269c94748f411e7bfedd4ad06cd1261b683eff28ea619e2da6b85fef23cf63a5

Analysis

max time kernel
143s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

055ade11c031b9e4b92b7a64a4cc2c60_NeikiAnalytics.exe
Size

243KB
MD5

055ade11c031b9e4b92b7a64a4cc2c60
SHA1

d4640bff9b1da7f50c638e841ea46460fe583a1e
SHA256

269c94748f411e7bfedd4ad06cd1261b683eff28ea619e2da6b85fef23cf63a5
SHA512

1f9a89ef63118a792361a97323f09fe2e96f8ba3f1890b7419c4a8ac877c61ac3964eb88801754d5b984ac603e4139292a755add72e7c4fe7767691f6684f525
SSDEEP

6144:vAzU8sGuE0d83mZKzwdlU2zlNgwTnAWtlhjQ:4zU7ZAkl5LhDAalhj

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efblbbqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmlfqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddnobj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nimmifgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkceokii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppjbmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cponen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acccdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgiohbfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqafhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcpcdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfaemp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddnfmqng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfihbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljceqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adepji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eblimcdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbohpn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpcdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Egohdegl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipbaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pciqnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhfaddk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbbffdlq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnfiplog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fooclapd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igdgglfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bphgeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egohdegl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojhpimhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nadleilm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coegoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iogopi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgeakekd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmdlmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdlkdhnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcgpni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oaifpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpdennml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfaemp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jilfifme.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hefnkkkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfandnla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Conanfli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckbncapd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmafajfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbgihaji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iojbpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmhdkknd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgbefe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipjoja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgnffj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpkmal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iojkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iialhaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eokqkh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qodeajbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omalpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmnnimak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Goglcahb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilnbicff.exe

Executes dropped EXE 64 IoCs

pid	Process
3508	Coadnlnb.exe
4168	Cfkmkf32.exe
3412	Chlflabp.exe
3756	Cofnik32.exe
2732	Cdbfab32.exe
2020	Chnbbqpn.exe
4320	Cohkokgj.exe
3340	Cbfgkffn.exe
5016	Dokgdkeh.exe
4688	Dhclmp32.exe
2308	Dmohno32.exe
2224	Domdjj32.exe
4432	Dbkqfe32.exe
4928	Ddjmba32.exe
396	Dheibpje.exe
2656	Dmadco32.exe
3248	Dkceokii.exe
1548	Dfiildio.exe
3148	Ddligq32.exe
3228	Digehphc.exe
3616	Dmcain32.exe
4204	Dkfadkgf.exe
4428	Doaneiop.exe
2632	Dbpjaeoc.exe
2488	Ddnfmqng.exe
1788	Dmennnni.exe
4188	Dodjjimm.exe
5092	Dngjff32.exe
2280	Dbbffdlq.exe
3672	Dfnbgc32.exe
424	Deqcbpld.exe
3592	Eiloco32.exe
4980	Ekkkoj32.exe
2160	Enigke32.exe
392	Ebdcld32.exe
1060	Eecphp32.exe
1172	Eiokinbk.exe
3272	Emjgim32.exe
1120	Eoideh32.exe
2260	Enkdaepb.exe
4420	Ebgpad32.exe
232	Efblbbqd.exe
1296	Eeelnp32.exe
1048	Emmdom32.exe
3108	Ekodjiol.exe
4344	Eokqkh32.exe
1920	Ennqfenp.exe
3376	Ebimgcfi.exe
4024	Efeihb32.exe
4888	Eicedn32.exe
5068	Emoadlfo.exe
3660	Ekaapi32.exe
3764	Eblimcdf.exe
1260	Efgemb32.exe
836	Enbjad32.exe
3224	Efjbcakl.exe
3260	Felbnn32.exe
3460	Fihnomjp.exe
1680	Fmcjpl32.exe
4200	Flfkkhid.exe
3668	Fpbflg32.exe
4108	Fbpchb32.exe
2268	Fflohaij.exe
1732	Feoodn32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bcbbjj32.dll	Eiloco32.exe
File opened for modification	C:\Windows\SysWOW64\Flkdfh32.exe	Fmhdkknd.exe
File created	C:\Windows\SysWOW64\Ompfej32.exe	Onmfimga.exe
File opened for modification	C:\Windows\SysWOW64\Oaplqh32.exe	Omdppiif.exe
File created	C:\Windows\SysWOW64\Onnnbnbp.dll	Pmkofa32.exe
File created	C:\Windows\SysWOW64\Cdhffg32.exe	Cmnnimak.exe
File created	C:\Windows\SysWOW64\Gppcmeem.exe	Gmafajfi.exe
File created	C:\Windows\SysWOW64\Kjjbjd32.exe	Kcpjnjii.exe
File created	C:\Windows\SysWOW64\Mcpcdg32.exe	Mqafhl32.exe
File opened for modification	C:\Windows\SysWOW64\Aiplmq32.exe	Acccdj32.exe
File created	C:\Windows\SysWOW64\Amqhbe32.exe	Akblfj32.exe
File opened for modification	C:\Windows\SysWOW64\Fohfbpgi.exe	Fniihmpf.exe
File opened for modification	C:\Windows\SysWOW64\Fmhdkknd.exe	Fimhjl32.exe
File created	C:\Windows\SysWOW64\Dmcnoekk.dll	Ilcldb32.exe
File opened for modification	C:\Windows\SysWOW64\Ljceqb32.exe	Lgdidgjg.exe
File opened for modification	C:\Windows\SysWOW64\Mmmqhl32.exe	Mjodla32.exe
File created	C:\Windows\SysWOW64\Kllfakij.dll	Nmbjcljl.exe
File created	C:\Windows\SysWOW64\Fenpmnno.dll	Offnhpfo.exe
File opened for modification	C:\Windows\SysWOW64\Iialhaad.exe	Ipihpkkd.exe
File opened for modification	C:\Windows\SysWOW64\Lomjicei.exe	Llnnmhfe.exe
File created	C:\Windows\SysWOW64\Ojemig32.exe	Omalpc32.exe
File opened for modification	C:\Windows\SysWOW64\Ieidhh32.exe	Ioolkncg.exe
File created	C:\Windows\SysWOW64\Hpidaqmj.dll	Jgpfbjlo.exe
File created	C:\Windows\SysWOW64\Oglbla32.dll	Ompfej32.exe
File created	C:\Windows\SysWOW64\Oabhfg32.exe	Ondljl32.exe
File opened for modification	C:\Windows\SysWOW64\Pmnbfhal.exe	Pjpfjl32.exe
File opened for modification	C:\Windows\SysWOW64\Gokbgpeg.exe	Fiqjke32.exe
File created	C:\Windows\SysWOW64\Pcegclgp.exe	Pmkofa32.exe
File created	C:\Windows\SysWOW64\Cmedjl32.exe	Ckggnp32.exe
File opened for modification	C:\Windows\SysWOW64\Hlnjbedi.exe	Hfaajnfb.exe
File created	C:\Windows\SysWOW64\Bgqoll32.dll	Ljceqb32.exe
File created	C:\Windows\SysWOW64\Dilcjbag.dll	Bpedeiff.exe
File created	C:\Windows\SysWOW64\Fmhdkknd.exe	Fimhjl32.exe
File opened for modification	C:\Windows\SysWOW64\Hpnoncim.exe	Hoobdp32.exe
File opened for modification	C:\Windows\SysWOW64\Kcpjnjii.exe	Kodnmkap.exe
File created	C:\Windows\SysWOW64\Pjkakfla.dll	Lgpoihnl.exe
File created	C:\Windows\SysWOW64\Mjaonjaj.dll	Egened32.exe
File created	C:\Windows\SysWOW64\Kjlopc32.exe	Kfpcoefj.exe
File opened for modification	C:\Windows\SysWOW64\Loighj32.exe	Lljklo32.exe
File created	C:\Windows\SysWOW64\Efoomp32.dll	Adgmoigj.exe
File opened for modification	C:\Windows\SysWOW64\Eiloco32.exe	Deqcbpld.exe
File created	C:\Windows\SysWOW64\Iknmmg32.dll	Mjodla32.exe
File created	C:\Windows\SysWOW64\Lkjaaljm.dll	Jbccge32.exe
File created	C:\Windows\SysWOW64\Digehphc.exe	Ddligq32.exe
File opened for modification	C:\Windows\SysWOW64\Llcghg32.exe	Lckboblp.exe
File created	C:\Windows\SysWOW64\Mpapnfhg.exe	Lcmodajm.exe
File opened for modification	C:\Windows\SysWOW64\Gmojkj32.exe	Fmmmfj32.exe
File opened for modification	C:\Windows\SysWOW64\Gbnoiqdq.exe	Gppcmeem.exe
File opened for modification	C:\Windows\SysWOW64\Nfjola32.exe	Nclbpf32.exe
File opened for modification	C:\Windows\SysWOW64\Njmqnobn.exe	Nfaemp32.exe
File opened for modification	C:\Windows\SysWOW64\Egohdegl.exe	Doccpcja.exe
File created	C:\Windows\SysWOW64\Eklajcmc.exe	Ehndnh32.exe
File created	C:\Windows\SysWOW64\Bcominjm.dll	Bagmdllg.exe
File created	C:\Windows\SysWOW64\Goglcahb.exe	Gpelhd32.exe
File opened for modification	C:\Windows\SysWOW64\Jgbchj32.exe	Jokkgl32.exe
File opened for modification	C:\Windows\SysWOW64\Lnjgfb32.exe	Ljnlecmp.exe
File created	C:\Windows\SysWOW64\Dbmdml32.dll	Qobhkjdi.exe
File opened for modification	C:\Windows\SysWOW64\Dpkmal32.exe	Dojqjdbl.exe
File created	C:\Windows\SysWOW64\Mleggmck.dll	Lpepbgbd.exe
File created	C:\Windows\SysWOW64\Hojncj32.dll	Efjbcakl.exe
File opened for modification	C:\Windows\SysWOW64\Ondljl32.exe	Ojhpimhp.exe
File created	C:\Windows\SysWOW64\Ogakfe32.dll	Phcgcqab.exe
File created	C:\Windows\SysWOW64\Fegbnohh.dll	Llcghg32.exe
File opened for modification	C:\Windows\SysWOW64\Mpeiie32.exe	Mhoahh32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11000	10844	WerFault.exe	526

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkbjmj32.dll"	Kpmdfonj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Momcpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efjbcakl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lhenai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flkdfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njmqnobn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipihpkkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckbncapd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajaelc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdcmkgmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpcjgnhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paoinm32.dll"	Fnfmbmbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Himfiblh.dll"	Iijfhbhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfmpaf32.dll"	Omalpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Labnlj32.dll"	Bbhildae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmblagmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kajefoog.dll"	Pbcncibp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajohfcpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bapgdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llodgnja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qmfqknfm.dll"	Lfjfecno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcleff32.dll"	Nflkbanj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chkobkod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elkllcbh.dll"	Dfnbgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffiipfmi.dll"	Efgemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhjhdagb.dll"	Hfhgkmpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Almoijfo.dll"	Kjjbjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kplmliko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngmnjok.dll"	Qbonoghb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbhildae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cildom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abklmb32.dll"	Chnbbqpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ahoemi32.dll"	Fijkdmhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhaljido.dll"	Jokkgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgjoif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cncnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldldehjm.dll"	Hfaajnfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejhdfi32.dll"	Illfdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjdhbppo.dll"	Jpcapp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bphgeo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eklajcmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmnnimak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Domdjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eeelnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdbplg32.dll"	Fmmmfj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnfkdb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lckboblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inpoggcb.dll"	Qapnmopa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khokadah.dll"	Bdcmkgmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbgihaji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipjoja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncpgam32.dll"	Lnjgfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qedegh32.dll"	Ojfcdnjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgeqca32.dll"	Fdlkdhnk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dheibpje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkceokii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilchfdgp.dll"	Dkfadkgf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omdppiif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipeeobbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbofpe32.dll"	Ngqagcag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fndpmndl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llcghg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajjokd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdmoafdb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 3508	3416	055ade11c031b9e4b92b7a64a4cc2c60_NeikiAnalytics.exe	89
PID 3416 wrote to memory of 3508	3416	055ade11c031b9e4b92b7a64a4cc2c60_NeikiAnalytics.exe	89
PID 3416 wrote to memory of 3508	3416	055ade11c031b9e4b92b7a64a4cc2c60_NeikiAnalytics.exe	89
PID 3508 wrote to memory of 4168	3508	Coadnlnb.exe	90
PID 3508 wrote to memory of 4168	3508	Coadnlnb.exe	90
PID 3508 wrote to memory of 4168	3508	Coadnlnb.exe	90
PID 4168 wrote to memory of 3412	4168	Cfkmkf32.exe	91
PID 4168 wrote to memory of 3412	4168	Cfkmkf32.exe	91
PID 4168 wrote to memory of 3412	4168	Cfkmkf32.exe	91
PID 3412 wrote to memory of 3756	3412	Chlflabp.exe	92
PID 3412 wrote to memory of 3756	3412	Chlflabp.exe	92
PID 3412 wrote to memory of 3756	3412	Chlflabp.exe	92
PID 3756 wrote to memory of 2732	3756	Cofnik32.exe	93
PID 3756 wrote to memory of 2732	3756	Cofnik32.exe	93
PID 3756 wrote to memory of 2732	3756	Cofnik32.exe	93
PID 2732 wrote to memory of 2020	2732	Cdbfab32.exe	94
PID 2732 wrote to memory of 2020	2732	Cdbfab32.exe	94
PID 2732 wrote to memory of 2020	2732	Cdbfab32.exe	94
PID 2020 wrote to memory of 4320	2020	Chnbbqpn.exe	95
PID 2020 wrote to memory of 4320	2020	Chnbbqpn.exe	95
PID 2020 wrote to memory of 4320	2020	Chnbbqpn.exe	95
PID 4320 wrote to memory of 3340	4320	Cohkokgj.exe	97
PID 4320 wrote to memory of 3340	4320	Cohkokgj.exe	97
PID 4320 wrote to memory of 3340	4320	Cohkokgj.exe	97
PID 3340 wrote to memory of 5016	3340	Cbfgkffn.exe	99
PID 3340 wrote to memory of 5016	3340	Cbfgkffn.exe	99
PID 3340 wrote to memory of 5016	3340	Cbfgkffn.exe	99
PID 5016 wrote to memory of 4688	5016	Dokgdkeh.exe	100
PID 5016 wrote to memory of 4688	5016	Dokgdkeh.exe	100
PID 5016 wrote to memory of 4688	5016	Dokgdkeh.exe	100
PID 4688 wrote to memory of 2308	4688	Dhclmp32.exe	101
PID 4688 wrote to memory of 2308	4688	Dhclmp32.exe	101
PID 4688 wrote to memory of 2308	4688	Dhclmp32.exe	101
PID 2308 wrote to memory of 2224	2308	Dmohno32.exe	102
PID 2308 wrote to memory of 2224	2308	Dmohno32.exe	102
PID 2308 wrote to memory of 2224	2308	Dmohno32.exe	102
PID 2224 wrote to memory of 4432	2224	Domdjj32.exe	103
PID 2224 wrote to memory of 4432	2224	Domdjj32.exe	103
PID 2224 wrote to memory of 4432	2224	Domdjj32.exe	103
PID 4432 wrote to memory of 4928	4432	Dbkqfe32.exe	104
PID 4432 wrote to memory of 4928	4432	Dbkqfe32.exe	104
PID 4432 wrote to memory of 4928	4432	Dbkqfe32.exe	104
PID 4928 wrote to memory of 396	4928	Ddjmba32.exe	105
PID 4928 wrote to memory of 396	4928	Ddjmba32.exe	105
PID 4928 wrote to memory of 396	4928	Ddjmba32.exe	105
PID 396 wrote to memory of 2656	396	Dheibpje.exe	106
PID 396 wrote to memory of 2656	396	Dheibpje.exe	106
PID 396 wrote to memory of 2656	396	Dheibpje.exe	106
PID 2656 wrote to memory of 3248	2656	Dmadco32.exe	108
PID 2656 wrote to memory of 3248	2656	Dmadco32.exe	108
PID 2656 wrote to memory of 3248	2656	Dmadco32.exe	108
PID 3248 wrote to memory of 1548	3248	Dkceokii.exe	109
PID 3248 wrote to memory of 1548	3248	Dkceokii.exe	109
PID 3248 wrote to memory of 1548	3248	Dkceokii.exe	109
PID 1548 wrote to memory of 3148	1548	Dfiildio.exe	110
PID 1548 wrote to memory of 3148	1548	Dfiildio.exe	110
PID 1548 wrote to memory of 3148	1548	Dfiildio.exe	110
PID 3148 wrote to memory of 3228	3148	Ddligq32.exe	111
PID 3148 wrote to memory of 3228	3148	Ddligq32.exe	111
PID 3148 wrote to memory of 3228	3148	Ddligq32.exe	111
PID 3228 wrote to memory of 3616	3228	Digehphc.exe	112
PID 3228 wrote to memory of 3616	3228	Digehphc.exe	112
PID 3228 wrote to memory of 3616	3228	Digehphc.exe	112
PID 3616 wrote to memory of 4204	3616	Dmcain32.exe	113

C:\Users\Admin\AppData\Local\Temp\055ade11c031b9e4b92b7a64a4cc2c60_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\055ade11c031b9e4b92b7a64a4cc2c60_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\SysWOW64\Coadnlnb.exe
  C:\Windows\system32\Coadnlnb.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\SysWOW64\Cfkmkf32.exe
    C:\Windows\system32\Cfkmkf32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Windows\SysWOW64\Chlflabp.exe
      C:\Windows\system32\Chlflabp.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3412
    - - C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3756
      - C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2308
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1548
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3616
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4204
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        24⤵
        Executes dropped EXE
        
        PID:4428
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        25⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2488
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        27⤵
        Executes dropped EXE
        
        PID:1788
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        28⤵
        Executes dropped EXE
        
        PID:4188
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        29⤵
        Executes dropped EXE
        
        PID:5092
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2280
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3672
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:424
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3592
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        34⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        35⤵
        Executes dropped EXE
        
        PID:2160
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        36⤵
        Executes dropped EXE
        
        PID:392
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        37⤵
        Executes dropped EXE
        
        PID:1060
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        38⤵
        Executes dropped EXE
        
        PID:1172
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        39⤵
        Executes dropped EXE
        
        PID:3272
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        40⤵
        Executes dropped EXE
        
        PID:1120
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        41⤵
        Executes dropped EXE
        
        PID:2260
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        42⤵
        Executes dropped EXE
        
        PID:4420
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:232
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1296
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        45⤵
        Executes dropped EXE
        
        PID:1048
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        46⤵
        Executes dropped EXE
        
        PID:3108
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        48⤵
        Executes dropped EXE
        
        PID:1920
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        49⤵
        Executes dropped EXE
        
        PID:3376
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        50⤵
        Executes dropped EXE
        
        PID:4024
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        51⤵
        Executes dropped EXE
        
        PID:4888
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        52⤵
        Executes dropped EXE
        
        PID:5068
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        53⤵
        Executes dropped EXE
        
        PID:3660
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3764
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1260
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        56⤵
        Executes dropped EXE
        
        PID:836
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3224
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        58⤵
        Executes dropped EXE
        
        PID:3260
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        59⤵
        Executes dropped EXE
        
        PID:3460
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        60⤵
        Executes dropped EXE
        
        PID:1680
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        61⤵
        Executes dropped EXE
        
        PID:4200
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        62⤵
        Executes dropped EXE
        
        PID:3668
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        63⤵
        Executes dropped EXE
        
        PID:4108
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        64⤵
        Executes dropped EXE
        
        PID:2268
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        65⤵
        Executes dropped EXE
        
        PID:1732
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        66⤵
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        67⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        68⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        69⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        70⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5336
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        72⤵
        Drops file in System32 directory
        
        PID:5380
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        74⤵
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        75⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5552
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        77⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        78⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        79⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        80⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        81⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        82⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5912
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        84⤵
        Drops file in System32 directory
        
        PID:5956
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        85⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        86⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        87⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        88⤵
        Drops file in System32 directory
        
        PID:2184
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5176
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        90⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        91⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        92⤵
        
        PID:324
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        93⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2644
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        94⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        95⤵
        
        PID:992
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5308
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        97⤵
        Drops file in System32 directory
        
        PID:5356
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        98⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        99⤵
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        100⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        101⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5580
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5764
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        104⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        105⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        106⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        107⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        108⤵
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        109⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        110⤵
        
        PID:924
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        111⤵
        Modifies registry class
        
        PID:5052
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4932
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        113⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5432
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5548
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        117⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        118⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        119⤵
        Drops file in System32 directory
        
        PID:6076
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        120⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        121⤵
        Drops file in System32 directory
        
        PID:3552
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        122⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        123⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        124⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        125⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        126⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        127⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        128⤵
        Modifies registry class
        
        PID:4496
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        129⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5944
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        131⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        132⤵
        Drops file in System32 directory
        
        PID:6028
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        133⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        134⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2528
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        135⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        136⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        137⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        138⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        139⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        140⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        141⤵
        Modifies registry class
        
        PID:6424
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        142⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        143⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        144⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        145⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        146⤵
        Drops file in System32 directory
        
        PID:6656
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        147⤵
        Drops file in System32 directory
        
        PID:6716
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        148⤵
        Modifies registry class
        
        PID:6764
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        149⤵
        Modifies registry class
        
        PID:6816
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        150⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        151⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        152⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6972
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        154⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        155⤵
        Drops file in System32 directory
        
        PID:7096
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        156⤵
        Drops file in System32 directory
        
        PID:7156
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        157⤵
        Modifies registry class
        
        PID:6168
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6328
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        159⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        160⤵
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        161⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        162⤵
        Drops file in System32 directory
        
        PID:6648
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6752
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        164⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        165⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        166⤵
        Modifies registry class
        
        PID:6956
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        167⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        168⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        169⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        170⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6332
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6336
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        173⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        174⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        175⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        176⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        177⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        178⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        179⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        180⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        181⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        182⤵
        Drops file in System32 directory
        
        PID:6548
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        183⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        184⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7104
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        186⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        187⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        188⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7048
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        190⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        191⤵
        Drops file in System32 directory
        
        PID:6844
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        192⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        193⤵
        Drops file in System32 directory
        
        PID:6300
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        194⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        195⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        196⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        197⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        198⤵
        Modifies registry class
        
        PID:7348
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        199⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        200⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        201⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        202⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        203⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7624
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        205⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7704
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        207⤵
        Modifies registry class
        
        PID:7756
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        208⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        209⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        210⤵
        Modifies registry class
        
        PID:7892
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        211⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        212⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8008
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        214⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        215⤵
        Drops file in System32 directory
        
        PID:8104
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        216⤵
        Drops file in System32 directory
        
        PID:8156
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        217⤵
        Drops file in System32 directory
        
        PID:8188
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        218⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        219⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        220⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        221⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        222⤵
        Modifies registry class
        
        PID:7400
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        223⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7488
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        224⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        225⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        226⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7548
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        228⤵
        Drops file in System32 directory
        
        PID:7496
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        229⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        230⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        231⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8044
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        233⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        234⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4568
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        236⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7336
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7412
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        239⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        240⤵
        Drops file in System32 directory
        
        PID:7660
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        241⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        242⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        243⤵
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        244⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        245⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        246⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        247⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        248⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        249⤵
        Modifies registry class
        
        PID:7696
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        250⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        251⤵
        Drops file in System32 directory
        
        PID:8052
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7212
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        253⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        254⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        255⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        256⤵
        Drops file in System32 directory
        
        PID:7640
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        257⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        258⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        259⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        260⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5376
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        262⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        263⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3944
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        265⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        266⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        267⤵
        
        PID:816
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8204
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8240
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        270⤵
        Modifies registry class
        
        PID:8276
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        271⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        272⤵
        Modifies registry class
        
        PID:8348
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        273⤵
        Modifies registry class
        
        PID:8384
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8420
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        275⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8492
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        277⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        278⤵
        Drops file in System32 directory
        
        PID:8564
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8600
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        280⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        281⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        282⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        283⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        284⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        285⤵
        Modifies registry class
        
        PID:8860
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8964
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        287⤵
        Drops file in System32 directory
        
        PID:9000
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9036
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        289⤵
        Drops file in System32 directory
        
        PID:9072
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        290⤵
        Modifies registry class
        
        PID:9108
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        291⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        292⤵
        Drops file in System32 directory
        
        PID:9180
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        293⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8248
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8308
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        296⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        297⤵
        Modifies registry class
        
        PID:8444
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        298⤵
        Modifies registry class
        
        PID:8516
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        299⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        300⤵
        Drops file in System32 directory
        
        PID:8628
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        301⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        302⤵
        Drops file in System32 directory
        
        PID:8764
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        303⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        304⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        305⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        306⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        307⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9064
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        309⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        310⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        311⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        312⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        313⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        314⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        315⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        316⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8932
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        318⤵
        Modifies registry class
        
        PID:9044
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9168
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        320⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8452
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        322⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4584
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8840
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        324⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        325⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        326⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        327⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        328⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        329⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        330⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        331⤵
        Drops file in System32 directory
        
        PID:8836
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        332⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        333⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        334⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        335⤵
        Modifies registry class
        
        PID:9308
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        336⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        337⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        338⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        339⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        340⤵
        Drops file in System32 directory
        
        PID:9488
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        341⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        342⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        343⤵
        Drops file in System32 directory
        
        PID:9596
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        344⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        345⤵
        Modifies registry class
        
        PID:9668
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        346⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9708
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        347⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9744
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        348⤵
        Drops file in System32 directory
        
        PID:9780
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        349⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        350⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        351⤵
        Drops file in System32 directory
        
        PID:9888
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        352⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        353⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        354⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        355⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        356⤵
        Modifies registry class
        
        PID:10068
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        357⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10140
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        359⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        360⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9228
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        362⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        363⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        364⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        365⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        366⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9620
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        368⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        369⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        370⤵
        Modifies registry class
        
        PID:9808
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        371⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        372⤵
        Drops file in System32 directory
        
        PID:9944
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        373⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        374⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        375⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        376⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        377⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        378⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9472
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        380⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        381⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Pmbegqjk.exe
        
        C:\Windows\system32\Pmbegqjk.exe
        382⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        383⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        384⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Qbonoghb.exe
        
        C:\Windows\system32\Qbonoghb.exe
        385⤵
        Modifies registry class
        
        PID:10168
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        386⤵
        Modifies registry class
        
        PID:9336
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        387⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        388⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        389⤵
        Modifies registry class
        
        PID:9980
        
        C:\Windows\SysWOW64\Aadghn32.exe
        
        C:\Windows\system32\Aadghn32.exe
        390⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9440
        
        C:\Windows\SysWOW64\Aiplmq32.exe
        
        C:\Windows\system32\Aiplmq32.exe
        392⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Adepji32.exe
        
        C:\Windows\system32\Adepji32.exe
        393⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9680
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        394⤵
        Modifies registry class
        
        PID:9656
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        395⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        396⤵
        Drops file in System32 directory
        
        PID:9660
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        397⤵
        Modifies registry class
        
        PID:10260
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        398⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        399⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10376
        
        C:\Windows\SysWOW64\Bmbnnn32.exe
        
        C:\Windows\system32\Bmbnnn32.exe
        401⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Bdlfjh32.exe
        
        C:\Windows\system32\Bdlfjh32.exe
        402⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        403⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Bjfogbjb.exe
        
        C:\Windows\system32\Bjfogbjb.exe
        404⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        405⤵
        Modifies registry class
        
        PID:10556
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        406⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        407⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        408⤵
        Drops file in System32 directory
        
        PID:10668
        
        C:\Windows\SysWOW64\Bbdpad32.exe
        
        C:\Windows\system32\Bbdpad32.exe
        409⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Bkkhbb32.exe
        
        C:\Windows\system32\Bkkhbb32.exe
        410⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        411⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Bdcmkgmm.exe
        
        C:\Windows\system32\Bdcmkgmm.exe
        412⤵
        Modifies registry class
        
        PID:10812
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        413⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Bagmdllg.exe
        
        C:\Windows\system32\Bagmdllg.exe
        414⤵
        Drops file in System32 directory
        
        PID:10884
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        415⤵
        Modifies registry class
        
        PID:10920
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        416⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:10992
        
        C:\Windows\SysWOW64\Cdhffg32.exe
        
        C:\Windows\system32\Cdhffg32.exe
        418⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        419⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Ckbncapd.exe
        
        C:\Windows\system32\Ckbncapd.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11100
        
        C:\Windows\SysWOW64\Cpogkhnl.exe
        
        C:\Windows\system32\Cpogkhnl.exe
        421⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Cgiohbfi.exe
        
        C:\Windows\system32\Cgiohbfi.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11172
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        423⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        424⤵
        Modifies registry class
        
        PID:11244
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        425⤵
        Drops file in System32 directory
        
        PID:10276
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        426⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        427⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        428⤵
        Modifies registry class
        
        PID:10492
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        429⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Dgpeha32.exe
        
        C:\Windows\system32\Dgpeha32.exe
        430⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        431⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        432⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        433⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10844 -s 408
        434⤵
        Program crash
        
        PID:11000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4296,i,13879737908471496610,15335851594401413307,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:8
1⤵
PID:6584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 10844 -ip 10844
1⤵
PID:10948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aajhndkb.exe

Filesize
243KB

MD5
5d74056046fd96648a574275cc9bac19

SHA1
cab1b9ca6e6eb65a830a252afb07995a2e7e3f9e

SHA256
510edbf3bab886982eb41ca41464c15eb83ee715fca3ef68e1bcf76ad3ef3fd4

SHA512
43a8cf592d2fec6f51482df41e6c4432ee54821fa0d3c57231ce8015ddf966eb6c3d9da32f3d664515af6edf91c0b4bb2a8629afbdfa0f6d207c95dc095f02c8

Download Submit
C:\Windows\SysWOW64\Acqgojmb.exe

Filesize
243KB

MD5
209b9aefa4441805d3e2bf985d16ef6c

SHA1
6307d1002e711630614516ec4b2c55e5f561b8d0

SHA256
c0883adb1ab60e96ac411883dfbb6bd4ea78d3744e9be98fa171374c34d7abf0

SHA512
8d27c531cf1057732fc4fd6a30fd2cd8c5c9593304fade470c2877e431aed7c841b8947973052c66fc71f9a288e27eedfcb64340a460c6185c0595402f223977

Download Submit
C:\Windows\SysWOW64\Aiplmq32.exe

Filesize
243KB

MD5
8566bc9227d03502c5e5d15fb07f363b

SHA1
ad46651d3cc9cdfad90cd5fe2364a69c47a100ff

SHA256
803e734f823ca94a0b0dbfa4f004a3888cc943fb3d0fa591d4bd3b82bab9f26d

SHA512
0959dcf34718aab865954193127af1187781c8a23e5fa9fd5b61d1f6b5fde0e7c43f3b99805a2ccb45d67d3d38a8ed2c8320709ea49c6f47d3d337e242a569fe

Download Submit
C:\Windows\SysWOW64\Akkffkhk.exe

Filesize
243KB

MD5
a1265c2c3004c73c63d1b547a955debe

SHA1
5d47facb6fc26508ee21c2e6ee77fb4aa1d892a0

SHA256
ac673030e3b285afb3a4d0943ffe378f9211d3db6e1dc6066d53c9d9fea949bb

SHA512
9278bd2f7f9898ca246c6d380636e6dd67b4f77439b72f3f1b3068320385234fc6a612d36ec91ee16cc577d22af08de4f87a7146c6e07f14af9dd6eda31c4c97

Download Submit
C:\Windows\SysWOW64\Amqhbe32.exe

Filesize
243KB

MD5
ba9b975e764446b7b4867261b9b14bb9

SHA1
5fc5c655016faa21574ee0af097bbae4d508ed10

SHA256
f7ae374f990d341bfd6cde3b98de3dab0f9182d4cc8a1a9f117f948c4d889ce0

SHA512
73913691d10a7b8d6f6e3f7876b8bf09d18064e1d5ad794038cc4624b29e0031bafe95948081f86253cbfce3d21ae692e1ff1ad7d14ac30277df8b5f4d7d829e

Download Submit
C:\Windows\SysWOW64\Baepolni.exe

Filesize
243KB

MD5
d664e02c26cb666a8723dddc3ced811b

SHA1
26a96bee6f4237b738668169a43b0f5bd806f02b

SHA256
93685d44d5314cd45081e57c7ac6970d74e9e02ee42a1cf6c4979428e755c9ab

SHA512
38dc56ed3b41b4ceb6c3cfa54d3a67ff534f39b19d956b6b40029541641df0488b59443fe2890e3a26c1dfd795011a1e2b9d05740ce2d98ec821af993917fa2f

Download Submit
C:\Windows\SysWOW64\Bapgdm32.exe

Filesize
243KB

MD5
31237ba16098a337695e752f9c911e3a

SHA1
101124790ab81fe504575eb3fc31cfb55f5a1453

SHA256
2f294f5145083ab94f1deeb5cb4197290cc18a673ba79dfa77aca732c33ddb0b

SHA512
801629549b701d52014848cb8f7f61f173d560023576fd87462cccf89df3e43477f6c4eda6b7cdb9df6cedd5b8134d0fbc18eceef201be9100f5fa745a9faa2d

Download Submit
C:\Windows\SysWOW64\Bgnffj32.exe

Filesize
243KB

MD5
90a0ec1c1ddf56b556ecdd8174224def

SHA1
0c4f30ce499545c95fca8fd3c8365131048c7287

SHA256
0acf1facc358630bfc74c5f4e3e550e347689857633291a12b60485b0e57b25a

SHA512
34f69dd2060b4003e44de571ce24ed07da543cabe368631ee7b383c0e0918598879566bbbb8e5e685e1bdf64e6aee489e9fc582befb75670176c36f5cf3415c7

Download Submit
C:\Windows\SysWOW64\Bkmeha32.exe

Filesize
243KB

MD5
e9122d7a09f29ac30d140ce4705db736

SHA1
f69e403ed6ffb0bfff2bf39c59f7c894f616a05e

SHA256
af36a4c3bf2649ff6d2746d72ad8d55bd21f469367201983c9d5faf37ac03c1e

SHA512
2f9d3ec3fcb175453bcc22b3e2d3bd7022ec25036ba9cdc106f1fc8fa8c7bc0307edb9dc24b09cfc45fbab4b4bb3936cde062545ccb110e6cb7550be6c803656

Download Submit
C:\Windows\SysWOW64\Bmbnnn32.exe

Filesize
243KB

MD5
4341aca546e6bab0ee118256fd10665c

SHA1
f790df7d5b667c3e8147b61af4dea5ddacabe1da

SHA256
c864751fd70faeee74e7adc7046e3ee27652825477d7d8336c2050c66dfbd5b1

SHA512
bd006256cdc68e13b6c8d422e3ec533b87fa94d0340adbfd70f66604b0c2c21c83994873d29a7a2af19f2faf2cbe5eabadfa428561c3fae29aa94aabbadb3f74

Download Submit
C:\Windows\SysWOW64\Bphgeo32.exe

Filesize
243KB

MD5
d90ca3ad5657c43e167135a076ccf03e

SHA1
a818e1bba7c9eb31b3a50ee0b1a2aebf5d7757e3

SHA256
5eb7e6c88ed766cfe742beda4fe064cc4b92d597bbeabbe6507a699273007eb3

SHA512
180e050bbdcc3b060ae9d08de6781b3c27fdd5a9f31140a275c61cf924021a0e3f3b00ae1c00e61a5f68c6b17656c7f1c7e6e76ba9245cd68690d8c0dcbc293d

Download Submit
C:\Windows\SysWOW64\Cbfgkffn.exe

Filesize
243KB

MD5
f10c00785bb8e259512b2f2e5dbd9050

SHA1
e46601e1a9f24732d898e16d3af586507c48312c

SHA256
8df8b16246fe0cc5d49115f4f46b318932887c4b0312042bfb333fdd8a982e58

SHA512
a8fecc7bf27383d947a3421d47789deb222cf179a69204133173868f9063d6438035c7045222dd40220f2cf795e9d683233770e9266b2ca4a4c8080a39c1c5f4

Download Submit
C:\Windows\SysWOW64\Cdbfab32.exe

Filesize
243KB

MD5
cf09d565ce49c8676520bc6079755f0f

SHA1
af4f17fd422f1681308cab0aa99641a9636b5897

SHA256
3f2b3028fb3568be1985d4d016c88279a1b27405194072bacba21b43614142e6

SHA512
0f2e5c6ffba7b125640bf2e7923e34a4f862e12d95757a589b32d19866a0fb9eb33f1f234d1c54dd0761cff0644d54b39eae3aeaa61ff0dffb7fbfb9747149ca

Download Submit
C:\Windows\SysWOW64\Cdimqm32.exe

Filesize
243KB

MD5
538e663d3cfa3ce6997a2730658841c7

SHA1
65fc92aa0519733998e4dba1f2e662f84e2a6e36

SHA256
133f8e11dfa9c886b09cee12a3766a8263fdd4e045fa75d1fa473d27aff85e4d

SHA512
f081ba35b442133bbaf55685d3f0f2c27c35a7ee6b0e916318eaeaff24958179ccf6f85f21576aaecafb89ceab10dd662b35868f1d9c827cec7c84ef552a2de3

Download Submit
C:\Windows\SysWOW64\Cfkmkf32.exe

Filesize
243KB

MD5
6849d2e28333360a828e4c2b67c64125

SHA1
795e94ebd660d96b766ca960f4ab68bd41a67f19

SHA256
299da359a919d564a151ee6fad75fbee6960317a20f507ae07c719dbb2cb3305

SHA512
2f3301e8892601f3a32579354f71fe2fae9128ec23c4d852c1ed80315437ea4cb5b18830b4793d328f91df40fe6af70fffef96434e20640cb2b20254055afa99

Download Submit
C:\Windows\SysWOW64\Chlflabp.exe

Filesize
243KB

MD5
a639488568580785ec1fa09f80dae6fc

SHA1
6e15955e307455e63bec549dc2fd1fe541c14124

SHA256
908fa2b2bf80071b124618234d5913df396d4df44d0e155ff25a4e8d5965b151

SHA512
578a72b4d81879e4ffa7d07dcfd3ba5fd1abe394b7b2ae05815edf32e446ddfef01524bc503f02ed170fe4a86cdcf67f25b4b2eb70a007e5ebb80774401268a3

Download Submit
C:\Windows\SysWOW64\Chnbbqpn.exe

Filesize
243KB

MD5
868e1e049d41e87a3b5c0da5cdfe40dd

SHA1
84b7c9637365e2ef3b0c16cbfde0c17113b855ef

SHA256
6c1a41f9d5f5b9ddd0f07a29fc831b1d95e9cd4a5566719d7df2ff3ac5b8a8df

SHA512
d6974d1e39896720745a6c442db2f91503958600eb58bccf7cb9d82e69df65b5adebb270687fdc60bae8d8c29037c56bdfc1c8f4be4a428f3fcda62f5148ed46

Download Submit
C:\Windows\SysWOW64\Cmedjl32.exe

Filesize
243KB

MD5
60c7884c28d976721ea93646a13e8a13

SHA1
14bf64e70ddbc447299b649854ab91acbc89093c

SHA256
196f42c3fdea9da192f52773fd17946b13fdfc7105636f1a64af6e3f9ec0bc7e

SHA512
ab55797000f83c82b81735da93becb374b6292effcaf317e5a4cd4c578c70b8d1e636cc383a8808947a33a088e53f9c20bd65d5f4e1478bbcb2a0d413153ccd5

Download Submit
C:\Windows\SysWOW64\Coadnlnb.exe

Filesize
243KB

MD5
a173bc45a6f288dbfca6ea0f7f047cac

SHA1
8499a799083bdc1a1866ca3094812d141857bdf2

SHA256
fb442b6989e0ab230d3bff35defcdf345e45b04cb1b171780765ff90e64b8b50

SHA512
38a2da2be44d27a200057e8456fe0789079ad308d3e2004e5a3490f427747f6fc3091607cceddd54575c4d3c6d6df2c38327ab7d6833c4987820f168e11247ba

Download Submit
C:\Windows\SysWOW64\Coegoe32.exe

Filesize
243KB

MD5
0cfd4be48137f30d035d12e0ac71fc28

SHA1
c268199d8f8a5cf44c7bb8d92d0122952906bae1

SHA256
824b4dced553f671e3861ff708a54b2ba63470cbb591e1190cf0d97759c1f00f

SHA512
3c87e2890f2f17c26bcd1129a7305858f00001306cb1801ca36afb2f160cf1509b95edb114f4601e76ef129dd2728ce9f6b17a45ec7a01e6ec4c17130954a13e

Download Submit
C:\Windows\SysWOW64\Cofnik32.exe

Filesize
243KB

MD5
7aa5ef3a762b95de9e2c641b21d93669

SHA1
ba59d326726fc70314b9328b7c34524100ca8acd

SHA256
b61e4e020b5735154d9c285fc059e10b6c1c7c55dcd5a4ae562aefc5989e815f

SHA512
5213c9748629b902f3d39e3df55a23d9b59ee357de21ea837e11679d413173984be1113df7e68c3933e5ce3f1cee13cb4ac5e74dcd9bb6bb4b517ab12fb1cd70

Download Submit
C:\Windows\SysWOW64\Cohkokgj.exe

Filesize
243KB

MD5
b4fd75ec983b29a7d283f09d01f04da1

SHA1
cddc5dbd8882b76476a0e8aebed4db53de4d62d6

SHA256
35d160b72a33477964124e8f3526d5c428ab87a47563037b1e0c10807d26ca9a

SHA512
4386f14c5ffa869b22014f5f0cbdaf971f39ba6ef37cf76c71ed90ac8a15e69bd0b1a339da0222ad714ca6e9a9d8a48b91b379d974e962b76dba15372e8f8ee2

Download Submit
C:\Windows\SysWOW64\Cpfmlghd.exe

Filesize
243KB

MD5
06dfd41bb24f62cb3dcd3ee7b1ab5c80

SHA1
fa404b9e91020db99949ec8a40b72b76d6388478

SHA256
dba032ea5025e660fb4342d2394be7386f1e9bf7d0d463e9ebf54118a4b5b63c

SHA512
3fbd34255179e61059699f34137da24f90880d1cb7353bf6f084081b068abaa5237b04774dd68eb71bad4b50817704139ddf627c7e5dca98a3e10b47e50ac5cc

Download Submit
C:\Windows\SysWOW64\Cpogkhnl.exe

Filesize
243KB

MD5
a669f4d6e6baa0856d80b35587404dab

SHA1
06b2b012af452e908041066213527fc7b629dd84

SHA256
ad4753c0d5bec0ddcbf9803a7ddad09225e663ee76c0f9ef393b97630e75cc23

SHA512
422570d2cb2f5ac89cab8b521b342b40b41cf239841a3ebc60fb223dda219887620d9313154606ce62ff37ba81794dccb61e9f78890b4a9d36c2a00a70786cbc

Download Submit
C:\Windows\SysWOW64\Cponen32.exe

Filesize
243KB

MD5
67043a706259f2c7da1497c76beccc97

SHA1
5916d97c5ecb849c6f56b27f4cdd349851390589

SHA256
b51c7e8d582f6136aeed7ca691df34ab59c8a51b2a29159dfa8f6a2eeb036cb9

SHA512
57e1f8a68002157a27f63f83db407347d5cde9ef1378769c0d5ad09c9e9c54deac0eadddce0bef04cf4c819dcb33c2dcd9c3804b291bdda120711554cbdeda24

Download Submit
C:\Windows\SysWOW64\Dbbffdlq.exe

Filesize
243KB

MD5
8213c2a337fbf37d25bb50e3737c3ee3

SHA1
ac4556c6b704bb5cc8f13fc76710f7f2180b3f01

SHA256
852064678deda2788e9a71df45fbf4e33bfdf753a30659269345b11629a4632d

SHA512
8fde3d34899301dd6999232d75efc67158a97cbe7a275af3fa08b85f0ce45bf92ceed91e6b0d27d74d8a723665e5cd1cd0e44fdfaadb69a0d2ad8bd69e488c29

Download Submit
C:\Windows\SysWOW64\Dbkqfe32.exe

Filesize
243KB

MD5
03f5a926b39da93da164133f71a97314

SHA1
89e466004eb2e741f8ffbeef2d915fafa9653516

SHA256
c4b2b6cea11f51dbf738c56ff8d983f58ae8ec20e94460d618cbac41a1305c14

SHA512
2b46d4a7ebf40586f14a99b280fde6981b15d641569ffb832ec944b4701173417b1c9df3422ddf3627ce013c8ed06be41ebf7383cb4d2657eef789bfc274c636

Download Submit
C:\Windows\SysWOW64\Dbpjaeoc.exe

Filesize
243KB

MD5
544e59dfdab6d3e034804c9f324223f6

SHA1
3450cb90bb9b189c92185e21939601e8138ac397

SHA256
0edf44bc61010bc8ea20bb895a020c03f8c5df2b03acba5b1d7f83dfa9f61b1c

SHA512
d11fa85ba8dd8435e32d00fe61f2f5b95a580390cee518e4c06035c82e5086202927601445ca398753f0ae80afb8a308de2a7d148f11daa9fbddceedd8c6d034

Download Submit
C:\Windows\SysWOW64\Ddjmba32.exe

Filesize
243KB

MD5
033ba1b2c086001f665e1036ff9bd5b7

SHA1
37bbc7b94c9564dc189fcd3e48e8876ad54dabd4

SHA256
d94428ae1037773ccd0db5494d7ace1ba678d200f12ad9cdeb6cccf6f716a3e7

SHA512
5a678a124916e52210593b4e2ed250e905d74d458c61f0947739307545d9a335610b25596ec9e36f7030f9c1dbd7040a4b0822ebae644837577c51dfcf6faf4b

Download Submit
C:\Windows\SysWOW64\Ddligq32.exe

Filesize
243KB

MD5
a25441fdbdfadabcfcfc39000949e131

SHA1
1bdb52475d05d5464574f6bc6a45a65e10e72ff1

SHA256
a874dabe1b7f7c0d33d708a7f73e7e4ead9162698ca88f16e83ea7da0cfb4b56

SHA512
a3cd1e48e3729abe16def6e575f477e90d85eee417e9c23d78153e9d18cdf3e426a633ec2348f2a774ca9b54de9941674417bef0f4f357cd38123378e1b87e52

Download Submit
C:\Windows\SysWOW64\Ddnfmqng.exe

Filesize
243KB

MD5
f382b094613b83cf29d2952f897dd82e

SHA1
ea6134e2719539c639c10e396d8482b9d2bb2272

SHA256
45f06ad87552c15eae49021460e4d9a4863d029fb354bb1b2de52367c955c182

SHA512
4eb3533e66177cce3fc2289d70cee18dfa897fcbd627add4c7418ac25eeb318e87936fae4b5bed92293bb9f174fc949839ec9973c7c323f868a1c5fd5739e19d

Download Submit
C:\Windows\SysWOW64\Deqcbpld.exe

Filesize
243KB

MD5
cf7ba1c1ca204d2a6ad3b043517df0a0

SHA1
963af6c62d1141acb61be231fa2d75237638fc06

SHA256
848de0408a57bcffa842815b33a6d1ba960355a30ea9a2c83dc5583a76be3e77

SHA512
46f837b4bb66c88db9670944c09526baa57a3d3cd8e2a95caeffe16f86efb761f977ee8bc9b7cc3498d98b1da28f00005ceafa08a52d39e7497e4aefe89bf8a6

Download Submit
C:\Windows\SysWOW64\Dfiildio.exe

Filesize
243KB

MD5
e29183132c5b342c1ffdc7cae38a3e42

SHA1
f6f9705b0827e07ff245ede1ea5d28f95ad428ba

SHA256
4e4ff68e47a719efe0f49435c7f20c34dbf02cc65fa47f5e5fc937b9b41a9111

SHA512
1cbe0ace36c92447dc44c626a7ef3c48603483d72405c1d7c91bbbf26286a8b277331ea3459562aa8bd32416ec6a367e395cdd019d15b1877f1d9ad7f7a31e44

Download Submit
C:\Windows\SysWOW64\Dfnbgc32.exe

Filesize
243KB

MD5
bd0c695f97e36075f09397d971ac82a5

SHA1
33e1c6935b08ed933b6f2490705450be5ed861f1

SHA256
4eeea9f8dcdfd389f526769ef1e78eac1c08e5780917986c61355889c3271c1c

SHA512
d7c9b1d2920374fdeda9b5d0eb8e9fe2b49300b301f0dac4c1674214cb3587a2ced1354f2650cec817a702c5d14ace220c63f716554980ff749d452ab08bf1bf

Download Submit
C:\Windows\SysWOW64\Dhbebj32.exe

Filesize
243KB

MD5
c4e9f3ce8bb0518d35d6f1cd533d84a7

SHA1
b184ba055720c107ec3e29ff852a95d61ec758d4

SHA256
c5ef65ab720706d8415ae94a2c46b082143d897860b8b225d81144d2d553e81f

SHA512
ef469ea567c860b12e6b9b24cd08823c6f08f51fee238327bb18e49c0987b51061efb4adc0b5f275627f5fbdf878064f91b5f8f97a314774ddb01e0e80227b8c

Download Submit
C:\Windows\SysWOW64\Dhclmp32.exe

Filesize
243KB

MD5
69e646569b80155866b4985818d66045

SHA1
a9ad7043eb2ea4a8e3580093de08b5491879c90e

SHA256
a8f98fc305be731d079afaae4e96d477146741fdc1b94511aaf567b311b7a325

SHA512
e7bb9625b3c70de69bf3ae43809aae963c95be97739280e86f3be196d33246aff6093bc57f4013e36336a705f985a0a911273856493f9be5962dd55339eea990

Download Submit
C:\Windows\SysWOW64\Dheibpje.exe

Filesize
243KB

MD5
892fba8c534830c3560503b9c570c70c

SHA1
23c30c7d96118f32e62dc44f9a1f05e3ca991e73

SHA256
93460b0ff0245dd3438c447b7ee308b659810673ebcf94bdff59a4912ae81923

SHA512
413fa86f77964678929a3aa6f7aac50ba955f30775b5389dd4808ac74c8721d79d3b015bc2fd4cc7aff65f39f67cbbeb84acdd7d067fa5d5ace5f31cd827b95b

Download Submit
C:\Windows\SysWOW64\Digehphc.exe

Filesize
243KB

MD5
c91eb65b1f4f84b4354cdda043e709f0

SHA1
25db810c8d06b94f3f341a9b3d1edfec5001319b

SHA256
73249cbcb6cc946a85c33f2dc6b7dfcf53fccbd0dddc432019809326f1ce9870

SHA512
da67eac072e4669bf3762818bd9f6091e0e1cc8b2669e700460c511df5fd9daba6895ab7e528bc6eb714f0c08100d77e81961ec817ff91a02afa78a570c3ba24

Download Submit
C:\Windows\SysWOW64\Dkceokii.exe

Filesize
243KB

MD5
212b9ad110fc4ab07b6fa531d5dbc591

SHA1
b97dc499899dfc84f490f9974c4c8e095af0be39

SHA256
029c1792bf89847485d2d67f036baf114b4df0e493c7200c5639dfe30b9c1855

SHA512
f0a0300ac1fe64530fdff72ac0712c9a6a62c0ed6d76e2177a54f0edffd28f313504fd61b397ad0bc7f286aecd521cf600deea8ab7528baa3861d9d6d3c3eb09

Download Submit
C:\Windows\SysWOW64\Dkfadkgf.exe

Filesize
243KB

MD5
e5804c578310a22067e391aa8463ef87

SHA1
0f94855d30a5cbc07c1df23c924743e3e921cceb

SHA256
fe9c5dc5fe364e875857544863bfd88be6df3df3111c3addf00f38ca8525b232

SHA512
85fd0d6c9d7bedb2453c09d00ca5aac8ded74c1b714b7768a3e3905796a3094c44908737008495ba3c90fd196575831c46fe7df7c0f116ce4b46d854be9caa85

Download Submit
C:\Windows\SysWOW64\Dmadco32.exe

Filesize
243KB

MD5
f41bb9b41003f682f4070db4d9b545cc

SHA1
16a3daed0c56c7e18ecce26b937eadcb2110426f

SHA256
49d9f8890c3eccf801878150b4ebe84eb0c3e8ce320e516b88f323ddc977285b

SHA512
64dae2274b3c53d4bd34585082963712e267222748660915a9fffa707591e8ede966dffffc76be1342a961a6e19d3f6e1b2084d6eb865954aa6b35e564c30a27

Download Submit
C:\Windows\SysWOW64\Dmcain32.exe

Filesize
243KB

MD5
d4380b983b8b609f8d74ea2702173f47

SHA1
98ccd1ac3fa36db0382c5124ebecd947ad26fb3f

SHA256
57064c9ac8172f4417eeaab2d04c8a5971b6b4576ac410a4ae567afebd284156

SHA512
f87db7431a7b13a8e666fc9d91c61cba38459f221f2b1fe5eba4267d7a5065bc0317e901304aeeeebdc363635c633c23e286ccd057b824386941941d701eae87

Download Submit
C:\Windows\SysWOW64\Dmennnni.exe

Filesize
243KB

MD5
6f27552027bb4214e1825d6ebdc9376c

SHA1
8f1a41cbec2daaec96d825bf904e04313dfe3079

SHA256
66217fbf2b34d222ffa4ee456b168191557277c52adddd112b1df894ecd650b0

SHA512
0ad8e9e242062b41a7a248b44c17774df58564811ed00127ed59700436a3bd0b5c5c4fca7134fafc8bc626e707108ec0f7356792eaef005a916931f2e1949f97

Download Submit
C:\Windows\SysWOW64\Dmohno32.exe

Filesize
243KB

MD5
06067d05087f658f62dfc41bb9d81517

SHA1
90b03213272c0b61f253763b7549f8707fc46a63

SHA256
ecd63fe3611fe5f7d7fcd3913df16462f3875f2ed0a40f9fe85f8a3d4849ef8c

SHA512
0f61b9d14b8e4c7d0467a61024443348dd7dd087a9f533d04f43da0e5ee6197af4f2e7fd3b831be7c053e661cf20cc4ce459798540e5695210eed59119c16a22

Download Submit
C:\Windows\SysWOW64\Dngjff32.exe

Filesize
243KB

MD5
9c2153dec92ec08571176d91a3e70fc6

SHA1
303ee17a66a0500a256c9881264299ab934ef83b

SHA256
45d5ca05410e62493b6beca0470b922367153a8bf635ff9778e1144a473b72e0

SHA512
e99269add8571ae87e603a3f3e1fbb442365ea46238d7f09362727c52ff8eadf5e8117fc9f53dc6617ccee60885168ab25b787af0708000a0398adce3f1b93d0

Download Submit
C:\Windows\SysWOW64\Doaneiop.exe

Filesize
243KB

MD5
ab5be7fb4462941d354e01adbef52d2a

SHA1
e5d36deea0f836a40c23c1df2cdc8cc23f5947dd

SHA256
bae28d832ec5cc9651dcdc2ad9d7919c0cd6b423a7e330b77397b76e84bf4df9

SHA512
4d39cc1c9d7f78b36b2cb9e9983a80934815ddc1d3595dff41648cae87dddfa10ce993e18ef768ff653d5a3dc29aec2ec7409e8e901d2bb3c054888d3ca98577

Download Submit
C:\Windows\SysWOW64\Dodjjimm.exe

Filesize
243KB

MD5
6500884bdb57cc4cb4244d29f8ada3be

SHA1
1004d1647f23c85ea8c29260ea0fee2eb0632711

SHA256
ad81ed73c0039293a04dcf3319d7ad31006f4f08c8a78d73f9fbb3443bb6d664

SHA512
460e2f3faaeb57d401cdaf4e3076c067f7cc10cbb4f186b655cde124bf7abae53584e723b9a250b1a6a88c31180bf0f9a6cf794bf17ad1d19724e4d0cb07a416

Download Submit
C:\Windows\SysWOW64\Dokgdkeh.exe

Filesize
243KB

MD5
ccce370c9f4ed735c228205b41fe5311

SHA1
a1af2701a9064634e1953ca99518e55d6fce52eb

SHA256
b8f66948ee01f8b1bd2b2259ae37d4b9af1ea3e855f1469332798597386e410e

SHA512
04aa0b54dac56b08d1332dc93b65981814febbbeba5177213fb70e252b69bbd360d75148c3d2c95e4d30c2fb9d04c530164c8fcb3df4d74f79a6fb6f9cf3d9f1

Download Submit
C:\Windows\SysWOW64\Domdjj32.exe

Filesize
243KB

MD5
2a0f3eed6bfdd0b5e926a48192f772be

SHA1
8a600a902d35f9b8d348b9b60199dfc8bc8e2f60

SHA256
78466d1b1e94c48f0405990c5f97b818a0f033caf997c21b52eff5aea8e0a9d9

SHA512
72d2445d804a7e44135c1e5b91afde142c9c64f8a19a98495c31eab8be1f3dfc475957325f62721a99df2f0d3613af6ecf045f829fdc586d65421ed19ae71243

Download Submit
C:\Windows\SysWOW64\Egohdegl.exe

Filesize
243KB

MD5
5bde5d1c75faf13bc8253715c889cfdd

SHA1
f017a2733a25273affddce912c3f62f34aea6b1e

SHA256
3c904a287af7341f06a2e0fd72ac311a674e4b623399c32db699fadb9cb2387d

SHA512
ab45367da73e9a2643b389a2448f7c214c2e6c0c4597771d80543b87f15d4fab759f80fb9d1fd28c670679800bc9999f8d92c574c324e23c72e70952b9c11e4e

Download Submit
C:\Windows\SysWOW64\Eiloco32.exe

Filesize
243KB

MD5
be55410b5eaed23fcab73955d6020473

SHA1
669eea1d0bdab9e5635494204c1c0d3686f74368

SHA256
4fe8b869659d50d625f038e1fcac6a257efad31fecd7e31f7f75b0f4b0076f7d

SHA512
773fc46b41ed0105d329be31fd6967ae0711c73517f93aba1a11c590de4451517fcfebf287158fc1d8b2e82ab434c5db61dde6a2768cb8fd69cd272b0455fa45

Download Submit
C:\Windows\SysWOW64\Figgdg32.exe

Filesize
243KB

MD5
f3ccbf7dd9d5f45cfd697f2ec4d7b138

SHA1
295fc34a8672d5f2e4d5660ee3b8c073a4f281c2

SHA256
49ace094494f729ef782e4dd994b27de2b4f8f2ac1ca9e5e93d3b65773404402

SHA512
094b5f41f11d1fbf0929247128f1b88ec370611ec517ff96c11cbb76dcbb13d708c77aee004a0c47f99fd17487df02fde3d8832490373cef42a7c61a7965c139

Download Submit
C:\Windows\SysWOW64\Fndpmndl.exe

Filesize
243KB

MD5
c98195ab7cfb3e96db74cd521662b254

SHA1
78fce756554f4f920be2faee0a5d028345af3984

SHA256
2fc1a4fc3548bbcce89d3a998f65cc8fc1959d6b5e9cba13868112d2182f4b3e

SHA512
e20b9d54404a03c55a7fbe3338f5769f2a8652145c44c3c828b3d5a30a13fdc703dea3ccd511947e599e61b336a283370b50bd160ea125b9c18767370686bfc3

Download Submit
C:\Windows\SysWOW64\Fniihmpf.exe

Filesize
243KB

MD5
d9f3999f8fd2e23bc4b965e556112562

SHA1
4e299b13bfaff34cad53476a94832f3508f97bce

SHA256
2e3dc0a735887e3da69109ca8bd66886bbf41ad5126a64e6484152c84e0c5dca

SHA512
095d62a1c93d0e798e291718af51bed2d263d4cc400ba859be59deb65af2c8d06c75be68e0e15cc59363440ec7977569399044ae9b4aea9776fec271a010b2b8

Download Submit
C:\Windows\SysWOW64\Gkaclqkk.exe

Filesize
243KB

MD5
a425482217af97b0fc18f846e37b69f2

SHA1
8522e5204c972d0d1357b96c07786d24b206e3ba

SHA256
9b6e52a8bb28fc91b382ec6ac441500a1c22b10c732731ed505a626fa2dc48be

SHA512
706d9816344392e8888d787ff32235e657d146476429c7620d66d52fe13a0121f148b63da4a24d05c7201c46c8aff480edd2d304b877e7654dce36829151119e

Download Submit
C:\Windows\SysWOW64\Gpdennml.exe

Filesize
243KB

MD5
cb41e401c54ab34e59df195211de27d5

SHA1
9134462ae815b070bcb80dba5f8c13a96cfafed5

SHA256
babac66815561c09a4a23e3a12865416b5a3379b843b842ee68ae0d4e9c36e74

SHA512
4903babc81c1a33f10327854581f43f2fcde336fead09a3a125d4cc39b83b20b25bcb4378842a2b655a39fe4ce3c7e8d07a6b02aec672dabeb0403801b3f3d1c

Download Submit
C:\Windows\SysWOW64\Hbldphde.exe

Filesize
243KB

MD5
7285b98ed47cd6f997b124ea47c6c5a7

SHA1
3cec83af52e5a24ff7a9c2e155f101665637ae04

SHA256
b8252e020a9ccc1756c8487331d15b7c2fd57c38d867ec40d5a08c5507e7a7db

SHA512
d7042b0cf48129d95a2f3bb1c91c3bcf60dbfd2a38ff1df8c5b831225f9ab50eb898f5533c8151c6d75f46b3988a0d126f17d6a3d74c8b7a141da92562485f79

Download Submit
C:\Windows\SysWOW64\Hioflcbj.exe

Filesize
243KB

MD5
5af2d231833e78e5529728d5c8e03b3d

SHA1
c3724556deed0119932419c115ac6c9cc1a7d0af

SHA256
08aa22030a881a574f51750520b40c89b26237653de37d6fa719dc91335d4dcf

SHA512
6c3fcdc833b78dddadb58ebcb34682630e5dbbcd8058c3416c611696b8c2ff68330dc8102c5cff7acf46d8fb71c1d10872ae9aafb982ca0b7bbef7c4bcf2e3b4

Download Submit
C:\Windows\SysWOW64\Hlnjbedi.exe

Filesize
243KB

MD5
6918511a35141a6c6d6349f534f9c22d

SHA1
88f02b83fb07717e6709b1135b940960bea91889

SHA256
e68a34262f17818c14b08a178c23a3bb162a57409dbfefb8c03a130dcea2fd84

SHA512
f30c8af06dce9fe9072d32617487c3b8225dd5753daedc4634228b067d0ea3818049d45bfa9b184b37dbd8b95f315c4d54188999ef6c0c2122e8998732de3e39

Download Submit
C:\Windows\SysWOW64\Hoobdp32.exe

Filesize
243KB

MD5
95f6ab01145650ce8b96a42d1210c836

SHA1
d29798406229a6225d87adc070bd855236da53dc

SHA256
052af4d27e07bfc542b96f8e8798d700207e46c1e192b7983abe8ee303a74ee6

SHA512
64fb2ba12ea49b6a4ff06b092feff4b00f10a0d6cab0620e8c859f8d837a82465fceb8f9b903ff0eeaeb420b2d8b7ddeca5848915dd1731a3353aa2b48ad0bb4

Download Submit
C:\Windows\SysWOW64\Iialhaad.exe

Filesize
243KB

MD5
e7891ba972bd848292bdd7f5d2d6fb6e

SHA1
d778bbc4c3bebf1fe62f072101674364d68690b2

SHA256
2f05996a194dc84e68a70de12d23784c2709bba2c458d73302e444a5a6a59e48

SHA512
401f6122b17af7fb0775091cd6e8c4c1539caf750cd29d987f7929fc8389b7c630ec53d3ab99df48808bd0030822e37111b8103787d790b16216bac5cb7a547d

Download Submit
C:\Windows\SysWOW64\Iogopi32.exe

Filesize
243KB

MD5
7b127ebfc7f5d817063e298f08601373

SHA1
de94255aebb1e8ea6e33564a7cf4ec6b0d73c9cc

SHA256
ec5138a6c686ee00c4e5b0ba0bebb8298384eed3d36be35db949d16dd8ff5187

SHA512
b3c81807497c8471102dcba62dbbfd66994ad1a8a51b9776a0dce540c241da02dabda80f6d67cdec42772e8995164b89574b2b5c215350fd6c87e36dbe81f257

Download Submit
C:\Windows\SysWOW64\Iojkeh32.exe

Filesize
243KB

MD5
c0fcd81ef0123991d68554a851492136

SHA1
cd98af4a979c5d1a765375e36c4708c524315d4d

SHA256
e82ce7fe8e546896485ef012e12de3bd092f650bea3c6548b87fb8155171e4eb

SHA512
31393f4b36854119309dcc9092f5166a5e74a81f861b0f5e97869299200e82b100541c5555ff8d29c2fdeb8c8f33d429213c3a8888e595a5eabc639558f8ccb4

Download Submit
C:\Windows\SysWOW64\Jaonbc32.exe

Filesize
243KB

MD5
1094322eb064c133ec06f2dc97afc8da

SHA1
f9e8e1e499f8dba06179285353e026f8d4e90869

SHA256
934907e7594ec4c922a2036c0dcb8a5272098733f4ee74fc336d4d856a987259

SHA512
28e337e3ddb9f6459839ad712efba8839495bceb83f4bab1a1a692583cbb1aa645cd6a2bddfa00d4c628b286283d6afc7ec7b21a18bd107b841ec8e776985d98

Download Submit
C:\Windows\SysWOW64\Jojdlfeo.exe

Filesize
243KB

MD5
639c3cb081135b3a2facc6504696f54a

SHA1
683626cf9fad68820a846a0183fa347b1b41eade

SHA256
fdd8d2c6f54c6bcb2d0553240d69c693002e9665d3b0a9b1817129f533c86fcf

SHA512
27638d4ff68fae4c8e2db5f062f86b5048ed4029ba29e8cd2e3f18ea8753ebf05e692cb0ca091e1f17ba34c564d2671a5a1294cb88191281fb22b6d19ed8d40e

Download Submit
C:\Windows\SysWOW64\Khgbqkhj.exe

Filesize
243KB

MD5
8be8cfa481c1bd321d77c52226a2d83a

SHA1
05bbb46e134533a5d9af37651335a4408786c080

SHA256
2a7f7550b15bd10211506ce26c5b2c8b6ebcbd5b4f442ebccec0701892038817

SHA512
4702a614276af71c6a650a53fcfe8436856b7b76f8671062197c524bba1495fb4d9559a35fc182f679d503302b507a4c177594e3a10950c148bee21d92ce7865

Download Submit
C:\Windows\SysWOW64\Klekfinp.exe

Filesize
243KB

MD5
45bc7762e3409b05b0f0f490b3a05e1a

SHA1
865b8174b4e765b5d24d83912179850485fdab27

SHA256
38865752648b68b92f509e1a4db654b56f56827b3b6e7f08a3f078eb94b87713

SHA512
5606e6d1da628d96d6aabd9ebe8c8c7b473c71682dbc437da0deb70b61f020c177e99b57407a0adb09387139f8e82ca63574ce630bbaf049f00e134a80fad537

Download Submit
C:\Windows\SysWOW64\Llcghg32.exe

Filesize
243KB

MD5
3bb081b7523259fc07b15444d0fb2a7f

SHA1
90783c55f0a3b77c93fb5f158f43e03abf658cb2

SHA256
88b544d141ffe0f42abd6e4b646d18ab535d3532f2d1ef12a92d6389805542be

SHA512
855eb80e30e87d8d6ed3ebbab5fc7a46af2aa450ac0ce5758c403bae44d629a776ee71a50e1350597bf0c735f625ed9e2fb263059d654a943f59aaea9636a9dc

Download Submit
C:\Windows\SysWOW64\Lmdnbn32.exe

Filesize
243KB

MD5
4fd68f7c7b3f5d0a4fadcdb051f80c64

SHA1
85c92b92d69cf4aeb952248851934f7508fc7455

SHA256
b496b3ae54b9c26ef742537d0c34cb617c165e9b6de94c996a97fd7a082bc7a5

SHA512
3c6f05b510bde102d6eaeffcdb16526833f3b8d03e2ea11fb859baea9f0a3d5217855e3d6bd9008d74256dfd6f470d45182d27cec8131a87d90a91e889d031b0

Download Submit
C:\Windows\SysWOW64\Lomjicei.exe

Filesize
243KB

MD5
18d8323922151d87f98f0d711d3c0f22

SHA1
5a9e230739f00d07607cc35a0041d15d393da7ee

SHA256
db5283ce4509da5c63f4dfc7a2ff72af8813b32841678efca34c448a289ca5a1

SHA512
8c72bf1d7202765101ee556674841c0b74c03ecb4bcd3940042eab7eaeea0154e436c3ce4794fb1041c81d09de14404078ced2cba7eef924f930749b52d6f5d9

Download Submit
C:\Windows\SysWOW64\Mjaabq32.exe

Filesize
192KB

MD5
656d9167fa2159cfa28162f3b85b874c

SHA1
74a34bbd80e08adc6dff48aaba81a8e5af9226d2

SHA256
53e0621eeafdfcee996af1e3a3cc3d14a014a8db508eefa166775631132bdf40

SHA512
0621046a0f2fda3150ed4b80f1059fcd5a9fcc5552dfd1ca6369b93ec047376dfac7e8a38ab37417dcc1274108be2cdfc8faddd7c2c597da124fbbc45f33f94e

Download Submit
C:\Windows\SysWOW64\Mjpjgj32.exe

Filesize
243KB

MD5
61ece7a8525a9c28a99e796e8895254b

SHA1
91ea6a0a949d7ace3c0edb2d8882d857fb366c61

SHA256
e5852834b609dbb31398377081ff64095101c7ba17686d450a3777674bd77746

SHA512
2be8a33e71939d64e0345b0a86c0720292b1707ff6d4e93161de79b8ac5754b23360ff3419ca253f3d4f03c4af3a62d5cff098a7378e1855d80d0e2b9e28e331

Download Submit
C:\Windows\SysWOW64\Mpapnfhg.exe

Filesize
243KB

MD5
a21ce09d30968258c3b98f44d94ab873

SHA1
9bb20be3937a3e12a127ab74a03982b9b6142418

SHA256
acd7f28b9daa633629679bc3999b515e8722f6767e9defb28e7e05c7ad17d43c

SHA512
e43f57cf787c49ec81916441f1455920e170332877c019dcce92f45c8f72f50b3e5db6ce94e744097f6b0c864246d06f0db765a3c47362d3f84f4d0ccfaf32c9

Download Submit
C:\Windows\SysWOW64\Mpeiie32.exe

Filesize
243KB

MD5
7d3b32541da816883f6c70148b728a4b

SHA1
a83f91506fb3ed1fa204ed44462a70b5db3179ab

SHA256
cac86cc3b43626c7a19c60cc6b65728fa014fc3199ded5dbb04bc0c574ff96c0

SHA512
be894de8d7f6e6b53bfbdf6e08b8749e93a946795745a4327441e66ae2e00f194d2c41b5e691a85504cac39fec5d779520bdbc7336f0c219624a1c44983218c7

Download Submit
C:\Windows\SysWOW64\Nbbeml32.exe

Filesize
243KB

MD5
732209e8de7abc1e72ba5001394449d3

SHA1
f22ef3691d65d8c5c866e076a52ff30f9fd0a69a

SHA256
6a06e13f6409df86ddf6c0b1bb22f1bf0166736a270d046bafd898caca1d639d

SHA512
f93e9d1415c1a41743521c9e335e758b9655335e1d3dfd8b51488852896d062603fc2233d3360c20dfe510c404dac75e871b5b0f2b4747f4dc98d044ace24637

Download Submit
C:\Windows\SysWOW64\Nfihbk32.exe

Filesize
243KB

MD5
2fd5c9854d9520acee30afa993dfecb1

SHA1
3eaffdc22c0ddc7000e800933ab5b4bb31f47bdb

SHA256
fd41a753bd7ad664f38e8a1f402832a65bbf657855bd65ec4a722442c43de850

SHA512
d9f2e2a45c55f8aafc1e772e813aabb3c3a4ef48df6ab584a90f8a86a6629b044b6290f0bfb6ed4c9b20b26e8d9f4cb177bdbfd67daf83ae695f68a49a19cbb1

Download Submit
C:\Windows\SysWOW64\Nmjfodne.exe

Filesize
243KB

MD5
93203e82e7af03d8ed8cb4f59cceec13

SHA1
422ac4b04101e9db47634f86d98563a17dbfc92d

SHA256
1b30fa37a9a7ae55a26b536deeaf91a9768b279c6b6c1b865c58141a2c3dcf16

SHA512
d829dd355e7ce8e0a5397a19108461b9d856824c591c827c9c6e96519c4b60021cb2acfa00c5236e1dc6c2ffadc326c1d8f23a0e53ea53876ddc3a591d6023c7

Download Submit
C:\Windows\SysWOW64\Ojemig32.exe

Filesize
243KB

MD5
a67290dd7cf788f51fc95a7aa5431743

SHA1
f12203b07a2b1f2a90c7cc713f698e90e073f9fc

SHA256
a99fad52b6985a7228ae1df0e678974c61adbdca6b86a771ced32431e9b6cd8f

SHA512
f243f87e2ff8abaaf90936d92f59c32d047afe1dcbf3ba8b1dce46b4475007ab069af1ec42b846eded26ff18d87587b46fe9166791becd1bfc088920f4921736

Download Submit
C:\Windows\SysWOW64\Omalpc32.exe

Filesize
243KB

MD5
c5dfca6f2db10b28ab57c24f18d57a72

SHA1
739cc9c1ea5e93b9b447698ba490b4eaea44e1af

SHA256
9a3f3bed88428adb6e9c3c58e908ca85d8e4a65b0c60465f0d99645958bc3b60

SHA512
908ba09273ba0abffbfffbca57b697010a8640366768e7f38c04674b6a5c0ccb6a1efb7ca6de3682e99c726e4dbb7c267901c1b59508d44cee5e9d92bcf19999

Download Submit
C:\Windows\SysWOW64\Pcbkml32.exe

Filesize
243KB

MD5
0dd78f64c1c3bb39f2d846be94b0d375

SHA1
d764dd391230e4d92e7b34f672cd5b9d651e37e9

SHA256
c563d99f55eac0f4d9b54201ce796272c1b45c437da24c41ac7128d7c6c65faf

SHA512
bde949f9303213abf83aad397e64b336a6aab76ca29e7bd814cb67ad397574cd7d1547deddf1e2ab203647bb567f10455e366ed31b26b97e8db9bbc7c9c6c80d

Download Submit
C:\Windows\SysWOW64\Pdmdnadc.exe

Filesize
243KB

MD5
8927be254395adafd494c4a1b17e1cca

SHA1
d215ddbcf41e0f9ef8eec882d61cb2699281151f

SHA256
2cfb71d72fc29d7134f537a7ad7a320646a06c99c781fbb1999331575de455d6

SHA512
956ee796f1d317ba0c3d07a8a743d981eec86b37b79f5ee34d27099e0991adfbf65452d10d35bc21ead4cc35c59c4e9e907fa9966a71750a4e20fe719f609fe8

Download Submit
C:\Windows\SysWOW64\Phfcipoo.exe

Filesize
243KB

MD5
6598f07b1daff77106f98ab628e9ad74

SHA1
e6ab33de7f7f99bf29da32df8f81e4e6d81e5a8a

SHA256
9648b22a8d003171babea73907aaf3c9d63907406a225b1e7969d806904248ee

SHA512
0fac78d0497e5040383714bc5b4b325fcf6f1aa0767507d4fe3b756633cd46d473343342572208ca8035bcd5a50103499bb3a269247ad3c09ebfeed3acdaeae5

Download Submit
C:\Windows\SysWOW64\Pjcikejg.exe

Filesize
243KB

MD5
6f668d57c1e7564d479fdc7feab6c603

SHA1
98f10dc5a62380e8c3378a59e51fc90b93911bd5

SHA256
bbf4f52983ceea862f7d863e297ae92e56fafaaf5f1fe125995293d5c811f8ba

SHA512
5af44d171315f8debdbcfe259756d3240669b6010c1d30c5cc5d20177ebaee4670cb6d69da5bea0a5a004962610e6e3376b1cd58496f0d3797ec8223f7d58457

Download Submit
C:\Windows\SysWOW64\Ppgegd32.exe

Filesize
243KB

MD5
7b16b82262264df431e2c2c5f96cf64b

SHA1
d327db891626852bb065ca23050882a0ee839029

SHA256
5eae65a53dc9421efff0ecf7b74168f4f7326ffdfdd5bb72105d541889219557

SHA512
37862ca4238858bcb65f94cefc87de006479a2ee307ae162d2a7e7bad82b7230107c8d6792d807f4a5a13d9bc2833342ac3b7b9c5a3bb22117c8ba385db6d37d

Download Submit
memory/396-132-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/924-681-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/992-594-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1260-367-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1548-347-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1732-467-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1788-360-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2020-56-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2160-365-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2184-554-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2224-129-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2268-466-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2280-363-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2308-89-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2488-359-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2528-821-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2632-3172-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2632-358-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2644-582-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2656-133-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/2732-41-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3148-348-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3228-349-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3340-3204-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3340-64-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3412-25-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3416-5-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/3416-0-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3416-857-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3460-463-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3508-869-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3508-10-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3552-748-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3616-351-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3660-366-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3668-464-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3756-33-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3776-576-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4108-465-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4168-16-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4188-361-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4204-355-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4316-588-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4320-57-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4428-356-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4432-130-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4496-782-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4688-81-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4928-131-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4932-696-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4980-364-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5016-73-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5092-362-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5128-565-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5152-737-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5156-472-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5212-679-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5276-753-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5300-478-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5308-600-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5336-480-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5356-606-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5380-481-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5388-803-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5412-487-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5432-708-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5440-612-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5448-488-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5488-623-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5536-628-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5548-719-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5552-493-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5580-636-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5632-630-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5644-495-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5728-501-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5744-725-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5744-2987-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5788-770-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5800-512-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5852-651-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5860-518-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5900-791-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5904-816-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5912-524-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5936-653-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/5956-535-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6004-536-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6028-805-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6068-542-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6076-731-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6084-669-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6108-548-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6108-3047-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6136-780-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6140-3006-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6184-828-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6224-829-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6344-850-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6388-855-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6424-858-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6440-2859-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/6924-2869-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/7616-2771-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/7704-2811-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/8852-2667-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/8860-2686-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/9484-2606-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/9844-2589-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads