	Abkjdnoa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fodeolof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cilkoi32.dll"	Cbqlfkmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlednamo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jaedgjjd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaelmc32.dll"	Angddopp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qihfjd32.dll"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bobgoedj.dll"	Efgodj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Habmmpbg.dll"	Alkdnboj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qghlmgij.dll"	Gfbploob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbagnedl.dll"	Pncgmkmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjffbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhoholen.dll"	Eleiam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnbeadp.dll"	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjjplc32.dll"	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebdijfii.dll"	Beglgani.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgkhlnbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Baaplhef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlgmpogj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cecenn32.dll"	Doeiljfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Faihkbci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abckpb32.dll"	Jimekgff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abkobg32.dll"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqaeco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiphogop.dll"	Idacmfkj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqpego32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahoimd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Alkdnboj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Doqpak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gameonno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdfbibnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijmanlfp.dll"	Fljcmlfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcpclbfa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlopkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imakkfdg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Calhnpgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iihkpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmdkch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Heapdjlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chpada32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpablkhc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfolbmje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bclgpkgk.dll"	Ijhodq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fhqcam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehlaaddj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hofdacke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhbopgfn.dll"	Njqmepik.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 3192	3412	80103a095bd40eba9c71d6f80ba8c4a0_NeikiAnalytics.exe	82
PID 3412 wrote to memory of 3192	3412	80103a095bd40eba9c71d6f80ba8c4a0_NeikiAnalytics.exe	82
PID 3412 wrote to memory of 3192	3412	80103a095bd40eba9c71d6f80ba8c4a0_NeikiAnalytics.exe	82
PID 3192 wrote to memory of 1848	3192	Dhcnke32.exe	83
PID 3192 wrote to memory of 1848	3192	Dhcnke32.exe	83
PID 3192 wrote to memory of 1848	3192	Dhcnke32.exe	83
PID 1848 wrote to memory of 4848	1848	Domfgpca.exe	84
PID 1848 wrote to memory of 4848	1848	Domfgpca.exe	84
PID 1848 wrote to memory of 4848	1848	Domfgpca.exe	84
PID 4848 wrote to memory of 1436	4848	Dchbhn32.exe	85
PID 4848 wrote to memory of 1436	4848	Dchbhn32.exe	85
PID 4848 wrote to memory of 1436	4848	Dchbhn32.exe	85
PID 1436 wrote to memory of 2800	1436	Efgodj32.exe	86
PID 1436 wrote to memory of 2800	1436	Efgodj32.exe	86
PID 1436 wrote to memory of 2800	1436	Efgodj32.exe	86
PID 2800 wrote to memory of 2404	2800	Elagacbk.exe	87
PID 2800 wrote to memory of 2404	2800	Elagacbk.exe	87
PID 2800 wrote to memory of 2404	2800	Elagacbk.exe	87
PID 2404 wrote to memory of 3972	2404	Eoocmoao.exe	88
PID 2404 wrote to memory of 3972	2404	Eoocmoao.exe	88
PID 2404 wrote to memory of 3972	2404	Eoocmoao.exe	88
PID 3972 wrote to memory of 3920	3972	Efikji32.exe	89
PID 3972 wrote to memory of 3920	3972	Efikji32.exe	89
PID 3972 wrote to memory of 3920	3972	Efikji32.exe	89
PID 3920 wrote to memory of 1640	3920	Epopgbia.exe	90
PID 3920 wrote to memory of 1640	3920	Epopgbia.exe	90
PID 3920 wrote to memory of 1640	3920	Epopgbia.exe	90
PID 1640 wrote to memory of 3968	1640	Ecmlcmhe.exe	91
PID 1640 wrote to memory of 3968	1640	Ecmlcmhe.exe	91
PID 1640 wrote to memory of 3968	1640	Ecmlcmhe.exe	91
PID 3968 wrote to memory of 3464	3968	Eflhoigi.exe	92
PID 3968 wrote to memory of 3464	3968	Eflhoigi.exe	92
PID 3968 wrote to memory of 3464	3968	Eflhoigi.exe	92
PID 3464 wrote to memory of 4224	3464	Ehjdldfl.exe	93
PID 3464 wrote to memory of 4224	3464	Ehjdldfl.exe	93
PID 3464 wrote to memory of 4224	3464	Ehjdldfl.exe	93
PID 4224 wrote to memory of 3244	4224	Ecphimfb.exe	94
PID 4224 wrote to memory of 3244	4224	Ecphimfb.exe	94
PID 4224 wrote to memory of 3244	4224	Ecphimfb.exe	94
PID 3244 wrote to memory of 4376	3244	Efneehef.exe	95
PID 3244 wrote to memory of 4376	3244	Efneehef.exe	95
PID 3244 wrote to memory of 4376	3244	Efneehef.exe	95
PID 4376 wrote to memory of 1972	4376	Ehlaaddj.exe	96
PID 4376 wrote to memory of 1972	4376	Ehlaaddj.exe	96
PID 4376 wrote to memory of 1972	4376	Ehlaaddj.exe	96
PID 1972 wrote to memory of 4360	1972	Eofinnkf.exe	97
PID 1972 wrote to memory of 4360	1972	Eofinnkf.exe	97
PID 1972 wrote to memory of 4360	1972	Eofinnkf.exe	97
PID 4360 wrote to memory of 4772	4360	Ebeejijj.exe	98
PID 4360 wrote to memory of 4772	4360	Ebeejijj.exe	98
PID 4360 wrote to memory of 4772	4360	Ebeejijj.exe	98
PID 4772 wrote to memory of 3172	4772	Ejlmkgkl.exe	99
PID 4772 wrote to memory of 3172	4772	Ejlmkgkl.exe	99
PID 4772 wrote to memory of 3172	4772	Ejlmkgkl.exe	99
PID 3172 wrote to memory of 1824	3172	Eoifcnid.exe	100
PID 3172 wrote to memory of 1824	3172	Eoifcnid.exe	100
PID 3172 wrote to memory of 1824	3172	Eoifcnid.exe	100
PID 1824 wrote to memory of 3292	1824	Ffbnph32.exe	101
PID 1824 wrote to memory of 3292	1824	Ffbnph32.exe	101
PID 1824 wrote to memory of 3292	1824	Ffbnph32.exe	101
PID 3292 wrote to memory of 4988	3292	Fjnjqfij.exe	102
PID 3292 wrote to memory of 4988	3292	Fjnjqfij.exe	102
PID 3292 wrote to memory of 4988	3292	Fjnjqfij.exe	102
PID 4988 wrote to memory of 4180	4988	Fqhbmqqg.exe	104

C:\Users\Admin\AppData\Local\Temp\80103a095bd40eba9c71d6f80ba8c4a0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\80103a095bd40eba9c71d6f80ba8c4a0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SysWOW64\Dhcnke32.exe
  C:\Windows\system32\Dhcnke32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Windows\SysWOW64\Domfgpca.exe
    C:\Windows\system32\Domfgpca.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Windows\SysWOW64\Dchbhn32.exe
      C:\Windows\system32\Dchbhn32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4848
    - - C:\Windows\SysWOW64\Efgodj32.exe
        
        C:\Windows\system32\Efgodj32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1436
      - C:\Windows\SysWOW64\Elagacbk.exe
        
        C:\Windows\system32\Elagacbk.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Windows\SysWOW64\Eoocmoao.exe
        
        C:\Windows\system32\Eoocmoao.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\SysWOW64\Efikji32.exe
        
        C:\Windows\system32\Efikji32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\SysWOW64\Epopgbia.exe
        
        C:\Windows\system32\Epopgbia.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3920
        
        C:\Windows\SysWOW64\Ecmlcmhe.exe
        
        C:\Windows\system32\Ecmlcmhe.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\SysWOW64\Eflhoigi.exe
        
        C:\Windows\system32\Eflhoigi.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\SysWOW64\Ehjdldfl.exe
        
        C:\Windows\system32\Ehjdldfl.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\SysWOW64\Ecphimfb.exe
        
        C:\Windows\system32\Ecphimfb.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4224
        
        C:\Windows\SysWOW64\Efneehef.exe
        
        C:\Windows\system32\Efneehef.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3244
        
        C:\Windows\SysWOW64\Ehlaaddj.exe
        
        C:\Windows\system32\Ehlaaddj.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4376
        
        C:\Windows\SysWOW64\Eofinnkf.exe
        
        C:\Windows\system32\Eofinnkf.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\SysWOW64\Ebeejijj.exe
        
        C:\Windows\system32\Ebeejijj.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4360
        
        C:\Windows\SysWOW64\Ejlmkgkl.exe
        
        C:\Windows\system32\Ejlmkgkl.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Eoifcnid.exe
        
        C:\Windows\system32\Eoifcnid.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3172
        
        C:\Windows\SysWOW64\Ffbnph32.exe
        
        C:\Windows\system32\Ffbnph32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\SysWOW64\Fjnjqfij.exe
        
        C:\Windows\system32\Fjnjqfij.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Windows\SysWOW64\Fqhbmqqg.exe
        
        C:\Windows\system32\Fqhbmqqg.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\SysWOW64\Fbioei32.exe
        
        C:\Windows\system32\Fbioei32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4180
        
        C:\Windows\SysWOW64\Ficgacna.exe
        
        C:\Windows\system32\Ficgacna.exe
        24⤵
        Executes dropped EXE
        
        PID:624
        
        C:\Windows\SysWOW64\Fcikolnh.exe
        
        C:\Windows\system32\Fcikolnh.exe
        25⤵
        Executes dropped EXE
        
        PID:1440
        
        C:\Windows\SysWOW64\Fjcclf32.exe
        
        C:\Windows\system32\Fjcclf32.exe
        26⤵
        Executes dropped EXE
        
        PID:3456
        
        C:\Windows\SysWOW64\Fqmlhpla.exe
        
        C:\Windows\system32\Fqmlhpla.exe
        27⤵
        Executes dropped EXE
        
        PID:2248
        
        C:\Windows\SysWOW64\Fckhdk32.exe
        
        C:\Windows\system32\Fckhdk32.exe
        28⤵
        Executes dropped EXE
        
        PID:5104
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        29⤵
        Executes dropped EXE
        
        PID:3264
        
        C:\Windows\SysWOW64\Fqohnp32.exe
        
        C:\Windows\system32\Fqohnp32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2676
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        31⤵
        Executes dropped EXE
        
        PID:3708
        
        C:\Windows\SysWOW64\Fflaff32.exe
        
        C:\Windows\system32\Fflaff32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2360
        
        C:\Windows\SysWOW64\Fqaeco32.exe
        
        C:\Windows\system32\Fqaeco32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1304
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4768
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        35⤵
        Executes dropped EXE
        
        PID:3936
        
        C:\Windows\SysWOW64\Gimjhafg.exe
        
        C:\Windows\system32\Gimjhafg.exe
        36⤵
        Executes dropped EXE
        
        PID:3852
        
        C:\Windows\SysWOW64\Gogbdl32.exe
        
        C:\Windows\system32\Gogbdl32.exe
        37⤵
        Executes dropped EXE
        
        PID:5012
        
        C:\Windows\SysWOW64\Gcbnejem.exe
        
        C:\Windows\system32\Gcbnejem.exe
        38⤵
        Executes dropped EXE
        
        PID:3236
        
        C:\Windows\SysWOW64\Giofnacd.exe
        
        C:\Windows\system32\Giofnacd.exe
        39⤵
        Executes dropped EXE
        
        PID:4664
        
        C:\Windows\SysWOW64\Gqfooodg.exe
        
        C:\Windows\system32\Gqfooodg.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2264
        
        C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        41⤵
        Executes dropped EXE
        
        PID:3408
        
        C:\Windows\SysWOW64\Gbgkfg32.exe
        
        C:\Windows\system32\Gbgkfg32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:384
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        43⤵
        Executes dropped EXE
        
        PID:3524
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        44⤵
        Executes dropped EXE
        
        PID:3496
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        45⤵
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\SysWOW64\Gfedle32.exe
        
        C:\Windows\system32\Gfedle32.exe
        46⤵
        Executes dropped EXE
        
        PID:3152
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4076
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        48⤵
        Executes dropped EXE
        
        PID:400
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        49⤵
        Executes dropped EXE
        
        PID:2364
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        50⤵
        Executes dropped EXE
        
        PID:3652
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        51⤵
        Executes dropped EXE
        
        PID:1744
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1844
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        53⤵
        Executes dropped EXE
        
        PID:4272
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4340
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        55⤵
        Executes dropped EXE
        
        PID:4864
        
        C:\Windows\SysWOW64\Hpbaqj32.exe
        
        C:\Windows\system32\Hpbaqj32.exe
        56⤵
        Executes dropped EXE
        
        PID:4936
        
        C:\Windows\SysWOW64\Hfljmdjc.exe
        
        C:\Windows\system32\Hfljmdjc.exe
        57⤵
        Executes dropped EXE
        
        PID:228
        
        C:\Windows\SysWOW64\Hikfip32.exe
        
        C:\Windows\system32\Hikfip32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4512
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        59⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3436
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        61⤵
        Executes dropped EXE
        
        PID:4552
        
        C:\Windows\SysWOW64\Himcoo32.exe
        
        C:\Windows\system32\Himcoo32.exe
        62⤵
        Executes dropped EXE
        
        PID:2400
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2432
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        64⤵
        Executes dropped EXE
        
        PID:4468
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        65⤵
        Executes dropped EXE
        
        PID:4420
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        66⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        67⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        68⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        69⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        70⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        71⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        72⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        73⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        74⤵
        
        PID:620
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        75⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4896
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        77⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2568
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        79⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        80⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Ibojncfj.exe
        
        C:\Windows\system32\Ibojncfj.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2440
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2348
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        83⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        84⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        85⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        86⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        87⤵
        Modifies registry class
        
        PID:632
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        88⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        89⤵
        Drops file in System32 directory
        
        PID:3220
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3168
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        91⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        92⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        93⤵
        Drops file in System32 directory
        
        PID:5208
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        94⤵
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        95⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        96⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        97⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        98⤵
        Drops file in System32 directory
        
        PID:5424
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        99⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        100⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        101⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        102⤵
        Drops file in System32 directory
        
        PID:5600
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        103⤵
        Drops file in System32 directory
        
        PID:5640
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        104⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        105⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        106⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Jjbako32.exe
        
        C:\Windows\system32\Jjbako32.exe
        107⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        108⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        109⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        110⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        111⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6040
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        113⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        114⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        115⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        116⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        117⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        118⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        119⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        120⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5564
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        122⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        123⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        124⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        125⤵
        Drops file in System32 directory
        
        PID:5900
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        126⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        127⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        128⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        129⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        130⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        131⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        132⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        133⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        134⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        135⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        136⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        137⤵
        Modifies registry class
        
        PID:4700
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        138⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        139⤵
        Drops file in System32 directory
        
        PID:5468
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        140⤵
        Drops file in System32 directory
        
        PID:5608
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        141⤵
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        142⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        143⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        144⤵
        Modifies registry class
        
        PID:5144
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        145⤵
        Drops file in System32 directory
        
        PID:6036
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5280
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        147⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5612
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        149⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        150⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        151⤵
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6236
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        153⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6316
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        155⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        156⤵
        Drops file in System32 directory
        
        PID:6404
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        157⤵
        Drops file in System32 directory
        
        PID:6444
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        158⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        159⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        160⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        161⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        162⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6772
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        164⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6864
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        166⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        167⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        168⤵
        Drops file in System32 directory
        
        PID:7060
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        169⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        170⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        171⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6260
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6332
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        174⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        175⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6596
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        177⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        178⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        179⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        180⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        181⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7112
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        183⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        184⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6584
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        187⤵
        Drops file in System32 directory
        
        PID:6752
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        188⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        189⤵
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        190⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        191⤵
        Drops file in System32 directory
        
        PID:6296
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        192⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        193⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        194⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        195⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        196⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        197⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        198⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        199⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6852
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        201⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        202⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        203⤵
        Drops file in System32 directory
        
        PID:7312
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        204⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        205⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        206⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        207⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        208⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        209⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        210⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        211⤵
        Drops file in System32 directory
        
        PID:7656
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        212⤵
        Drops file in System32 directory
        
        PID:7692
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        213⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        214⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        215⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        216⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        217⤵
        Modifies registry class
        
        PID:7920
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        218⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8004
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8052
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        221⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        222⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        223⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        224⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        225⤵
        Drops file in System32 directory
        
        PID:7264
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7332
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        227⤵
        Drops file in System32 directory
        
        PID:7420
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        228⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        229⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        230⤵
        Modifies registry class
        
        PID:7640
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        231⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7740
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        233⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        234⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        235⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        236⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        237⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        238⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        239⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        240⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        242⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        243⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        244⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        245⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        246⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        247⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        248⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        249⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        250⤵
        Modifies registry class
        
        PID:7636
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        251⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        252⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        253⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8012
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2968
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        256⤵
        Drops file in System32 directory
        
        PID:7776
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        257⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        258⤵
        Modifies registry class
        
        PID:7436
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        259⤵
        Modifies registry class
        
        PID:6656
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        260⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        261⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7868
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        263⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        264⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        265⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        266⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        267⤵
        Drops file in System32 directory
        
        PID:8348
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        268⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        269⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        270⤵
        Modifies registry class
        
        PID:8488
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        271⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        272⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8620
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        274⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        275⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        276⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        277⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        278⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        279⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        280⤵
        Drops file in System32 directory
        
        PID:8916
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        281⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        282⤵
        Modifies registry class
        
        PID:8996
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        283⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        284⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        285⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        286⤵
        Modifies registry class
        
        PID:9180
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        287⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        288⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        289⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8392
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8464
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        292⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8524
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        293⤵
        Modifies registry class
        
        PID:8596
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        294⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8736
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        296⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        297⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        298⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        299⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        300⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        301⤵
        Modifies registry class
        
        PID:9156
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        302⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8336
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        304⤵
        Modifies registry class
        
        PID:8424
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        305⤵
        Modifies registry class
        
        PID:5052
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        306⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        307⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        308⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        309⤵
        Drops file in System32 directory
        
        PID:8712
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        310⤵
        Drops file in System32 directory
        
        PID:8780
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        311⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        312⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        313⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8212
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        315⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        316⤵
        Drops file in System32 directory
        
        PID:3392
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        317⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        318⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8884
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        320⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        321⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        322⤵
        Drops file in System32 directory
        
        PID:8388
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        323⤵
        Drops file in System32 directory
        
        PID:8452
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        324⤵
        Modifies registry class
        
        PID:8728
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        325⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        326⤵
        Modifies registry class
        
        PID:8264
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8448
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        328⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        329⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        330⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        331⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        332⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        333⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        334⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        335⤵
        Drops file in System32 directory
        
        PID:9384
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        336⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9512
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        338⤵
        Drops file in System32 directory
        
        PID:9564
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        339⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        340⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        341⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        342⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        343⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        344⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        345⤵
        Modifies registry class
        
        PID:9888
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        346⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        347⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        348⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        349⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        350⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        351⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        352⤵
        Drops file in System32 directory
        
        PID:10188
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        353⤵
        Drops file in System32 directory
        
        PID:10232
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        354⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        355⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        356⤵
        Modifies registry class
        
        PID:9492
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        357⤵
        Modifies registry class
        
        PID:9548
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        358⤵
        Modifies registry class
        
        PID:9632
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        359⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        360⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        361⤵
        Drops file in System32 directory
        
        PID:9828
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        362⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        363⤵
        Drops file in System32 directory
        
        PID:10004
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        364⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10140
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        366⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        367⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9328
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        368⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        369⤵
        Modifies registry class
        
        PID:9596
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        370⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        371⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        372⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        373⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        374⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        375⤵
        Modifies registry class
        
        PID:9252
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        376⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        377⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        378⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        379⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        380⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        381⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9900
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        383⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        384⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        385⤵
        Drops file in System32 directory
        
        PID:9920
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9652
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        387⤵
        Modifies registry class
        
        PID:10136
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        388⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        389⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        390⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        391⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        392⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        393⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        394⤵
        Drops file in System32 directory
        
        PID:10472
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        395⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        396⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        397⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        398⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        399⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        400⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        401⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        402⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        403⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        404⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        405⤵
        Modifies registry class
        
        PID:10952
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        406⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        407⤵
        Drops file in System32 directory
        
        PID:11052
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        408⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        409⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        410⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        411⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        412⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        413⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10376
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        415⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        416⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        417⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        418⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        419⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        420⤵
        Drops file in System32 directory
        
        PID:10772
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        421⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        422⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        423⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        424⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        425⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        426⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        427⤵
        Modifies registry class
        
        PID:11140
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        428⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11208
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        429⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        430⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        431⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        432⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        433⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        434⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        435⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10944
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        437⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11092
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        438⤵
        Modifies registry class
        
        PID:11180
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        439⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10276
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        440⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        441⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        442⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        443⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        444⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        445⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        446⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        447⤵
        Modifies registry class
        
        PID:6560
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        448⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10860
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10980
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        450⤵
        Drops file in System32 directory
        
        PID:11232
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        451⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        452⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        453⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        454⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        455⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        456⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        457⤵
        Drops file in System32 directory
        
        PID:11288
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        458⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11324
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        459⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        460⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        461⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        462⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        463⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        464⤵
        Drops file in System32 directory
        
        PID:11540
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        465⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        466⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        467⤵
        Drops file in System32 directory
        
        PID:11648
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        468⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        469⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        470⤵
        Drops file in System32 directory
        
        PID:11756
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        471⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        472⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        473⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        474⤵
        Drops file in System32 directory
        
        PID:11904
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        475⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        476⤵
        Modifies registry class
        
        PID:11976
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        477⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        478⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        479⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        480⤵
        Modifies registry class
        
        PID:12120
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        481⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        482⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        483⤵
        Modifies registry class
        
        PID:12228
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        484⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        485⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        486⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        487⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        488⤵
        Drops file in System32 directory
        
        PID:11492
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        489⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11488
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        490⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        491⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        492⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        493⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        494⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11860
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        495⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        496⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        497⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        498⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        499⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        500⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        501⤵
        Modifies registry class
        
        PID:11308
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        502⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        503⤵
        Modifies registry class
        
        PID:11528
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        504⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        505⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        506⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        507⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        508⤵
        Drops file in System32 directory
        
        PID:12104
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        509⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        510⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11332
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        511⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        512⤵
        Modifies registry class
        
        PID:11712
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        513⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        514⤵
        Modifies registry class
        
        PID:12180
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        515⤵
        Modifies registry class
        
        PID:11276
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        516⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        517⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        518⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        519⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        520⤵
        Drops file in System32 directory
        
        PID:11784
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        521⤵
        
        PID:12296
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        522⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        523⤵
        
        PID:12368
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        524⤵
        Modifies registry class
        
        PID:12404
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        525⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12440
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        526⤵
        Modifies registry class
        
        PID:12476
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        527⤵
        
        PID:12512
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        528⤵
        
        PID:12548
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        529⤵
        
        PID:12584
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        530⤵
        Drops file in System32 directory
        
        PID:12620
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        531⤵
        Modifies registry class
        
        PID:12656
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        532⤵
        
        PID:12692
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        533⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        534⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        535⤵
        
        PID:12800
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        536⤵
        
        PID:12836
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        537⤵
        Modifies registry class
        
        PID:12872
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        538⤵
        
        PID:12908
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        539⤵
        
        PID:12944
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        540⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12980
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        541⤵
        
        PID:13016
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        542⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        543⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        544⤵
        
        PID:13124
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        545⤵
        
        PID:13160
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        546⤵
        
        PID:13196
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        547⤵
        
        PID:13232
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        548⤵
        
        PID:13268
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        549⤵
        
        PID:13304
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        550⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        551⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12392
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        552⤵
        
        PID:12472
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        553⤵
        
        PID:12540
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        554⤵
        
        PID:12604
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        555⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        556⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        557⤵
        
        PID:12792
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        558⤵
        Drops file in System32 directory
        
        PID:12864
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        559⤵
        
        PID:12916
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        560⤵
        
        PID:12976
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        561⤵
        
        PID:13040
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        562⤵
        
        PID:13108
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        563⤵
        
        PID:13168
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        564⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        565⤵
        
        PID:13296
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        566⤵
        
        PID:12364
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        567⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        568⤵
        
        PID:12612
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        569⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        570⤵
        
        PID:12844
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        571⤵
        
        PID:12968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12968 -s 396
        572⤵
        Program crash
        
        PID:13228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 12968 -ip 12968
1⤵
PID:13116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abbpem32.exe

Filesize
62KB

MD5
48b0bd1a165ee7dcda70dbb392e3f413

SHA1
e8d1c6f7f84035977ffe3705b6b63e8f9cbebe4b

SHA256
9e92d9f107010fcfcb1136c590a47a117ffeb2467cbfc65186064ab32a8ede55

SHA512
855ba9b4cd60dac882ab315b07aa9b17ed8b7dfa4efc49644c3d0ebc5dbac2d23e9332baaef171067ece4d265b38b8b2d777a5c8ae657dcd83b3687145672a59

Download Submit
C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
62KB

MD5
ddbad004a4ade609eceed2ae29643eb6

SHA1
aaeb2fe4785dfc414aa066e38496469f015ff495

SHA256
484bdd579c54cc2b546ef76339d6aaa1b1f2bba4871ca00563f59cbb044fb335

SHA512
506705a8db8874ec14d1302bd0749bbe120d386eae93d50debbefaca88fbe07b971a810ffedf264c9099e76c83f569153d0c03afa222fc7a6e0a472a7c2be0e5

Download Submit
C:\Windows\SysWOW64\Agjhgngj.exe

Filesize
62KB

MD5
417aef833d16b6d763960e97ed9cfdaf

SHA1
2d8e10e38182965e210a9566d27a8e77e1ac19ab

SHA256
84736ff6a30a40a96f9cf7ad7f56ae8249c20f4aff3b190df6f48ed8b31883ad

SHA512
6cbca78767c4444545caf966a287140ce5cde83da766c9e902f13b60ff406d5650c657356dab32f5d6a312cfdc7a2a72b416bbf7dbfb8d4c4ab9f074052b7f12

Download Submit
C:\Windows\SysWOW64\Ahhblemi.exe

Filesize
62KB

MD5
61246c367b807ca5105cc4cfb44f6afa

SHA1
f123e7121ebedc31f29dee119b9f55a32662eeba

SHA256
bb2435969f7a3ff1909a3a0fc0e31675c3c5fb2ae25b3375d3d5a4c494be62a6

SHA512
4d0555f962be4de0a9e7c25b98a9d7f95f7f69bf8df6f6f644d1b10e580951eb356a418578c88bc472dac787fde2dda903bcba8d42c1af206275d50c64ef0057

Download Submit
C:\Windows\SysWOW64\Bclhhnca.exe

Filesize
62KB

MD5
0fee221697dfc99434aaed4db7d38483

SHA1
ab7fbcc090b66867ae5fa868c944248e5441aee3

SHA256
95597f737c0ff5b996395a3e5d672607a48daa68a2865310e43644b3042b09c5

SHA512
50d37b5f3a151ae3a0f3ef6e5bc2d9d839f41ad008ba1333e5f9ae01fe2678dbab215f414f6b1a6476221efea233982f618d363068861bce65cc68f8125072ce

Download Submit
C:\Windows\SysWOW64\Beeoaapl.exe

Filesize
62KB

MD5
75602487fce372567369dd7a65b5d6cf

SHA1
e379b1579a451b426de97859f99aefebd07f91b7

SHA256
5530802482a1949052cf32cc0cd2426685644c82f29303cdda86c6de567da8c3

SHA512
1bbfcfd9e2b8c67d97c3f32d8533c22c034dbe9516633de14b6633e42fe6e2ed1db87df8f99ed81158c19b9a0f2fdc58b1e74d5a5cfa188133ea5c82b8a42a2a

Download Submit
C:\Windows\SysWOW64\Bffkij32.exe

Filesize
62KB

MD5
bb063ca3bdbbb9c57da78500488777c5

SHA1
00367b399dd1fd55fc94fa9fba381cad8d8acf8d

SHA256
0b5b5c0b4a413dd1469b8ca9acb850e9fe2c73e4985a2b630037e50214cbcd2f

SHA512
24149786c9f681bb3d09bc422edb63974b93105fac8a6533c508694263fab511856a606055b2009c8947b905e7cb4c552bd09352e6fcbc00c2a3fde59a3cb465

Download Submit
C:\Windows\SysWOW64\Bjddphlq.exe

Filesize
62KB

MD5
c352993cc09e0b1cd3975aaed6430f0c

SHA1
0a8a04cf347dd36e38e7ad75563a97365161021f

SHA256
c1f5570e84f65d82bac3c8fc3e86e1e9c43663865347c562e17719675b4d1ea8

SHA512
4c2ff674730d8598e95b4e29bc624f860c09cd9530f5e4b8d43c57d3f0692e2ff5c89f7193bd1171624f09dda3bd5c94759ab33dbace7b5d249f7a58fa57f20d

Download Submit
C:\Windows\SysWOW64\Bnhjohkb.exe

Filesize
62KB

MD5
30f4256085236b22349256fe457997d9

SHA1
1a0d148135f662c6488d1b752412db1de66faafc

SHA256
f66f13ecc059c2822bcc4154128efe34b06cd6853e6cbe0b22ff5c4d533f1161

SHA512
b8e0803a26b6db35b12274d96c3d7693897997de5d6d8e88c0d3e0a4c90d6b2276941c18edc43bf24425a83d66ff2ea744fa319cf8a1a439d00003d1b0322494

Download Submit
C:\Windows\SysWOW64\Cbcilkjg.exe

Filesize
62KB

MD5
ed21a2bdf7a4b97cb8d4cae3d7cd4c19

SHA1
8914642dee1e6302dccd5068404e3ed0c0c634c4

SHA256
93ad5715582a6b248a0a5a62c3224fe114040037e0d733d0e17b610cef3967c1

SHA512
4f6f0ada07f0727eb4d954952e88ab743999919ecbab8d2b3afaccbb3841f5948a379cd0bacebf6ed1ca786b62b9680b9d037547deddb3e28ae062eb2744abf0

Download Submit
C:\Windows\SysWOW64\Cbjoljdo.exe

Filesize
62KB

MD5
7c83d0e350d23a6bb32aa3f5076d49c9

SHA1
5d0da9bf3e6b0ecbc5f80d4febac6c5ce990fcb0

SHA256
08da39be0d227a5e4ae16fa0764e288c7c94cd4b2e534d1bd0155b5f7502f4d2

SHA512
5f63b27404c097f2f11fe2df31247c35a585f391607c277e0fd5e6471ef44b12c2a7c44624cb1e8bcbadd40f3e47210c9cc825caec5354a14382ba62f38905f5

Download Submit
C:\Windows\SysWOW64\Ceehho32.exe

Filesize
62KB

MD5
b121666bf78ac50b65f75365c52db7b5

SHA1
62e1954d1845f3d9cf9698eadfc98e357c7a03f1

SHA256
b56e743413fa40d71f958d6418519c4a150094a4fdc370c4d69750f0baf86445

SHA512
354ce3cac28717e068a5aedbb21f57497ae6ee2b1e3c7bd8a91d8ed82b3bb6c81c44d534062255f12174e61854295abd81d5630b56f9fa9cdd62b43fc058b4e2

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
62KB

MD5
ac951c476caed66468f5a0e16a392c1b

SHA1
689a4771a051e2f495308817ee862ac228472ce9

SHA256
a6b40d5cb793665f11f7400c11302ef2eb3b8ac2c458145d5b475a72ac4b189d

SHA512
6de988b5f2a95b56122b1315e8acef7514acb5df237fd19d72fb9d5b11aa997598119bf18f917699e10c1ee74ff56a96f60fcba3e210f90ce7f151bc77324f43

Download Submit
C:\Windows\SysWOW64\Ceoibflm.exe

Filesize
62KB

MD5
b9f2de4525029c77a7b352cb94458dda

SHA1
0b3bc193b14a9f876c82e8285d546c5587b9b2de

SHA256
6fceacb6edad599dcfbd3ea16a6905d27827bd70888f6c61452608e9a2d9e28e

SHA512
e208fd6eab79dfdd19241da3f22aee8b4eeac84e48f9f248d89733a8b1717d0717fef75ef702c50bfd69ca39642efd343f94499655b8a55be38752994b0e997b

Download Submit
C:\Windows\SysWOW64\Cfpnph32.exe

Filesize
62KB

MD5
b31fadac393f033d612264f8deec8b2a

SHA1
ded4c999c424c98e5f175a120884d97ee9423029

SHA256
51f809ff599fe489483611c662975474173e7bd07afb1a72585a5df91c55784d

SHA512
e33a9e45527f7cd0bef68c7e1a14273191b1da7ad8feb12ceb442d64e8f71e9db680fe26fcee57cb60cb297db4f058ee5a65268d70529eb5e4e04a3a4ffb6aca

Download Submit
C:\Windows\SysWOW64\Cndikf32.exe

Filesize
62KB

MD5
33949e5dcbbc2a7640290f62feab1680

SHA1
dd6343ec86174b9128bdaebf5bc94d9c6df1b26b

SHA256
c7f2f7b24c1860b0ab32a1832bfb55f39bb206d24c72d967edef6592dea8a855

SHA512
99225a35ddedd4943c598a526359e79964387e8e423c1a6d2d4ed81bd87c22f790700c6c27f26196e2c444c782317ee147909c5f08963b5a082f3e6020f466c2

Download Submit
C:\Windows\SysWOW64\Dafbne32.exe

Filesize
62KB

MD5
b1ad1f92e14e550da0d75cb75104a387

SHA1
bb1d70d6fd064dcd22ebbccb48e4317990209e91

SHA256
6fa46f57cdef4601f86b515e4aa2838ae7627b64714eab1b0d077cd35a0954ea

SHA512
b463ca1d6f52dd11e564c24f8b8e15f5068d5afae5c4c7af72632da68815cfd63299600ba915cb4d27f9fdb1dad00f2a5535d7668d83b9a3899be41c19ecf379

Download Submit
C:\Windows\SysWOW64\Dchbhn32.exe

Filesize
62KB

MD5
88c4f8f0f61e729609dba5c40163a3b5

SHA1
8d0cbc18bfddd8e80450b08648f25cdf4ba2849a

SHA256
c514a29d613c5eafd9cfa4804b4d914b60daaf757d47bfb7c539c43ebd0b34cc

SHA512
e2d0376775a6c24098e967bae580dd2ee00997f4415bba276b2de178722fc4329e9f346fead0ba4174c79624b9d9d699577bcfaacaf1cf3af26db358e4f60a2c

Download Submit
C:\Windows\SysWOW64\Ddmhja32.exe

Filesize
62KB

MD5
6e8ff7377c1f5abf22a74b94ac41ede9

SHA1
feac30ac90b95b2bdc75d4c1b0f1dbd98d0034d0

SHA256
7e67ae16c4d3d33c965c8752bd2748cea654c2824badf57b97728edc0b7fa73d

SHA512
9d7d5c8f75fb6c3baaac6cd239835508886c054fd1f8f0fe411daacd8cbb3a70ddb74ba97449e4129ba6331488b2a4b8e413cbed6cc0a8d0498cc41ed0e8a2d3

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
62KB

MD5
de90d844e3f67feabd2327a9fa74d483

SHA1
03c0329663a9fccb49304a68419813e6992f9fb3

SHA256
c8d8d6afed80d20557bcf1e439d3f9ae2d5514a16cff60762a5767fdfc29b921

SHA512
886ea2aee65ee3af2a7dccc311861fbf50f701cbb530b5dc78e1ed0d2b2cd825d358444c2ab9ed1be713f5d8b83a8a70e5c8fe20a48071d17ab603205efbf41b

Download Submit
C:\Windows\SysWOW64\Deokon32.exe

Filesize
62KB

MD5
ad5a692a5c8fa6c05f1397ebeefc7de5

SHA1
9a98ffa90a9eb474506bae6b54fb6ab1d3ce2666

SHA256
99ea17979cd31803d330f3e31a0579fa080e4f9eecc23a750e3af206f66ed29c

SHA512
1dbbd3f83861cbee6ab5eeb2fc7a0e97d7709e140383ef4db64dc2e1362e3cefa0bb2a7aa3e0c6cfb60f112367019993ff911ccb23043e7f615a523b3fe2059a

Download Submit
C:\Windows\SysWOW64\Dhcnke32.exe

Filesize
62KB

MD5
211ffcc43e810d8ef27e3ec55773c146

SHA1
114c1e681c8fa5cde85defd41726cb75bea92b74

SHA256
e506930f81446d04f88caf1da1b3da128b34fdc47da0758c2dce570c7681d71e

SHA512
75e54edab5a3842ae786055988362fd69880ca530d247d723087d13662a4b57a7d2bc298748cbded2ed349644b449ea358daf4fd30cb958a5b38d10b06b66dd7

Download Submit
C:\Windows\SysWOW64\Dlgmpogj.exe

Filesize
62KB

MD5
b866da7b826c2df64a86ce8c2f2c88da

SHA1
6d19f068e3050192d2b5c4308830463178ccdaa7

SHA256
6f946e283c2f6c5400eeb00cbb59e108202b8e01c8ea7e848bb1ec0748139ec0

SHA512
abcde35f8ab274f1bf614017ce419cd3689d54fbc8538dbd36e0add2148701f03c62a6d1eac2d72f93a2aeb39eb646b9656c3e8cad8fb18719899e14b4c16ad8

Download Submit
C:\Windows\SysWOW64\Domfgpca.exe

Filesize
62KB

MD5
a76fa39386f20696a23da5cb09813b1a

SHA1
715364a4348dc30f57878a00a34e965afb1d4205

SHA256
7dbeed6ac2a9cfddfac80c61408680f6c679a33a55dc43d92ab60ff39901aef9

SHA512
b8a9f6b4bc6258bb0e24f1ad10d3029ddd33ea412585e6032b919e18c17b120a74d6b68f1b60d66404a8b1d432b8b6853b631a4fc3b04b96cea11eff3517dd4b

Download Submit
C:\Windows\SysWOW64\Ebeejijj.exe

Filesize
62KB

MD5
bc15b6d338dcb801a2768dc1b890b297

SHA1
737c2745de99a6ab47f2517a2330ce2da6f18b39

SHA256
aeac7587b31da9a26b821c1061697870afe7fd2a621ee0473fddf62b83f26e17

SHA512
cdd690797d3851b6b1407b281e92c3b939e2dcd870090edafab113833320115b12844546c0775f11e7426c637bdd0188f69294c9b1f9b27ba01a5ac53fc85740

Download Submit
C:\Windows\SysWOW64\Ecandfpd.exe

Filesize
62KB

MD5
a3b3c1f045b7bec1b0a62f1cc17fde65

SHA1
d11fe87881d5848666c82eca37efc6f452174681

SHA256
bc070b8236e1e29328ef67135d1fb184eede6516bb34c3450c6f4d9de3756bb8

SHA512
dd7c1d672121eaabaf9373077dd00dac87734adad586b80dee44f2ea02e1e1889f3949a2a3b3bb4462f4e8433c49713321134b823034e4d9dd9f2da70cf23af7

Download Submit
C:\Windows\SysWOW64\Ecmlcmhe.exe

Filesize
62KB

MD5
aa221451ab4d000cef157881db245be1

SHA1
42a678a71ba97241cbf3d0d99d2bab57ce353b56

SHA256
2c1c7a66dbda939fb50baa9506504c4a7f7a050202aeac1ce92b9dc99f58f7ad

SHA512
001c3981922447ea34ecd346e562feb57cb08a0d1a4592fb79f74e1d437243391b660ca9aee57d7b08ec6dfbf9402b811d7ca494643f5a01f6d8ebfd20904346

Download Submit
C:\Windows\SysWOW64\Ecphimfb.exe

Filesize
62KB

MD5
08f04a0169d65ab2e71b43569429c2cc

SHA1
8701cfa59fe5e76eab1d6d40876381dde19fabb3

SHA256
daa15024ca17ed889fdc3f8e696b4f964a694e0e78872befa4bb12b1419938db

SHA512
7ba2d5b7122bc2310f8b2a471dcd8aaa54144ffc182368724c714c7fd4c3580c716d3c05ac8cc0c7c1a8e4a9b7ed190f6fd82a6c481acd2cfac4741fb4255fbd

Download Submit
C:\Windows\SysWOW64\Eeidoc32.exe

Filesize
62KB

MD5
8669a7bdb0e6970f7e2c57d2392013c8

SHA1
a4ebd02b02c283189add23c53a5a493e22c85e2b

SHA256
25f995281ef7faee24d09177146d71809885e6c5449d46b6ea5030869b3ff683

SHA512
e7a8f8aa454d9175108b74c9f29b73a482e3e2e015d285c02d9799426199972160690b799d8b3e181244dd55eab6c2244c82c8be7e02997b6e5fc8ea51a665d6

Download Submit
C:\Windows\SysWOW64\Eemnjbaj.exe

Filesize
62KB

MD5
2459383efed5f7bb467319ac9422e6e2

SHA1
8ebb45ed6e7d731bdc1f825977b98d4a33de93ce

SHA256
55cd9fa295d8c7b1fbd87c82bb5698db4f755d48528c475481aeb2a6e9620ddc

SHA512
12c0b3e8eac04a3aaf427e8e636dd67a5d56e7805fc04a5ff0225798d81b62ef967153fb17fb8692251f25affbf3ea696457f41b9ebf6d7c4069370c512e7c75

Download Submit
C:\Windows\SysWOW64\Efgodj32.exe

Filesize
62KB

MD5
0459a8b88f30944bd8c435c9ccffccb6

SHA1
0551655a457aa6f76f17f0733b0318220fdd2590

SHA256
68cab93ad6a5c4074d48f6f91b61c54a44dc6aaf63a070ad97dc8db77e91f2f4

SHA512
fc26316ab46032bdcfd5880791aa1e7b173d7a18be5b3434ac4e4e9766b07858c9ece08153a37387610b39c4d78f9eed6228b7e9a7ad049788792c312e4542cf

Download Submit
C:\Windows\SysWOW64\Efikji32.exe

Filesize
62KB

MD5
dfb8a1711857c1d4a706d19dda0310e2

SHA1
ffa1ab5f062065c9790d3ff287e17982f59b6c4f

SHA256
29db5765ce2886f413f8da8e82be24d9428e38253785194c68189db716ff801c

SHA512
5ecae98ce8abdfee2467e0fcbbb906fc264793141f0899ea55431dda63fad6e6d71f609a3d35a4804e97ee0997f0a6251e37bd046176338625d262c19396a039

Download Submit
C:\Windows\SysWOW64\Eflhoigi.exe

Filesize
62KB

MD5
4d5e748eee13b8749b8e4a8ca736235f

SHA1
ccb0d77ff1a21f795ceb6c32f0c92280faf5a44d

SHA256
6268ef5aac795febda5547227179241f7ad0cf71cafa7a57cf298511ec2fda99

SHA512
34d8a4b513d2d447babe86cfe661615e9e2a6af21b4e9ac3a11a0eab9bf8ebe2f82f6c91acd4fc3223199f6f1d25ff5382327d7b5362171a76257199468c1801

Download Submit
C:\Windows\SysWOW64\Efneehef.exe

Filesize
62KB

MD5
68b38602953e2ad193f4920b24e9a0c5

SHA1
d3e7c7f5976bddc015c07c226175086a471bcf4f

SHA256
6d2d05a7a79cf64484678f3c7bec75e6e234653ec5f03fa06c10424b3f5965d1

SHA512
95adf44a976cde0421d03d891b2cdc7c0f997b7762c864cce9f3e683f5acf3b495aeb03aa577355b73b42740c6e838029bea2ce509655163781ea0f55b923cef

Download Submit
C:\Windows\SysWOW64\Ehjdldfl.exe

Filesize
62KB

MD5
38702391ee4d6f92f348156c54142678

SHA1
8dddde1d8aa81103007127fbeb48fc45a2d52cdf

SHA256
a8c7adf695f6c688da82a5a783a97688cff55b3a6ba226130de3aadfea75b52e

SHA512
f44d925c8bb0bbb0e8db91c3fdaf36a4eef1378b9e19e75a0135c9d46d9763a1885b0ed789b6aeb38f4f37a85fac1f8780a8073c606963680bf295b2abbb2335

Download Submit
C:\Windows\SysWOW64\Ehlaaddj.exe

Filesize
62KB

MD5
f0fb29a33b96087b76ed7eb6436a9459

SHA1
733272e2235deaab23cf30d7ab964ffbef7a7a73

SHA256
cea733942c28d98cc4eb15fc7a2412a824c223c36c4900101830b8b53c8fbf38

SHA512
cd0e8a130f168eee4dbdac822c779a55b4339093eddc437c9e3f1f5567465549b595ef3ec0b89ecb434d7df4c29cd093148e8456b54ad793293a04b2d7f2d0c6

Download Submit
C:\Windows\SysWOW64\Ejlmkgkl.exe

Filesize
62KB

MD5
1fe327c5c1dc2934dff8cd40a732857c

SHA1
d31b55222f1c98c3264dee935daed8f5f88a2a85

SHA256
494a86405c61d954f809c50f25e70ac907f25f5925edb1fbd73b22515e9dd69f

SHA512
b93262977b1f969503895a71215b27f3753bd116379f14b6f93a3778b363db4eb07cef3e9a7d5f814691382bf6232adb50b70d7d2e4fcf60e3b9f23cf1855e8e

Download Submit
C:\Windows\SysWOW64\Elagacbk.exe

Filesize
62KB

MD5
e6da0dee630ea65baefdf22e00e6284c

SHA1
99970f3baaff3be9a2413fb377b1c8049de83b15

SHA256
d988be5b26e7fd6ff2ffaba7b806d0b8237a71c858c29d38af6231febadc72b2

SHA512
4f5c0c6b174953ba0bd0573f6ce021132317709262d4020e8b52c5301b0a13edfd535858cc5326c3745298af8bcaf83e4af217c563de5dc22b4a22b3242fec6b

Download Submit
C:\Windows\SysWOW64\Eofinnkf.exe

Filesize
62KB

MD5
27451a3a7a1f9f7f2d288448633ba02e

SHA1
c45357365a5bdce3c12f7dab79fbe561f3b7b7cc

SHA256
a273240ea3daf5f3fd12eef1a768c321d1ebbd7f5fd00581741be7761068baf7

SHA512
5f572830f71dc38c7aefbd7afcbc4cc9a1e07d582a157b82ffdb1c1a4168f36d70edd82454ec0f165c83c746591538a34cff821accd4d789bbef53f89f7abde6

Download Submit
C:\Windows\SysWOW64\Eoifcnid.exe

Filesize
62KB

MD5
64471884b37a75dd691cbf86f08e42d1

SHA1
a1157699e4317ee96dc06b14b105b5fd276fefd1

SHA256
5812c7a042a2f76eb275841a0c223e907df40d1caa0b19e8c55b052ea128b069

SHA512
63ba8a34fea9ecc722a9c2aa7f2f39103e9a27af1aa87fe9f6b912fbc363efd00de0b1c7e566baf0d81e395c09302e7906b07a10886b225e51c034fc94df4794

Download Submit
C:\Windows\SysWOW64\Eoocmoao.exe

Filesize
62KB

MD5
c35448266a36d78ab2da944631feae26

SHA1
7ea1bd4581100b930b34f0d460e596fadccb3cca

SHA256
1d3c0c4e77285c9350a09a1fd7cd92c8ee46cb253641c70151c75db6984a7044

SHA512
4ae0494dac550398b179e3e88926af324920645dbba9e84c72c5edaf439fee4a72f54c9c8ff33699b7fb2868ce3eea34d3e0561af2827d75f55ce6d8b2477850

Download Submit
C:\Windows\SysWOW64\Epopgbia.exe

Filesize
62KB

MD5
8eb4a6fa99c772901c35f96a71fd30fe

SHA1
197d27b203d361499bbde32ba1b61d7dc3cfed85

SHA256
d9ea68d7e9c6cbcb4b0f6342a7dd2fddb9dec0453f5f9d1e67aad7e6eedbb814

SHA512
6ab54bf6f33d7d1653458ffa2849874c5f3be48d32cfd48a1e1a15f806dfe1bccf3b0324362291cd73190d11ad3ecca9b016b83c34c56d1d3967cb878ce3f5db

Download Submit
C:\Windows\SysWOW64\Fbioei32.exe

Filesize
62KB

MD5
a56670c5b51f40c5212fe711c5147cf9

SHA1
20ce64b243eb8c23421e3e41bbb69167d92c69ce

SHA256
1d8c8eb48038306e4ea5c353f7feb7a20926d8c4d336edf6c71797e34141e208

SHA512
6ae5c1627fec50ee1755dadc38b49634f6cb25e087877f45a01576e7e7bf64bdf5d72fcd8909e42677afb9ed0664679bf0f47322bee785600ffd1ce89ab96e64

Download Submit
C:\Windows\SysWOW64\Fcikolnh.exe

Filesize
62KB

MD5
a021e14471c630756bbad028f4522715

SHA1
5c20a02fab529071560034d613c3666d2de80c0b

SHA256
ccf52724bc23be93673e7f7bea27c726c5085a590a4a9ae36772de1e97b38aee

SHA512
559d81ff3d81f0711b520f976b14238a08997c54da010420171e80e1696254c8c844455c9d8d8c4346bc6a6a10e28bb5dc85fd23b5342c331628f24016a63165

Download Submit
C:\Windows\SysWOW64\Fckajehi.exe

Filesize
62KB

MD5
55996000bc70206550935bf5bef9e37f

SHA1
fb5b22edd9768fd4e2379cfb854866ff2709c591

SHA256
1cf41092f2d2759410afde37e521ee7e1560ba1c90b6d5cdf5144830ca5d01aa

SHA512
132d7680d194549ab1e1d6b1ec3f0a2eb30afd9fa6e26941888e0bdd47be90fa16c114a4eaba6afe57600ded995e7a4f7e832088686d1e8784f51c7ff40a5e61

Download Submit
C:\Windows\SysWOW64\Fckhdk32.exe

Filesize
62KB

MD5
f39977642d1cbde5fcb0171608994c4c

SHA1
0b792fe0023bc14233103511f5f7edc9aff5ca0d

SHA256
8857e2e0d93e263ba8f3533d4ee586048b3ec43eb76eb1297c3e04060d5e7243

SHA512
5f0c4c16491cdf247e91544154284c0c12d19e22bd3f599154456b25cd3006d3d87a77553dae6056e1999678ff770f2701eaf250ee11eba90e512a47f8281a39

Download Submit
C:\Windows\SysWOW64\Ffbnph32.exe

Filesize
62KB

MD5
2bc7677d9f76e082a78d2d0f7d4a6ac1

SHA1
bf347311632b987e496a3289b231eeae4873bb4c

SHA256
81ceee9a436aebd0a337f73c5a5b1b702304958aacb6d4ac33a6101e8ef8a6d8

SHA512
73cd2759d7258244a402dfc78cbd979889b08d4b9c62274e67d566499ffa2b5a371ce95449b91879e8aed53929c300afa44d69133961cdfab9e349e4e95cf7c7

Download Submit
C:\Windows\SysWOW64\Fflaff32.exe

Filesize
62KB

MD5
c42c3c650ee3f4ab52960054954c28b3

SHA1
d298f94432c8799083f26dca2fec68597c6659b2

SHA256
df6a36c5b030738f25450edccc34c95af86e67280abf2d01251eb1b4e25a1d6e

SHA512
3285d663dea3cfebc4ca2f02dc2c18d4a6bf1124d85e37cf65222946976b45dc41452e4f317f2f3f393376405a95c2f8dcb2f1a4d8c4a5bcccd3db7bfb10c83a

Download Submit
C:\Windows\SysWOW64\Fhqcam32.exe

Filesize
62KB

MD5
f51aae89aa068028bab6cca222c1a47d

SHA1
6fdd283d93760a468998c42a985a3d04f196dc8f

SHA256
dd8fc2964cc9dab9c01e7c1dff4023c95e767be0bb6f54400fac1158fa0c23a5

SHA512
2522ecbabec577dd788f488dc21c85883c253764763d0a6b87b219bad22dae32f8bbbe4d075cb5e5bb21e5ffc45512e2d3f94291c5082f329be2c4348ee987a7

Download Submit
C:\Windows\SysWOW64\Ficgacna.exe

Filesize
62KB

MD5
b41658da05e6b82bd0b87fcfdda785d8

SHA1
ab71dea1338ed850d2354f8de5978635cbe0ad55

SHA256
8a30bcd6ac4aca54ed4b054ce5b7206645764d7f0c69f33525030016df5bcd65

SHA512
335a61ea0ee1cf315783032cbb199cf65f48a0893f8e03bf1033debc2a3767e2c43ef3c332ca460814ccdc05b4c34f8460c04f52b6f2c276108958415c78193b

Download Submit
C:\Windows\SysWOW64\Fihqmb32.exe

Filesize
62KB

MD5
249b71cae9d6f8a6d01e5c8cf6a9e2cb

SHA1
eab535c933b4cd0df43cba8e15215a3d9a94abba

SHA256
5697ee31ffa19cd090d38c0d8477e64857fa7b3caec929956aee5f166d1747a2

SHA512
4e88b90fdbb7b2203e558765e8d0b9d69aeffd416a97aa8050a08c2781224e91cd6f022d6dee73b47f072bf1b9d6f37137611785e7d7af38746784ba6f5a2e3a

Download Submit
C:\Windows\SysWOW64\Fjcclf32.exe

Filesize
62KB

MD5
44bb7eae556dc8502e961e250bf8817c

SHA1
8de2d374ab5e7f77e3dfab0a484974475d38b84f

SHA256
e485a48769e04491c2efede778f6058726ccb83e7c6af95653afa0846b1b8bcf

SHA512
8a8fd18c374596a405ded5b9f23dccbd3279a2944c6ff9505e71a3164f8e60d6d1df48b243afc17a24d7d56f256eaf850de436f2c930bb13e6c24252c793e7f0

Download Submit
C:\Windows\SysWOW64\Fjnjqfij.exe

Filesize
62KB

MD5
0cb779a99d33a2690d267b65445f69d9

SHA1
7bd7dcdca5c915810b9846cd27190a9edcf1bb6d

SHA256
a44fec1bb54bb06bead02d554c1b00fee38756ebad280339e944498a38ec5851

SHA512
bfa10e8f54edfee6bf437a5f9a73c09e65763c4d1fa4c6b09297bda4c2ade5d0bd0d02b55447d19de1284cdd1e638130fa7eaf7505758e1e81ee504f05fdfde1

Download Submit
C:\Windows\SysWOW64\Fobiilai.exe

Filesize
62KB

MD5
f25b3147d3fbcb4f5c0fa1408f4fdb4b

SHA1
0ffb3a894814370ee379b372ee2f902ee6a41163

SHA256
728487a7c7281e0cbd4ed398579e58fe61958608c906c1f7ae228be9fb22dc89

SHA512
45a2645aaa6bad1024b27395e3ef1de4f91d080f67a99323af46507821ca18731abb7732d407fb3fb9d3520be3a4d36c490f114f5e0f241110b187232386497b

Download Submit
C:\Windows\SysWOW64\Fqaeco32.exe

Filesize
62KB

MD5
64f503fac188068bd3e0e82eb603ae83

SHA1
1172b7f6eecf391bf599972a638968d5020bee08

SHA256
b44b0511147c8354bc56894382480475727cbd0f1d0bcd942d08de6631ea4224

SHA512
b9bf2cb00d273a51cbb8caf6a696d44e105f4adcaaa4c0deefc11de61a500e73cb88ad4a7489511fb16ab275fc2b45e9e5fff2203528cfd43b3e6a3e0a04003e

Download Submit
C:\Windows\SysWOW64\Fqhbmqqg.exe

Filesize
62KB

MD5
3dfeebb43a4bc5edaaea8d84ad620821

SHA1
c3bcb62e253f42059eced5e246424f135ccbab9b

SHA256
ab6d608028a74009fc45ce9ed34ae92175268204e7c250551628a04ec4c58895

SHA512
09a9a755360939334aa88e0327641f7e5bd53864d872aa570634789ecca4595b2f5eb060fcd8ef9fb23d87c5856f6ed7a944132832d5a9b05b01187e281c7fbf

Download Submit
C:\Windows\SysWOW64\Fqmlhpla.exe

Filesize
62KB

MD5
f7001eec7a9ccacf88c499113eaa278c

SHA1
c14aea11e238652d2fdac720c0a0c19355efe23f

SHA256
a8ec5d808cc6a7ae6db41a838f1a0df2a651e173490d497b5414e020c8c0e74f

SHA512
775f917a7ba7e4e2328f8ba692bb883c8e2f7688c51620c9b248b8d2a7f2b957e3c00a306e7468588926000b1d78059d54f977d2fecc722768280796609c2c84

Download Submit
C:\Windows\SysWOW64\Fqohnp32.exe

Filesize
62KB

MD5
23edcb4a267a0b7d7617faf2fbb5cd3b

SHA1
2aa463b61625f9070b523b8873a09ea1d5e0a288

SHA256
7a8b8e1a59ad6d7a798ef9f6f4a1379118ff15dd5692cde110d9669ccbdf2317

SHA512
61983f1fd3682ff31032719d521775bf81aaf83d522b5362e99e99189f6b603b1cd707bc1f410cfe6730367dc5d26e77720bbb5a96da553b4cd2b6bd031f2151

Download Submit
C:\Windows\SysWOW64\Gicinj32.exe

Filesize
62KB

MD5
66085f62288b9b8ebbfd57a7aaeff62d

SHA1
dfaa3d76ca0916f98233549f38658d6526b48133

SHA256
3e82d52a3eba1186b3cb7773a26a96a3b51e9e2dedd39e7a2aaff911c55d8cca

SHA512
5c1d6f5c72aa02ef5f27030d02c91becb15be8a997b1fbd5ea4b1a4deaeadba44f1973c70df0aed519c49626d18da4212301257f5f00f89435b43c330273baa1

Download Submit
C:\Windows\SysWOW64\Gkmlofol.exe

Filesize
62KB

MD5
5ed7bc48ae649b7f938e6bd4d701fab7

SHA1
83bdce713bf4879ab987c3a0e4cec409e4db5eac

SHA256
756412a61f9196d6ea80a4accc15cbeb232145a0e0a98f74e14de4666ab90578

SHA512
aab2f16e42b1d27c335f3822fff808ee15978e91fffe80d141db5545c6dc6ebae184bc864e190fe06593b619bb34c3b21be5ab9ea1d7fdff34f52290182637b0

Download Submit
C:\Windows\SysWOW64\Heapdjlp.exe

Filesize
62KB

MD5
54826aed3ae296c3f880af88dd9c4394

SHA1
4d4229b268be03fccf053ef980be510fe8e3f984

SHA256
b7320f905bd0a4a8768a7a33949f9b4253c10e8231ba137b1ec837c360c8538a

SHA512
cd8c48bf0e5e87f0fabde16ae6afaab69c83fad3da0c072c62662091fc2c78b88fd795a54dc980999170f4c726e7f8076827d454480b490e20da4d5a2c008d23

Download Submit
C:\Windows\SysWOW64\Hecmijim.exe

Filesize
62KB

MD5
015046095a7c7bbed22a0d7609895271

SHA1
4c638c6a1714bea6e842bd835b988b040bd0827a

SHA256
a16ae7d7985aadc4db9f3a3d6a7a131f178faf71bfd30a47db2433c14ee948c7

SHA512
63f97ec5b6f8c1523294ab417f62f5a48ee7105e817cc9d0aed5f3c09dd1867bfe0adcb0d6bf2185f26b6fce0668504d264882f23cad36c7272bafac10d19d46

Download Submit
C:\Windows\SysWOW64\Helfik32.exe

Filesize
62KB

MD5
776fe846f3929b57a8656b002864a31a

SHA1
a2adafef4800d1bff8a3069979a6c4dea0294aa0

SHA256
0af7f88303676a3e91fea7ff0535361deff95558ed3dcad4dd36991426c11e37

SHA512
2696a9db81c18b983580b6faa3d0c50fc91c3d67bbbed14321a2c026568804ed8278b7f99d7fbf71dbe11bec2b2b560a662a992877d4a27c3f41cc13d4439851

Download Submit
C:\Windows\SysWOW64\Hmabdibj.exe

Filesize
62KB

MD5
bb6fd20be5a67c077ab74705ec2911af

SHA1
97c4756c51020590a5546b4b0571549e50d83329

SHA256
c7400bc08975a0f501402f6a4ec91839d260af1eb2f507747c7d141d9021b099

SHA512
e32c2a97e0ab903766957b260c968b31069469fcf597c0a1e994f07d5e87cee79099c0048c2f7334d3fbb3129c9fa500fb58410a774d1a48b588e382d3e11f14

Download Submit
C:\Windows\SysWOW64\Hmfkoh32.exe

Filesize
62KB

MD5
6e56b8272ea8664d5973a3b4ac10396f

SHA1
2cc67005f0ff1c25f0c45b256a586484844e74ae

SHA256
562e28e3debfe6da4578d7f65f27ca3b07cae810e37c7b4e503c31a4154db9b7

SHA512
8edf1128608e94405b428a5628a65aa5744ba9e2e1b280a2c5def9f4f06a73db81e9460bc7d46351f9e0144ad3a69ca2b2a8963eba999fdb8266fb658cc57b46

Download Submit
C:\Windows\SysWOW64\Hmmhjm32.exe

Filesize
62KB

MD5
a4c44964597ff4ce35cdaf8ba52e2540

SHA1
725cfd373c78bbc9c11478ebe7c9c95116025452

SHA256
ccbf1f01f21da6a115651d0edebd5ea66e61217b44de6f5523152df22a527e94

SHA512
bf5658d8f2b25659fd2b6e215e762f189aff658e62b8f2a5f27e1cf59c6c4b38316a9ca5c957ad3d310c154820541de814369aaa4508ab4be6f5e8aaaf4a8403

Download Submit
C:\Windows\SysWOW64\Iehfdi32.exe

Filesize
62KB

MD5
8d4345a3325b5fd5646de0b78661e2eb

SHA1
c48877bb63cda604cb6d21ef6ee7f21e35feac69

SHA256
8c3f71e4f6dbbd166a1db4c9eb41eb5a1c827c0819fab52fb3921bc404c6db39

SHA512
cdec1c8e5537df3117cb66d756be96c07a81ad2a98c9a4d01ec9e06e4a8047ac1172102a52931fb0fb2c596d7d045d352edf89b32d1c6970f87aad5b00540497

Download Submit
C:\Windows\SysWOW64\Ifgbnlmj.exe

Filesize
62KB

MD5
e73c517aa34f32d647d6c7e4a48c5b47

SHA1
b9c6d66bdf7815bd868eb84b36358c0484d73c85

SHA256
a09d95ac96c0a203dc51317cf7aa82f085e9b90275002733986470feed80926e

SHA512
dc0884a8c67fae79efff51f80e598a20889dc3bbcbbe7b0df8b3d8cc66c17841511e19835ff43f9633a5b4bb6f10e3965442c948200cfc35434074ff16801645

Download Submit
C:\Windows\SysWOW64\Imdnklfp.exe

Filesize
62KB

MD5
26f126d3c3fbb5526029ae6de1a890f8

SHA1
18ece4f3eef638a31dfd9b6da108023517e3f992

SHA256
828ea7c63a1a009433ed1d628496c624753a7d5fd723373d7385360e62e22aeb

SHA512
b30a0738aa6b015bde1b2a18c3f36e990df7192043266916255349f2ef712e0ea38f0844e0ea21777a32dbab3032b1de2493e3e339de7a6d7c6abf281cdaa726

Download Submit
C:\Windows\SysWOW64\Ipnalhii.exe

Filesize
62KB

MD5
eedd20ae500270b818c7cf89fdcb9e72

SHA1
9d5fdb28c4586e975e75648d3eeb75430bedde84

SHA256
fc10585ce0bddf485672e751e6cc3982fb72fdcaeda3c3152c02b9e78226c833

SHA512
27cb2476667899eebe7409f2c74fadf2bef8d105965f0108b17cba9b97cde8570736b99166ddacbdb267e410efc08591f60bda565a4c39073c2e86013ebe3cf6

Download Submit
C:\Windows\SysWOW64\Jbeidl32.exe

Filesize
62KB

MD5
fe013ac3003ebb2990f113f625bff657

SHA1
5c7f2dabaea6462a892036096c3ec68c23aec976

SHA256
79f2f242cd62dcf272e0572edd7c3eb2da396e690b96e84b6833a5ed7af4437c

SHA512
9d75c0c3d2d6c137800e27aea31577f9315543aaf6ff96b53f5c59c41c09a321b85fbf5a165cbe94203b2a73e5184f1264724283357442d08baf9da59c32154b

Download Submit
C:\Windows\SysWOW64\Jblpek32.exe

Filesize
62KB

MD5
059b7aca512e397e53dddf98cdaf5c7c

SHA1
60c5c9fa352a42e962f5059679748304b3772968

SHA256
0b7e83d48f04ded1948bd4356243d1a710038f0aac7b41566434e3a2b21b5728

SHA512
1d6ddab89eedc228abfe8b289b3c47a26d43186a2a2f489516fa77fb89f94ff1e05499a5cf4ccf961c1466626388947baa7d1f1b988f8667fd53b31faa789c59

Download Submit
C:\Windows\SysWOW64\Jbocea32.exe

Filesize
62KB

MD5
3579d17253506187701b3b261e0b1723

SHA1
a3e2a146bff7ac05123bfa3e3de7431be068afd4

SHA256
42ac1747e78bdb59ed0984e7891ed9b76b7f9e0cb334e7725a7f3ff3a0b0506c

SHA512
9c24dc8263f710536549037c5ecd59751cb3e533e80019535c4068441d1497bf6426415d0f320732e66b3e882ea1e33f5ededf3026d4e86fbb78de359f61b83e

Download Submit
C:\Windows\SysWOW64\Jcefno32.exe

Filesize
62KB

MD5
cb07dde024915e1fc1747b320f6b4ffa

SHA1
6697b116e73305048479d7b7b0050d0af545440b

SHA256
e6bf99b2927459e3f247524f8cbde6c00da2ab911b32b0fcc2f659932f82e7a7

SHA512
9fc7841945521f2ff71e384431541e4d08a17f28ff9ff6521209c9842f63d46eac58152a7caaf35a77d81983099b33f2a619cddbdab42b3574dba6cf4d27e4cd

Download Submit
C:\Windows\SysWOW64\Jplfcpin.exe

Filesize
62KB

MD5
ac28c349f72d7a6aa240ffb4ba8be90c

SHA1
294b80a4de3bce2996bd7d5143106cb20909a53c

SHA256
12354fa0c896f86dc3e934b90b7fcf9a9daa4042a671d631e5df124d3c505896

SHA512
0a59ac9c7341d8231af1eef2a6ba89bcbe99d28f42db73e38cd701f2920fd2d2b4425df5eac38bd059ebc6a1d0a882d2f087eb04c9affbc90c33d3e55d9890be

Download Submit
C:\Windows\SysWOW64\Kemhff32.exe

Filesize
62KB

MD5
0013e8a59e8d9213396c9000495b4801

SHA1
78f1e570da7411035eecf7af5312d2ae2d40c4cb

SHA256
f8ec715e1f2053a7e02d2457bcfc88767453f4a6c961c2899f256f29ecb7eeff

SHA512
3b82c284317a14ef9c24dee5a74c97b296015610c06ee3ec97c450c07669b958b91ff095187dc6251120df23160eb21a96f899933ab989b0007e9a37f92aa3be

Download Submit
C:\Windows\SysWOW64\Kinemkko.exe

Filesize
62KB

MD5
171b4e4260c1276da0a3e615512e7c35

SHA1
000f7d6029e97410cf6953ff5011899f10d751ca

SHA256
cd00c61706844b1fc01eaa5ef971c0e6b36d4b21809e473d27ca9fef0d264f4e

SHA512
bdf9fbe91afe40987fd91bf7181c82a08e8cd4d11420c62b75e98035ae6393670b83e80045bf29ef27f2938178f76abf7d0d89c37a35cfddbec158538a1c8997

Download Submit
C:\Windows\SysWOW64\Klngdpdd.exe

Filesize
62KB

MD5
2dd39b07255e3085b9df596838a28ba5

SHA1
b8db271d2517a997ff347515cbdb5557a279b85a

SHA256
619b117080dd1efb01fdf80fb6228e9ecb85afa8d096060e638784d518711acb

SHA512
efab831eedad3f2c3c747b0d1a6090669b7eed4fc423b5926bb1e61367dd9e8c68b08c3441f1cd45728ffa9efb54b22be55fba228dd4ad16052289d88ddfbc8e

Download Submit
C:\Windows\SysWOW64\Kmijbcpl.exe

Filesize
62KB

MD5
11b1eb200d063544f1f0c9e201a46715

SHA1
a7e40765809c9b628822e59dde033fff5f8c71c2

SHA256
ab45b9122a7861fe578564f094ea2bea94cea77db5f2669447e95185279fe4ab

SHA512
abb04bb771b48e6189459fd2d309b846fbbb3697ade1c13f57be36910d3c7b98ec622ff96bd905d53ec9b9705a783fdf6a517ddbac8808b76e3ba387df47b7ce

Download Submit
C:\Windows\SysWOW64\Liekmj32.exe

Filesize
62KB

MD5
931d5fba4050336efa4544bfb5f3d1ce

SHA1
60111d03cd35b406568be87636240d95d75a87ac

SHA256
665fcdbe5ec0f812650dd348942ac17bdee7f2e991da2e80260f66e6ba0fa297

SHA512
fc8071fdfb4dc46a435d5bf9d67936308ef99f3ef0b617f9065d9e7d99fcbdd40dacb31678b250e11ba1491a9ee2671cd4b1523c1896d6735ca17e97b75239ea

Download Submit
C:\Windows\SysWOW64\Lljfpnjg.exe

Filesize
62KB

MD5
adf8d10186f15e4bed87ffe6a96318a3

SHA1
2fadd2ffa6fc7693290c4b888d4f78c2fff08018

SHA256
752e4d22d537a629860ee5dc75315f2b831cd5c43f393ea11580f6731aac818b

SHA512
24cacc9f4f9ec56f22317b799446201d640fa83226511555b76903329035235a12b6bb3229d7d5158f0685bca7180c96ddca09b1752f171123d2030af183a9fa

Download Submit
C:\Windows\SysWOW64\Lphfpbdi.exe

Filesize
62KB

MD5
8b59cd6f5701573a25df414dccacbe4d

SHA1
0ad44596ac48c88c28686a775dbe7028ec81b5db

SHA256
df22aaa15e08a35d571f7c5eb56438f877d0aa26b1efed7b2594280a0ea09ad0

SHA512
3c2dbd1a1f7a9a1a1149003e1f2575f366d7a91c096f71980be7cbe03c32cb8e41b7b693745e0c69e1ce73eec8edbd2459c0f975bf5b75218392bb0c0cb45165

Download Submit
C:\Windows\SysWOW64\Mcbahlip.exe

Filesize
62KB

MD5
a233fa0eccb13de7b231473992d38184

SHA1
dff6416be516b69a6d84d760d019de86314a1054

SHA256
cb345a077aa28ecdb09fa1fdb76326c640d88c8b06526e2e5122d415a7dc945c

SHA512
2e39b2c1b5af3b1d7d6fc190e7345be39365b399019ecf9028feeef962b7240f06102217c77d404b4250a8511bbc6845e82c0d050d546d93ec2f1e527a89b932

Download Submit
C:\Windows\SysWOW64\Mcnhmm32.exe

Filesize
62KB

MD5
dc9ef9d436bc67f021d9f9ea8e8a5cc8

SHA1
5e84becdb4e7e9d25954c2166186906d251b312c

SHA256
276216e80e547dc1d12b6523d7ea0de8ee4c6c2378582f70c66fb80b36e09097

SHA512
e7802b7243281ba1604cdf42702b06ded369c0db25a51e639bd9f1277764050464715cb6e9b10a4b9136cba8e37a3c591e64925da66be1234e2723fef3fe4c62

Download Submit
C:\Windows\SysWOW64\Miemjaci.exe

Filesize
62KB

MD5
837a1f0cdae21a1584bf56a2fc9dd04c

SHA1
a02b24dd009d2eb5cbc1253690e44923cd228c01

SHA256
00208c9cabf20de8887632135ca89675313599a5d0a8da06a5999d308d3062fc

SHA512
f34cae4f39a201cc9c8125aac3aee7c0e59af8a8c28cbff29b846e54030ad5683cf07fbd83be29f15cca140eab002e4c1cc9049de2cbbbc36234c3a9e05344f9

Download Submit
C:\Windows\SysWOW64\Migjoaaf.exe

Filesize
62KB

MD5
5aa122039b9d07bd5efc8ae4b90cfb50

SHA1
367d902b2fa90f4189fa3bff71d404b1b55746ce

SHA256
2a9a76636a9e15056137467d5dabe5eea3e6d84732dc95669139f521122d97f5

SHA512
edc428b9480373c865eca1fb570a4c686e47048d9f0736c27e75f201d1a5c13f8a876a58bff27c25cd8489791da4608d486612b714dcc5761ea13195f86b25e8

Download Submit
C:\Windows\SysWOW64\Mkepnjng.exe

Filesize
62KB

MD5
f796acfc262ededa20c79a93be8bd47e

SHA1
e8652c8983fafd78498ce5afabc9358c58ead168

SHA256
b2b6653e53cdc33c366e0aaa786fa2c24abb74727378f19d1c3b54ce75fde93f

SHA512
ea686b4ff5f3ca0f82af7303dd15f62c6232c3e427918cc82ca420fb2e64168f9a649d25e8c0cdb2d8c524a5c8c376c2c3c53ee8c8882ee18e82daf7c6d9b59a

Download Submit
C:\Windows\SysWOW64\Mmnldp32.exe

Filesize
62KB

MD5
ee720f9a97ecab82f6f4c914127e6c7d

SHA1
58121315d7eb49981baf8725b644262bc5274222

SHA256
0c749b617739e79a589bec9d7accd218c2ea4bda50a3c43a8225ca0a7e97c3b2

SHA512
60842d58cea3dbb975854fcb1b99679b9142fd64acb864a91c7c5a8e206eeb44ab256bec7e189f4a4aa6fd882717a666c922345132159ca0c0f61d0611f6a440

Download Submit
C:\Windows\SysWOW64\Mpaifalo.exe

Filesize
62KB

MD5
28781516f87e6d544334e0fecb9bf8f0

SHA1
1ce1b3e19f31020a84395ad1d0a1dc2ced3141b4

SHA256
27cd0eea95f443f2b13bc7ff3abd6e3d4f27f62f891b09bff14e4c05f256ca26

SHA512
e08bc508aebbd9084ba996317e13b2de4cc74e62091c5ba8e632c6682ef4fee9ede82d4253660b21370b54bbf8a1eddd6511c1ca56fa6bbee4cce34b35cb2a46

Download Submit
C:\Windows\SysWOW64\Nbhkac32.exe

Filesize
62KB

MD5
5d98f51b5045c707922dba33b0b21b79

SHA1
9aafaed73432036029d6f93ab9ba4c1981b0628b

SHA256
01d841b42adda447e12cacdcc86c67ca9d8529c3e50020943a862cdbedf1bfd0

SHA512
17d2f6b7f8fbfcb00e00110f6f056016ffbe72fbad4a99167ca7785ce8ffeb63e4b3a84128fad5b6487e15a109d7aa9b72e91646cff032f31ba78c8077b6bb3d

Download Submit
C:\Windows\SysWOW64\Ndcdmikd.exe

Filesize
62KB

MD5
1a3bae487e364bd6a08c2d2822724c55

SHA1
81b540349df6ec682291835c03e7d809849dee26

SHA256
20e43fed2f6add6fab156877e998c1116d3e87737ba2ed021f2b49697295d619

SHA512
6168c1c4d615184d1ade0ae3756eda0da7040229170907e78f1894bd49686c55b3ff44bafa0ed203096c578acd746dc57b7b30d8170ffd3592682126aab9cd93

Download Submit
C:\Windows\SysWOW64\Njciko32.exe

Filesize
62KB

MD5
c617df60066771616d4f17ccd2bc37b4

SHA1
e60307fcd95c27e6507bdfdf9149a484b2cbc274

SHA256
0abd908d1558fc5bbe591f260c46dbee5e2ed33b537353a0c99c35e723282cee

SHA512
9ec20b09dbf6562e77aa4fa896a625ceda3c97ee7397e44026e77e377220e8f49f083864b7c74b485d6cd84fb8dcd618a47cdaf636f7f0ce8a8fde6c31621df3

Download Submit
C:\Windows\SysWOW64\Nnolfdcn.exe

Filesize
62KB

MD5
0862ff0a9ac0404167474a5ec5c1b250

SHA1
2164689d14afdf460778bda68a58760ec2e8ce05

SHA256
a9e53b1bb2eacb139f68ad65658b655dd6637a4ae4d703d779730128142d9eef

SHA512
f82a87c56121ae782758597214732de1dc243acc89e21389bb3186a7fe5af7fa110b3f28d9b6d49a525a2c3e3a83b40c8e5419d04e62ade89e794f6fa43d2c76

Download Submit
C:\Windows\SysWOW64\Npfkgjdn.exe

Filesize
62KB

MD5
4f3e5288ef83a51c8cf358b0a9c2a9a6

SHA1
5ac25d2917706d4cd2f2cf1c19721c8504421f0e

SHA256
4fc62492fe5d7640766c1f2db16520f3066d98a4a5e2b109503aa8570f415aac

SHA512
7aed1ec135d59d54d744f93334ad3707f503928983e42e5636ba99c5bac10f5cf4fd74bbf28049b2b2aaee675692ccb4bcc2679481362c17473ac488009d4381

Download Submit
C:\Windows\SysWOW64\Oboaabga.exe

Filesize
62KB

MD5
5ca426146efd658e1d6aa71ea67a14f6

SHA1
0947e57e2c8d7e37f761920a115b2a5e9a9df635

SHA256
39e9f91999227996ad66cd7bb264ea9bc263ff7cc8c9ac267a78995372d44f6f

SHA512
fff58c2975d96b1879788106b2c4b396c5043231b9fe2c4f56bdeed766f79636cbfbfce1a895e557148b32bb2599e628e440168da12bd8976717882548d5608b

Download Submit
C:\Windows\SysWOW64\Oddmdf32.exe

Filesize
62KB

MD5
823d1c5f8e951bae214f44cbd47c9f09

SHA1
361e8814adc34b91af7614f78414433efe297996

SHA256
ce45c34168cf410ce594c465c46e1578d6e7fa2ef6154f13b3def173364b9261

SHA512
52fa0cbedb59a131c803f937f2f111fa14244d2617f6089d3af03cb5142b46cd99310801fb530bfa2fa27545a8f21b118579a949688ce64008e232e5dd27df0c

Download Submit
C:\Windows\SysWOW64\Ogifjcdp.exe

Filesize
62KB

MD5
1b09bcef914dc0617706a7494e86f945

SHA1
3168dccda55d665573080d2743c4537e5ba47486

SHA256
2f44da48d842fb5175ca66eb1c7b44e7bd5f9b27dcc6cc268b3986acf8963046

SHA512
787d9427cffcbfe32212d36555510bf1dacaac25b409ea3aa96b4618b9635831a82bda43db12bcc0d35c971ff102e39cde10723441252ad30e41e31d76068043

Download Submit
C:\Windows\SysWOW64\Ogkcpbam.exe

Filesize
62KB

MD5
ea584f673be70a7eed965f327f21055f

SHA1
a18c3f5b38f71b1627c4ff17830c6ca4aaf18ef6

SHA256
92bccdfcab784552c6115bdd5472e8ea1b1d70d28ee7c5a197ecec706c4d06ef

SHA512
859478492e5538ddb778a1973e85a8f696c58147627c4ee32e7cbc8820e05c269b74b02d0842802cc643c43d8d06a29ad89646c01852a884de85b83d4e4c82cd

Download Submit
C:\Windows\SysWOW64\Ojaelm32.exe

Filesize
62KB

MD5
2bd15ddb8e16eeabcaa047195bc556e1

SHA1
6e527883c73c4aee5b02c9f3c2cdc9279728852e

SHA256
90de5355b972a73814e849131592954551d11e7911d3e79a2a51afb8f20ae7db

SHA512
8fad161e452e02a18e09aa52081629e2eabb0b09a4500732ae65bbde89443237d69cb81dde9eff324d6aa4522d0ab763735ab074e700fadcf9bf5c6828be78f9

Download Submit
C:\Windows\SysWOW64\Ojoign32.exe

Filesize
62KB

MD5
f2a3ceeff9eedd720652ed238570037f

SHA1
28305d359975526ed2dfcd7d1bb100243aa4cf1f

SHA256
5e9c66e94c1a5b2d32650de4540ea57e36b80d7a2b2f43b71ba426eba113ae42

SHA512
95c56ae8cf9f1468834a19915fba4eef07db07b5231a74b3f2673e50f2cd2dfc000f65264a1a7b25e6760207d60113fded591417de06aebe1a212ec096ca0af6

Download Submit
C:\Windows\SysWOW64\Pfolbmje.exe

Filesize
62KB

MD5
6c0ac1577f6481af0c81a80dc150bcb4

SHA1
4d672bc2d4576b11454d2844b5014a01776d0576

SHA256
86aef369b31ad7e3bff6e5995735b168afb569293f1ddc8b08568f57c30d630c

SHA512
dbc80f6c66a3cb6f66a4e8a3061fe42715de62f85ff7054186136b8b02e4fa0d0d8174f8a5eae7936bb8784d33bbe445a24e35dd17ba3c03eb1bd3cf8d17e2db

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
62KB

MD5
cbd0d003396f14cff566db4d0b3c2fde

SHA1
1d4648f7e771de3ca7dac68320193cfc031ac17c

SHA256
06b1bfa0f475fe3e869cb91d7ddae9c53426b35a59d62ccb6bb1ee8458f93362

SHA512
7553b36028d4a3ee2ebc07768464db8335b47ee332b76e86eadc36fc2f4c3be9a29e5729d324d6aee12b50c006b3d314940d03bc3651483a0249a25b5c60791a

Download Submit
C:\Windows\SysWOW64\Pqbdjfln.exe

Filesize
62KB

MD5
b625b09bfb69a67ee07652c35c8b7eca

SHA1
4f8e255b722c554ccf147720f69430e8400fa0c4

SHA256
d647f045a6d6a12bafff5a5d51b1623aacad91e83ffe66d99d885b37a6501e49

SHA512
ede82213fbaed38d15232dd44cc2cfde2132a2511276eded819caef2672df33b063e38d2a06b817878fe576fde242bacbb3ede1122f76b67cb51217c04a16e63

Download Submit
C:\Windows\SysWOW64\Qalnjkgo.exe

Filesize
62KB

MD5
a2b2c8c7aa56f96d8964a08e0954e19b

SHA1
5451d6105f5fba5886f00042d9a552664fd5f546

SHA256
d90bd02611818e0b055045349d74b4f15cffa7c407d90a59b6a1e68e2fa15631

SHA512
47f0f3a4965dd521010746e1949e8c2fd013c52e4ae50c2559b98241754602fda50fef5901a1db4ac072fbfa0d0e5b10b2b614ce56392969b4045f5bb6910558

Download Submit
memory/228-435-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/384-337-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/384-402-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/400-380-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/624-197-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/624-285-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1304-280-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1436-115-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1436-33-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1440-288-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1440-206-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1640-74-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1640-164-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1744-396-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1824-166-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1844-403-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1848-99-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1848-21-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1972-126-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1972-215-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2248-224-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2248-306-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2264-327-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2360-336-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2360-266-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2364-383-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2364-447-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2404-49-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2404-137-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2676-253-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2800-41-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2800-125-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3152-363-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3152-432-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3172-157-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3192-90-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3192-8-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3236-379-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3236-310-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3244-196-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3244-108-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3264-241-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3264-316-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3292-175-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3408-395-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3408-330-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3412-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/3412-73-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3412-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3436-458-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3456-295-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3456-216-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3464-179-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3464-91-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3496-354-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3524-343-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3524-409-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3652-394-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3708-329-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3708-257-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3852-362-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3852-296-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3920-154-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3920-65-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3936-359-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3936-289-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3968-82-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3968-174-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3972-56-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3972-142-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4076-373-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4180-189-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4180-278-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4224-187-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4224-100-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4272-410-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4340-421-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4352-448-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4360-139-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4376-205-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4376-117-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4392-360-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4512-445-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4664-382-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4664-317-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4768-286-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4772-144-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4772-231-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4848-29-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4864-426-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4936-433-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4988-180-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4988-265-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/5012-308-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/5104-309-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/5104-232-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads