f9e46be38d8d75dc6565a8a4e321c2783a73c7f3fedd078814ce86941eb5fd3a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

06be6e53613fa6ae01d58d364b7b6b50_NeikiAnalytics.exe
Size

59KB
MD5

06be6e53613fa6ae01d58d364b7b6b50
SHA1

7fb4871cdd07adfedc1c36869ff8503fddc952b1
SHA256

f9e46be38d8d75dc6565a8a4e321c2783a73c7f3fedd078814ce86941eb5fd3a
SHA512

42fc66dd419f9ee84039d7c071e74d3057433791ffa0e63677728b47c274dc9144682f13c4c482a2c12e46ab8eb5427edc8a94341bd71437bc1efc094394c271
SSDEEP

1536:2FKCyRyJd/uafKwBPCz8fkbnwwrPqEJSYNCyVso:2Up0XBfkL/riEJSXeso

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpappc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lijdhiaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chdkoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jplfcpin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chdkoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffimfqgm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jplfcpin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpqiemge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnfipekh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Elppfmoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfnphn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlopkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dccbbhld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cklaknjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cddecc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceoibflm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhbgqohi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocnjidkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alhhhcal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llcpoo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bganhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcgblncm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qkmhlekj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abpcon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocpgod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnakhkol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngdmod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdkhapfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnbbbabh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cahfmgoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dceohhja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcagkdba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llcpoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddmhja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikbnacmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Megdccmb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lenamdem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjmehkqk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anfmjhmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acocaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmbmibhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lphoelqn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Meiaib32.exe

Executes dropped EXE 64 IoCs

pid	Process
4528	Lpocjdld.exe
4664	Lgikfn32.exe
4000	Lkdggmlj.exe
1972	Liggbi32.exe
612	Laopdgcg.exe
4624	Lpappc32.exe
3592	Lcpllo32.exe
1352	Lijdhiaa.exe
4700	Lpcmec32.exe
3648	Lcbiao32.exe
1764	Lgneampk.exe
3788	Laciofpa.exe
3992	Ldaeka32.exe
2540	Lgpagm32.exe
4584	Lnjjdgee.exe
4292	Lphfpbdi.exe
2716	Lcgblncm.exe
3832	Lknjmkdo.exe
4980	Mahbje32.exe
3524	Mdfofakp.exe
3168	Mgekbljc.exe
2208	Mpmokb32.exe
2028	Mgghhlhq.exe
432	Mkbchk32.exe
1540	Mamleegg.exe
2108	Mdkhapfj.exe
4016	Mgidml32.exe
4120	Mjhqjg32.exe
4756	Mpaifalo.exe
2256	Mglack32.exe
4532	Mnfipekh.exe
2872	Mdpalp32.exe
5096	Nkjjij32.exe
2312	Njljefql.exe
4600	Ndbnboqb.exe
3988	Ngpjnkpf.exe
1156	Njogjfoj.exe
2088	Nafokcol.exe
528	Nddkgonp.exe
2456	Ngcgcjnc.exe
4024	Njacpf32.exe
1204	Nbhkac32.exe
4268	Ncihikcg.exe
5024	Nkqpjidj.exe
2068	Nnolfdcn.exe
3816	Ndidbn32.exe
968	Nggqoj32.exe
1840	Njfmke32.exe
4604	Nqpego32.exe
4332	Ncnadk32.exe
940	Okeieh32.exe
2224	Oqbamo32.exe
3224	Okhfjh32.exe
3016	Onfbfc32.exe
1844	Odpjcm32.exe
4232	Okjbpglo.exe
5072	Obdkma32.exe
4400	Odbgim32.exe
216	Ojopad32.exe
4900	Oqihnn32.exe
3320	Ocgdji32.exe
3364	Onmhgb32.exe
3700	Odgqdlnj.exe
1184	Pkaiqf32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Likjcbkc.exe	Lpcfkm32.exe
File created	C:\Windows\SysWOW64\Fpkknm32.dll	Nnlhfn32.exe
File created	C:\Windows\SysWOW64\Ndkqipob.dll	Cfmajipb.exe
File created	C:\Windows\SysWOW64\Eaacilcc.dll	Qcepkg32.exe
File created	C:\Windows\SysWOW64\Njcqqgjb.dll	Mamleegg.exe
File created	C:\Windows\SysWOW64\Fkalchij.exe	Fdgdgnbm.exe
File opened for modification	C:\Windows\SysWOW64\Fooeif32.exe	Fdialn32.exe
File created	C:\Windows\SysWOW64\Jpphah32.dll	Jcgbco32.exe
File created	C:\Windows\SysWOW64\Nepgjaeg.exe	Mlhbal32.exe
File created	C:\Windows\SysWOW64\Ccdlci32.dll	Pcbmka32.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Laciofpa.exe	Lgneampk.exe
File opened for modification	C:\Windows\SysWOW64\Gbbkaako.exe	Gododflk.exe
File created	C:\Windows\SysWOW64\Cegjejoc.dll	Dboigi32.exe
File opened for modification	C:\Windows\SysWOW64\Ippggbck.exe	Iifokh32.exe
File created	C:\Windows\SysWOW64\Jbgkimpf.dll	Docmgjhp.exe
File created	C:\Windows\SysWOW64\Facagg32.dll	Bopgjmhe.exe
File created	C:\Windows\SysWOW64\Edbklofb.exe	Ekjfcipa.exe
File created	C:\Windows\SysWOW64\Mgekbljc.exe	Mdfofakp.exe
File opened for modification	C:\Windows\SysWOW64\Eocenh32.exe	Eekaebcm.exe
File created	C:\Windows\SysWOW64\Ipknlb32.exe	Iefioj32.exe
File created	C:\Windows\SysWOW64\Mdjagjco.exe	Mlcifmbl.exe
File created	C:\Windows\SysWOW64\Cnkplejl.exe	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Ckpjfm32.exe	Clnjjpod.exe
File opened for modification	C:\Windows\SysWOW64\Pnpemb32.exe	Pkaiqf32.exe
File opened for modification	C:\Windows\SysWOW64\Chdkoa32.exe	Cajcbgml.exe
File created	C:\Windows\SysWOW64\Cmlihfed.dll	Mdjagjco.exe
File created	C:\Windows\SysWOW64\Pcijeb32.exe	Ofeilobp.exe
File opened for modification	C:\Windows\SysWOW64\Bnhjohkb.exe	Accfbokl.exe
File created	C:\Windows\SysWOW64\Oqbamo32.exe	Okeieh32.exe
File opened for modification	C:\Windows\SysWOW64\Ekjfcipa.exe	Elgfgl32.exe
File created	C:\Windows\SysWOW64\Lphoelqn.exe	Lllcen32.exe
File created	C:\Windows\SysWOW64\Kjiccacq.dll	Mgimcebb.exe
File created	C:\Windows\SysWOW64\Najmlf32.dll	Njefqo32.exe
File opened for modification	C:\Windows\SysWOW64\Ambgef32.exe	Aqkgpedc.exe
File created	C:\Windows\SysWOW64\Qeemej32.exe	Qnkdhpjn.exe
File created	C:\Windows\SysWOW64\Cagecd32.dll	Pkfblfab.exe
File created	C:\Windows\SysWOW64\Ceoibflm.exe	Cbqlfkmi.exe
File opened for modification	C:\Windows\SysWOW64\Eoaihhlp.exe	Elbmlmml.exe
File opened for modification	C:\Windows\SysWOW64\Lphfpbdi.exe	Lnjjdgee.exe
File created	C:\Windows\SysWOW64\Gdjjckag.exe	Gcimkc32.exe
File opened for modification	C:\Windows\SysWOW64\Daekdooc.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Njogjfoj.exe	Ngpjnkpf.exe
File opened for modification	C:\Windows\SysWOW64\Dhbgqohi.exe	Dedkdcie.exe
File opened for modification	C:\Windows\SysWOW64\Fdgdgnbm.exe	Fkopnh32.exe
File opened for modification	C:\Windows\SysWOW64\Mjhqjg32.exe	Mgidml32.exe
File opened for modification	C:\Windows\SysWOW64\Elbmlmml.exe	Edkdkplj.exe
File created	C:\Windows\SysWOW64\Fmfmfg32.dll	Eabbjc32.exe
File created	C:\Windows\SysWOW64\Mgbpghdn.dll	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Pghdbegp.dll	Andgoobc.exe
File created	C:\Windows\SysWOW64\Kgldjcmk.dll	Pjmehkqk.exe
File opened for modification	C:\Windows\SysWOW64\Ajdbcano.exe	Aegikj32.exe
File opened for modification	C:\Windows\SysWOW64\Bcoenmao.exe	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Hipnbb32.dll	Nqpego32.exe
File created	C:\Windows\SysWOW64\Gijlad32.dll	Megdccmb.exe
File created	C:\Windows\SysWOW64\Bmbplc32.exe	Bjddphlq.exe
File opened for modification	C:\Windows\SysWOW64\Eamhodmf.exe	Eoolbinc.exe
File created	C:\Windows\SysWOW64\Chncif32.dll	Elgfgl32.exe
File created	C:\Windows\SysWOW64\Fkffog32.exe	Fhgjblfq.exe
File opened for modification	C:\Windows\SysWOW64\Bhdbhcck.exe	Beeflhdh.exe
File opened for modification	C:\Windows\SysWOW64\Clnjjpod.exe	Cdfbibnb.exe
File created	C:\Windows\SysWOW64\Mlefklpj.exe	Mgimcebb.exe
File created	C:\Windows\SysWOW64\Obdkma32.exe	Okjbpglo.exe
File created	C:\Windows\SysWOW64\Flnakb32.dll	Eaklidoi.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9240	9004	WerFault.exe	442

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Okeieh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Danecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbpjhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfnhlp32.dll"	Jplfcpin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Docmgjhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdegandp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npmagine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odgqdlnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocnjidkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mamleegg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Addjcmqn.dll"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjmidh32.dll"	Onfbfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlokddim.dll"	Fafkecel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fakdpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncdgcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dceohhja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Icnpmp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jplfcpin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghilmi32.dll"	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkankc32.dll"	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nafokcol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkqpjidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Blpnib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbegho32.dll"	Bdolhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imdgqfbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Megdccmb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgidml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnfkma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elfana32.dll"	Abbpem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enoogcin.dll"	Hkikkeeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqpego32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbifelba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghlcnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibaabn32.dll"	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjkombfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkidenlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jplfcpin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chmeobkq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fafkecel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhclbphg.dll"	Fooeif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbaipkbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlhbal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acocaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eamhodmf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkalchij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hihbijhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Medgncoe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnjjdgee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eefhjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfaedkdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfjhkjle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhaomhld.dll"	Kpbmco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Goaojagc.dll"	Njnpppkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlkolh32.dll"	Bahmfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhciec32.dll"	Ckpjfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckedalaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daolnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddonekbl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 4528	1904	06be6e53613fa6ae01d58d364b7b6b50_NeikiAnalytics.exe	82
PID 1904 wrote to memory of 4528	1904	06be6e53613fa6ae01d58d364b7b6b50_NeikiAnalytics.exe	82
PID 1904 wrote to memory of 4528	1904	06be6e53613fa6ae01d58d364b7b6b50_NeikiAnalytics.exe	82
PID 4528 wrote to memory of 4664	4528	Lpocjdld.exe	83
PID 4528 wrote to memory of 4664	4528	Lpocjdld.exe	83
PID 4528 wrote to memory of 4664	4528	Lpocjdld.exe	83
PID 4664 wrote to memory of 4000	4664	Lgikfn32.exe	84
PID 4664 wrote to memory of 4000	4664	Lgikfn32.exe	84
PID 4664 wrote to memory of 4000	4664	Lgikfn32.exe	84
PID 4000 wrote to memory of 1972	4000	Lkdggmlj.exe	85
PID 4000 wrote to memory of 1972	4000	Lkdggmlj.exe	85
PID 4000 wrote to memory of 1972	4000	Lkdggmlj.exe	85
PID 1972 wrote to memory of 612	1972	Liggbi32.exe	86
PID 1972 wrote to memory of 612	1972	Liggbi32.exe	86
PID 1972 wrote to memory of 612	1972	Liggbi32.exe	86
PID 612 wrote to memory of 4624	612	Laopdgcg.exe	87
PID 612 wrote to memory of 4624	612	Laopdgcg.exe	87
PID 612 wrote to memory of 4624	612	Laopdgcg.exe	87
PID 4624 wrote to memory of 3592	4624	Lpappc32.exe	88
PID 4624 wrote to memory of 3592	4624	Lpappc32.exe	88
PID 4624 wrote to memory of 3592	4624	Lpappc32.exe	88
PID 3592 wrote to memory of 1352	3592	Lcpllo32.exe	89
PID 3592 wrote to memory of 1352	3592	Lcpllo32.exe	89
PID 3592 wrote to memory of 1352	3592	Lcpllo32.exe	89
PID 1352 wrote to memory of 4700	1352	Lijdhiaa.exe	90
PID 1352 wrote to memory of 4700	1352	Lijdhiaa.exe	90
PID 1352 wrote to memory of 4700	1352	Lijdhiaa.exe	90
PID 4700 wrote to memory of 3648	4700	Lpcmec32.exe	91
PID 4700 wrote to memory of 3648	4700	Lpcmec32.exe	91
PID 4700 wrote to memory of 3648	4700	Lpcmec32.exe	91
PID 3648 wrote to memory of 1764	3648	Lcbiao32.exe	92
PID 3648 wrote to memory of 1764	3648	Lcbiao32.exe	92
PID 3648 wrote to memory of 1764	3648	Lcbiao32.exe	92
PID 1764 wrote to memory of 3788	1764	Lgneampk.exe	93
PID 1764 wrote to memory of 3788	1764	Lgneampk.exe	93
PID 1764 wrote to memory of 3788	1764	Lgneampk.exe	93
PID 3788 wrote to memory of 3992	3788	Laciofpa.exe	94
PID 3788 wrote to memory of 3992	3788	Laciofpa.exe	94
PID 3788 wrote to memory of 3992	3788	Laciofpa.exe	94
PID 3992 wrote to memory of 2540	3992	Ldaeka32.exe	95
PID 3992 wrote to memory of 2540	3992	Ldaeka32.exe	95
PID 3992 wrote to memory of 2540	3992	Ldaeka32.exe	95
PID 2540 wrote to memory of 4584	2540	Lgpagm32.exe	96
PID 2540 wrote to memory of 4584	2540	Lgpagm32.exe	96
PID 2540 wrote to memory of 4584	2540	Lgpagm32.exe	96
PID 4584 wrote to memory of 4292	4584	Lnjjdgee.exe	98
PID 4584 wrote to memory of 4292	4584	Lnjjdgee.exe	98
PID 4584 wrote to memory of 4292	4584	Lnjjdgee.exe	98
PID 4292 wrote to memory of 2716	4292	Lphfpbdi.exe	99
PID 4292 wrote to memory of 2716	4292	Lphfpbdi.exe	99
PID 4292 wrote to memory of 2716	4292	Lphfpbdi.exe	99
PID 2716 wrote to memory of 3832	2716	Lcgblncm.exe	100
PID 2716 wrote to memory of 3832	2716	Lcgblncm.exe	100
PID 2716 wrote to memory of 3832	2716	Lcgblncm.exe	100
PID 3832 wrote to memory of 4980	3832	Lknjmkdo.exe	101
PID 3832 wrote to memory of 4980	3832	Lknjmkdo.exe	101
PID 3832 wrote to memory of 4980	3832	Lknjmkdo.exe	101
PID 4980 wrote to memory of 3524	4980	Mahbje32.exe	102
PID 4980 wrote to memory of 3524	4980	Mahbje32.exe	102
PID 4980 wrote to memory of 3524	4980	Mahbje32.exe	102
PID 3524 wrote to memory of 3168	3524	Mdfofakp.exe	103
PID 3524 wrote to memory of 3168	3524	Mdfofakp.exe	103
PID 3524 wrote to memory of 3168	3524	Mdfofakp.exe	103
PID 3168 wrote to memory of 2208	3168	Mgekbljc.exe	104

C:\Users\Admin\AppData\Local\Temp\06be6e53613fa6ae01d58d364b7b6b50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\06be6e53613fa6ae01d58d364b7b6b50_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\Lpocjdld.exe
  C:\Windows\system32\Lpocjdld.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\SysWOW64\Lgikfn32.exe
    C:\Windows\system32\Lgikfn32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\Windows\SysWOW64\Lkdggmlj.exe
      C:\Windows\system32\Lkdggmlj.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4000
    - - C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1972
      - C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:612
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4700
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3992
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2716
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4980
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3524
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        23⤵
        Executes dropped EXE
        
        PID:2208
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        24⤵
        Executes dropped EXE
        
        PID:2028
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        25⤵
        Executes dropped EXE
        
        PID:432
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1540
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2108
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4016
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4120
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        30⤵
        Executes dropped EXE
        
        PID:4756
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        31⤵
        Executes dropped EXE
        
        PID:2256
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        33⤵
        Executes dropped EXE
        
        PID:2872
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        35⤵
        Executes dropped EXE
        
        PID:2312
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        36⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        37⤵
        Executes dropped EXE
        
        PID:4600
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3988
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1156
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2088
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        41⤵
        Executes dropped EXE
        
        PID:528
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        42⤵
        Executes dropped EXE
        
        PID:2456
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        43⤵
        Executes dropped EXE
        
        PID:4024
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        44⤵
        Executes dropped EXE
        
        PID:1204
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        45⤵
        Executes dropped EXE
        
        PID:4268
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5024
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2068
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3816
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        49⤵
        Executes dropped EXE
        
        PID:968
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        50⤵
        Executes dropped EXE
        
        PID:1840
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4604
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        52⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:940
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        54⤵
        Executes dropped EXE
        
        PID:2224
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        55⤵
        Executes dropped EXE
        
        PID:3224
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3016
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        57⤵
        Executes dropped EXE
        
        PID:1844
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4232
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        59⤵
        Executes dropped EXE
        
        PID:5072
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        60⤵
        Executes dropped EXE
        
        PID:4400
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        61⤵
        Executes dropped EXE
        
        PID:216
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        62⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        63⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        64⤵
        Executes dropped EXE
        
        PID:3364
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3700
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        66⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1184
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        67⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        68⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        69⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3160
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        71⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        72⤵
        Drops file in System32 directory
        
        PID:3464
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        73⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        74⤵
        Modifies registry class
        
        PID:3304
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        75⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        76⤵
        Modifies registry class
        
        PID:4760
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        77⤵
        Modifies registry class
        
        PID:3968
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        78⤵
        
        PID:452
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        79⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        80⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        81⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        82⤵
        Drops file in System32 directory
        
        PID:1444
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4328
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        84⤵
        Drops file in System32 directory
        
        PID:3000
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        85⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        86⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        87⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        88⤵
        Drops file in System32 directory
        
        PID:3240
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        89⤵
        
        PID:600
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        90⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        91⤵
        
        PID:100
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        92⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1900
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        94⤵
        Drops file in System32 directory
        
        PID:3008
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3744
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        96⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        97⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4976
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        99⤵
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        100⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        101⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        102⤵
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        103⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        104⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        105⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        106⤵
        Drops file in System32 directory
        
        PID:5484
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        107⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        108⤵
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        109⤵
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        110⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        111⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        112⤵
        Drops file in System32 directory
        
        PID:5748
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        113⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        114⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        115⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        116⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        117⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        118⤵
        Modifies registry class
        
        PID:6008
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        119⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        120⤵
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        121⤵
        Drops file in System32 directory
        
        PID:6140
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5168
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        123⤵
        Modifies registry class
        
        PID:5228
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4164
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        125⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        126⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5520
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        128⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        129⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5724
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        131⤵
        Drops file in System32 directory
        
        PID:5776
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        132⤵
        Drops file in System32 directory
        
        PID:5872
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        133⤵
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        134⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        135⤵
        Drops file in System32 directory
        
        PID:6084
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5156
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        137⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        138⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        139⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        140⤵
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        141⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        142⤵
        Modifies registry class
        
        PID:5656
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5788
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        144⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        145⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        146⤵
        Drops file in System32 directory
        
        PID:6136
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        147⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        148⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        149⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        150⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        151⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        152⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        153⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        154⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        155⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5608
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        157⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        158⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        159⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        160⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        161⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        163⤵
        Drops file in System32 directory
        
        PID:5288
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6160
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        165⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        166⤵
        Drops file in System32 directory
        
        PID:6240
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        167⤵
        Modifies registry class
        
        PID:6280
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        168⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6352
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        170⤵
        Drops file in System32 directory
        
        PID:6392
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        171⤵
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        172⤵
        Drops file in System32 directory
        
        PID:6476
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        173⤵
        Drops file in System32 directory
        
        PID:6516
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        174⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        175⤵
        Drops file in System32 directory
        
        PID:6596
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        176⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        177⤵
        Drops file in System32 directory
        
        PID:6676
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        178⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        179⤵
        Drops file in System32 directory
        
        PID:6752
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        180⤵
        Drops file in System32 directory
        
        PID:6792
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        181⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        182⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        183⤵
        Modifies registry class
        
        PID:6912
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        184⤵
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        185⤵
        Drops file in System32 directory
        
        PID:6992
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        186⤵
        Drops file in System32 directory
        
        PID:7032
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        187⤵
        Modifies registry class
        
        PID:7068
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        188⤵
        Modifies registry class
        
        PID:7108
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        189⤵
        Drops file in System32 directory
        
        PID:7148
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        190⤵
        Modifies registry class
        
        PID:6176
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6236
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        192⤵
        Drops file in System32 directory
        
        PID:6308
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        193⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        194⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        195⤵
        Drops file in System32 directory
        
        PID:6504
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        196⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        197⤵
        Modifies registry class
        
        PID:6644
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        198⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2604
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        200⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        201⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        202⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        203⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        204⤵
        Drops file in System32 directory
        
        PID:6936
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        205⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        206⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        207⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        208⤵
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        209⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        210⤵
        Modifies registry class
        
        PID:6424
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6540
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        212⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        213⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        214⤵
        Drops file in System32 directory
        
        PID:4424
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        215⤵
        
        PID:3092
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        216⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        217⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7132
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        219⤵
        Drops file in System32 directory
        
        PID:6288
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        220⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        221⤵
        Modifies registry class
        
        PID:6748
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        222⤵
        Modifies registry class
        
        PID:6788
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        223⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        224⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        225⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        226⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        227⤵
        Modifies registry class
        
        PID:6880
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        228⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        229⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        230⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        232⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        233⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        234⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        235⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        236⤵
        Modifies registry class
        
        PID:7304
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        237⤵
        Modifies registry class
        
        PID:7344
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        238⤵
        Modifies registry class
        
        PID:7388
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        239⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        240⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        241⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        242⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        243⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        244⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        245⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        246⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        247⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        248⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7832
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        250⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7912
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7948
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7988
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        254⤵
        Drops file in System32 directory
        
        PID:8028
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        255⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        256⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        257⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        258⤵
        Drops file in System32 directory
        
        PID:8188
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7216
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        260⤵
        Modifies registry class
        
        PID:7292
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7368
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7436
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        263⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7588
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        265⤵
        Drops file in System32 directory
        
        PID:7628
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        266⤵
        Drops file in System32 directory
        
        PID:7700
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        267⤵
        Drops file in System32 directory
        
        PID:7768
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        268⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        269⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        270⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        271⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8040
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        272⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        273⤵
        Modifies registry class
        
        PID:8176
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        274⤵
        Modifies registry class
        
        PID:6204
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        275⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        276⤵
        Drops file in System32 directory
        
        PID:7460
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7568
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        278⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        279⤵
        Modifies registry class
        
        PID:7816
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        280⤵
        Drops file in System32 directory
        
        PID:7920
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8016
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        282⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        283⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7416
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        285⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        286⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8004
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        288⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        289⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        290⤵
        Drops file in System32 directory
        
        PID:7740
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        291⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        292⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7940
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7608
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        295⤵
        Modifies registry class
        
        PID:7288
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        296⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        297⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        298⤵
        Drops file in System32 directory
        
        PID:8260
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        299⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8344
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        301⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        302⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        303⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        304⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        305⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8588
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        307⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        308⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        309⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8752
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8792
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        312⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        313⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8908
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8948
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8988
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        317⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9064
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        319⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        320⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        321⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        322⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        323⤵
        Drops file in System32 directory
        
        PID:8280
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        324⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        325⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8460
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        327⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        328⤵
        Drops file in System32 directory
        
        PID:8600
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8680
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        330⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        331⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        332⤵
        Modifies registry class
        
        PID:8848
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        333⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        334⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        335⤵
        Modifies registry class
        
        PID:9080
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9140
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        337⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8248
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        339⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        340⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8572
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        342⤵
        Modifies registry class
        
        PID:8720
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8828
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        344⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        345⤵
        Modifies registry class
        
        PID:9060
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        346⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8284
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        348⤵
        Modifies registry class
        
        PID:8452
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        349⤵
        Drops file in System32 directory
        
        PID:8668
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8876
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        351⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        352⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        353⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8444
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        354⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        355⤵
        Modifies registry class
        
        PID:8644
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        356⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        357⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9004 -s 396
        358⤵
        Program crash
        
        PID:9240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 9004 -ip 9004
1⤵
PID:8972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abpcon32.exe

Filesize
59KB

MD5
20d4caf86cbe7ebd88a3e198c4102be1

SHA1
281fce17577d759158f3477cc1e233811a9cef04

SHA256
880978f02932a571391b25a1893063e76d2591c9b1d43396c3841a4be6c5e7aa

SHA512
b7e463ac11978e8159348d37c4417f3a18b85150f91f0311059175e60da7e8b97c0beb676471072b363418e774d800a50e77fa70ec4b4575e2d182891aa1aa00

Download Submit
C:\Windows\SysWOW64\Accfbokl.exe

Filesize
59KB

MD5
085514d84bd78fe40795811225432231

SHA1
62cf26ada9940dd263c364c4804941c7476f913e

SHA256
436ab49ef4f721d263be4415c71cd666bb7031a22897576b1219f9f4121c9a71

SHA512
71c4609dfa7a4834c068c922180ee51b7e383e03c6fd967ad5c68df61f8e7604204ec220a7ae52204a8e3684131682d1a3d0c1fc979a100c48ad6052d393d112

Download Submit
C:\Windows\SysWOW64\Ambgef32.exe

Filesize
59KB

MD5
84373c3d8eefece55c0edc727d0afbfc

SHA1
6f0c0cd96d0dba7a9efafbec90bdcaac242e0ee1

SHA256
9b8363abd5dbb81e4fc173bbe65e6be9954f3992091d81fdc6889f0f0835a246

SHA512
62d149c47fbac7d7bb39e047fe9ca51c22f770a74ac501786fd41dfefdfeccbf30fff1112be65d6f6e5747f508eea856913d7a8b63b4b9ccf9b92fab60821eec

Download Submit
C:\Windows\SysWOW64\Bbgipldd.exe

Filesize
59KB

MD5
828c58546a7e317cc84b94c3e422061e

SHA1
55b9459862b277e8b015b458cf478a49cb391bf2

SHA256
fc61bdd89d31ac690514171e4086adb261d8f3fef1e8abbb9d8abaaf31093d77

SHA512
7650e567e42d4741a0915e2b8b9c38c45ebba57875fde7c2b29bf673c04de70e92a8b862b3de76c7d1916920b5bed9276d5415bc53689d5bdac3499571a8ba77

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
59KB

MD5
79ae61ca7f41b129422f00ca33e0c9db

SHA1
7518a30e308367144e39cac79439c8b6c98b4905

SHA256
13d10babc4fc5c03b39c9c171f4a0cc2916b1e5d62d9a6e550c6996097272ec2

SHA512
81baa727bd6371a057798751a164c1f5d830c921537ff3b09610b2eff788277383b8dcbb5fda8bc3bc6cc94143bab971c854a0aff11670384af13ecb343751bb

Download Submit
C:\Windows\SysWOW64\Bganhm32.exe

Filesize
59KB

MD5
17ed736f888c2445e1b70a83b5d60fdf

SHA1
e4589c518c130b11ef25db01bf14cde470fe6bbe

SHA256
c4ecc9d23d1ef819277cccfff085fbf421464aceedc4351a77ac310b370b9023

SHA512
641c40f4d2976485323b1f5ca8e068eeb017651d1fe9a5b9ca4d812c4607089dad41196bdb389d57566f7da70fe0e6e2d45267bfb0e3d6df0d1108a400383e5a

Download Submit
C:\Windows\SysWOW64\Blpnib32.exe

Filesize
59KB

MD5
25da5cf75d44891d25a27ecb2751a989

SHA1
7ad33c664f335ea8503212a87e30a94e01cd42b0

SHA256
8bbfc641be45653e271f72c44aac5b1719c393c1e0788cf2b1065391bdf235df

SHA512
9f08e990c5bf9040ecac1864175effd3c116c132c82af0cf94a43878248daf7e66887e7dc5476a4f27736cc3a79546be41765517b90c88f83eaac96505e1afb1

Download Submit
C:\Windows\SysWOW64\Cabfga32.exe

Filesize
59KB

MD5
58efd7aea9152f96503c140bce0f0ebb

SHA1
539ed8e25581ce0a496c0051cfb0b00f6e1d938d

SHA256
c78e3418715fe8b29931babe54349dc203ddc75da10db3cef2b3c892161c77fd

SHA512
2700f4ed6d76999c40368105dd553d7eec9b37057d05f56f51ff24aeefdccc87c6fb8d797c35bc90c107d2a9f664aaf28478c961a87bfc96cfdf97006f22a3c5

Download Submit
C:\Windows\SysWOW64\Cbqlfkmi.exe

Filesize
59KB

MD5
a061a1c1a562b469f05c8bcd945648dc

SHA1
138630ffddc2f8cf269e9e56400eb7dddbeb895c

SHA256
124065908db891eb863b2c1400891d88445d979b9d9fa057aefc31189e9d4b59

SHA512
2b19255df94bf4391061bf9da2346e1788e05c43ab3b6797719b729f785c50d9e1ec5d53fa2076656e7352679ed0989204f618b9eaedf2c0f3ebb4421a7b8245

Download Submit
C:\Windows\SysWOW64\Ceckcp32.exe

Filesize
59KB

MD5
a6cea0f29b6e9dc3e4e4592493fe0a47

SHA1
df316bcf5ca3230c09d7a689e9f8bfb48e95530e

SHA256
cbfef982707ef0a602f4e7c642b31ffd78e473cb780352f714620d57bc1f596e

SHA512
ccc835eee15c4fe03031f0ea1a57e84165c267d3acd58d839c50c91091538c6fafe86f0a928e08de21df1849704bd3054099a517a216b8174b4b12df21ba98b0

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
59KB

MD5
6043f296e7d275b0bd842c1f83f4cb23

SHA1
74efaf4eb94c3e54399cd22c10d50e20491b8158

SHA256
c3420f746564b8015db49034c1a1538601254a8ef58b3e7c314d2227cb3f5898

SHA512
01c4ad039b22ab385d6b5e2ede5574b6231a22529465c661b81c29ac103f2f85e46d750a2667d2ab9c954ce321b63c7832b3a267d81c5da3849686843899a304

Download Submit
C:\Windows\SysWOW64\Chghdqbf.exe

Filesize
59KB

MD5
260f0d5ffb8338728e68359ac1dcd7aa

SHA1
bcee5b48be9a71e9308e4a7751afe1ed98d9879d

SHA256
c0e366b2e505e977312eec1a6fba2e8f495b4fe93c832f4fde96f390fe53a800

SHA512
8b19e4a550c3d98fc84e08ff0984b7062b41537fb74151cb2035a5453b710e37aaf6faf641b36ad9d26a484d9d72097ea15c66c4331748cb3f984305085c9f2e

Download Submit
C:\Windows\SysWOW64\Cjkjpgfi.exe

Filesize
59KB

MD5
2e0543568548ac409ae8af180dbc9f53

SHA1
e05d156e8f74814c4286fef1c99d1f5547693733

SHA256
56aa2f00223f8ba57f0b3e79bebf91abdecdc8df07e1f7a143cc6497d669bd4d

SHA512
4760588be3dd5140289ba0b25f57f5f3fc4694fb483614fd5ae9d84877a00a6c62b939eff06c4c1dddddccc56f0fe7c04c90d5322983863cd04688040cf784db

Download Submit
C:\Windows\SysWOW64\Daekdooc.exe

Filesize
59KB

MD5
afbc991b507eb96a334c0dd88553df31

SHA1
a49e30c0f81779594b1f403292816e369bab48c9

SHA256
5cbc96d223ac4d70fd9d3cf06920b118b2fa9b26cbc13cfaf792f051c3e16016

SHA512
c61ae3302f65d1b6dc0e61e4d178e2889c356ad63ba6f3b2d0279b4ff388230648807f8ab07e3f037f5b07de16e0aa30cc3cda4a426f4372809594b92f758da6

Download Submit
C:\Windows\SysWOW64\Ddmhja32.exe

Filesize
59KB

MD5
9b5535256cf85fc11681da4c59cee53f

SHA1
370d30b6f34ab5f6864a8a3ec0f53ea007858e2f

SHA256
d9da0de20cc8a74592085e7e0c4c4a89bc43839e2cc525eca3f9e73287e5708d

SHA512
b2dffd7cfbcdf77e94d6ca8abd2fb04efaa4442d374797cf9742bf0cf0a8e0b6d448388fac47411339e87c305dc9280a813a0727eeb117e158cb8f99040ed0a0

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
59KB

MD5
9516cc4c62b6ccfdc1872609d406621f

SHA1
0834ec71feb0cb1746ef0edd996b041585ecaabd

SHA256
1796f6251b45d6ac5393b93d05a73fac565cae7937791d7488249f40793970d5

SHA512
8143dfb8f6ebacb557959f89786de296fc138c1bac32b46ff6a35706d438791286c6c3f98b7f4e83446fe6283587dd67f5a481fd62022c0b7c98e65be8812b98

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
59KB

MD5
ec14088c42765d15ee1f2e14b118a4fc

SHA1
7beebce061cc51737bbd3da03997a915b978e781

SHA256
a31e60b41724bfd3f1295ccd0f8ed1480bb35cd4f321219983b3f5b19d294caa

SHA512
026417f6c5630ba6ae1dc0c15e2ad85d2dc441b6aee9de4de3063975db4fb80f0466cc9733afedb5aee3f3af60467d1bfeb2b7f4603847fd24c5d714784ac09b

Download Submit
C:\Windows\SysWOW64\Fdgdgnbm.exe

Filesize
59KB

MD5
5a86aeb79bf38fe777a09ac37c72a6af

SHA1
da06c1292da51a674fb0a51fa47bdb2c3b47b622

SHA256
4f194dea2f7ded9042f330459ac1c50a6963a0b071e24a60054f4aa282e82ed4

SHA512
baf6f2ca7dce5abadaff9434daff7e624dbac0e010a8cab3d8f2d49783b9081dee106fdeb3a27d96436f958c877070480a4dfc53d4da348c319852281e74517c

Download Submit
C:\Windows\SysWOW64\Ffimfqgm.exe

Filesize
59KB

MD5
fe8c2db31cb9957ff3a9810fc3f85834

SHA1
bc3b2c07e151f799ea8eb917dd9743de772a0278

SHA256
d68b8281b69ff094d588a3b9d1105b00e0d14c23e8b09004c9509f3f21e4c6fa

SHA512
43152bf968b93a9270c9f75ce6f08ec69d3fd929b783c84801c1ff85320224cb205e64733194d8e489e7c42d0805fad7405431382230c249d604109dcbc66f04

Download Submit
C:\Windows\SysWOW64\Hbpgbo32.exe

Filesize
59KB

MD5
50cee3e35e2402fec0d3e5651c6c44f0

SHA1
b2fec9700e1bd40ff54b762c9c874f3bfb844aa0

SHA256
4aee15575fff3a92499947a7f40ead933dca5370acfb3d88ed1392e54f36b257

SHA512
0e8245463d2f92aeb55e462a94b4a864a0fab725b16d196d39c1b9e754efb12cdb9e00732e78f3eafba2e782cee90f5042f1afae29cf944f9a3f300db55fda8f

Download Submit
C:\Windows\SysWOW64\Hfnphn32.exe

Filesize
59KB

MD5
5dac809007736447c136a4910f6fc6bc

SHA1
d9db4fd19a9976392fbfeb8be9d27561bd54cb7e

SHA256
897f61e4884b389c8cd63ecb3f85230fbf505eb13300d32aa9b88cb521873613

SHA512
792779626b47285dc38182d676077c95f1e59922c45874d9667d43974bb89979d6d01c8d2acf82baa86976fa9df251c4ad2c685884a2abc98877f3078df06a4f

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
59KB

MD5
e8540a75034648fdea6a845f9d669a28

SHA1
000beba16e167facbf20b8f01c17b8e7b618cbda

SHA256
ac0b1fb1b1f807ad51454c57f2765728609bb61d88c772344a6a37113f37d381

SHA512
28a73c668a63710df48fb769c3b11962271bdc294f975e8e4b87b2c215939dd78bcc4c46f368cf2d0471bb2b6e86b31a7d65ee2332b019bd14de7baa56773ad7

Download Submit
C:\Windows\SysWOW64\Icplcpgo.exe

Filesize
59KB

MD5
37f36fff94492a31f684171b76aad2ca

SHA1
90eaa889c8f317d97e1d1ea666cd20eaaaaec84c

SHA256
130d385d711a08c308d25a1f0cd6cb4d29bc478be60daa44d2b8c2f30b3f6585

SHA512
27e740cf9d9e13ed28d65dcfe51259ba79b82f5449700de04225a75bfe8d4f4427e706d5a889b296562b002577224d6b331783c17f59c7284b6435ad5ae58486

Download Submit
C:\Windows\SysWOW64\Iefioj32.exe

Filesize
59KB

MD5
831b199afacfa70c88c0f428c742e299

SHA1
39868e4d2917c5c5c05fefa58711f286202f4679

SHA256
7426242826c7c7a3c3f07a86cf831172d13d87bc9d4e23f37248e833521ba715

SHA512
3e7c6fc4e16f1450fae67deb266c3b7e743852489297512197014237d46edf11842b4dc4ae140083bafe370189c6e64518d91c97ffbe49114c2aa4452d369bb4

Download Submit
C:\Windows\SysWOW64\Ippggbck.exe

Filesize
59KB

MD5
92f76550d1b9fc06706fb81788180309

SHA1
678edd66170b7aca0cfeb0272c6917dfb993916b

SHA256
896e1a3897c4240058d492cb29682042f0eb90b19fa9dea32d258ef607745009

SHA512
58a045f9386fd1b1102a00ed6e9c70defaee2b9e6a1c525919acbeefc990a9c6afc5250fe40f3c4ba1e0f1c77286ed986a1eccabd2972ed369f58ef1956d129e

Download Submit
C:\Windows\SysWOW64\Jcioiood.exe

Filesize
59KB

MD5
119a8b213c24f0dc7dd4e1ff6ace7e4c

SHA1
19e5bf7f996fd15f31d3d187caddafec698c23fc

SHA256
f0ae9b73730d92bee45558ba61048c6c367cd7cc4e7b3702daaa5f8e7aaf030c

SHA512
588ecd7b35ff49d8f769acfc08f6631fcbd375543bdcb4a0f642dbda77272f3915cd268ec4e8361848f20ce5f2c0dc0012bf807313d2152de54e5ab8464ce178

Download Submit
C:\Windows\SysWOW64\Jioaqfcc.exe

Filesize
59KB

MD5
bdc0f861d76dba21d5390d899de75f27

SHA1
b2f00cd571384f67d19a27078d2ac3dc3f8367bf

SHA256
3b5b36088e9f27ba9a931aeff165a24bf2865182ae7f4a826c1ac1fda5e2c58a

SHA512
f71542a96156f9c1948e3abb4a83e858bc7b2a09e2a9b206e0a004b92484deeae8962be877ee156b97ebcc2069657ae94951b7dc2a9e9d5fe86bc7a59ed0ab75

Download Submit
C:\Windows\SysWOW64\Jpgmha32.exe

Filesize
59KB

MD5
46f9f2abef7f6975a8cb2655c6083c44

SHA1
b1a5f207d9fbc3cf18be0a5fed83642043329efa

SHA256
52d239cae90c0eeff55239c19b86b91255f7f7100ebbb2022233a85052b07590

SHA512
3ff7af7f0ecbd48c82ab5416dd8a5f2ae243821928568faddef97d50e9092181f6330f50eda50919ee5bf179f31a8b8315c57b73646678c73bf1713690573e5d

Download Submit
C:\Windows\SysWOW64\Laciofpa.exe

Filesize
59KB

MD5
af2939094df670aec9a305a82f6ed53a

SHA1
2444bb44c716a9f1695b54f9113790bc7ecc785f

SHA256
4618dc306bec6c11d362325595e2a05354f76f571e9880863533d737849c1f2a

SHA512
297ca00cabdb920498aa3e80e33ed9549a5a0867b5914915c0e9c21bd06439545168bc41064000b5206043b9d4dd46c85e2b2a844d9a5e5665e88e61ddf445b0

Download Submit
C:\Windows\SysWOW64\Laopdgcg.exe

Filesize
59KB

MD5
dbb85ec355387553b9983ff2f283d2fa

SHA1
61f107dc390664119f008ac1edf27e4138e41fff

SHA256
04f2445731c6647d4e271f4e77406777dafe81e1f2c65eace1af0770b2074bbc

SHA512
fc02c2c79d9bf4d299f36812052de1f18bd3e0d2e1f9d3f29e34d787f85728b0952e355ab82baa1fbc1f0e4addb951d961e0cda28099e01e6627bd257893b77b

Download Submit
C:\Windows\SysWOW64\Lcbiao32.exe

Filesize
59KB

MD5
03184bee4805652f9b759a7d21204b26

SHA1
85489133edbf301444d6b95d7801e6c7e40c7cc1

SHA256
6a924e914815b6f92b9e99356ffff98f6fe7a25fe01c05870f4bd1d214f92b67

SHA512
a9299b35fcb7590ba42583c0daa6eb5f6a73bc1cc9c9ff784a776df72919b3048712412f764fdfc1a75c6b33de2742e18b47d2bf2e4ca2e4577d407ead5e6116

Download Submit
C:\Windows\SysWOW64\Lcgblncm.exe

Filesize
59KB

MD5
daf33fcbc00585e890c5b397cf67b95e

SHA1
e553aababfb38a9c88e845c896dd8969751ecfa7

SHA256
941dded64a79ea678a0a6381d6b964efaca6ea4cd659b4dee974793320e4b4ce

SHA512
5149870b7bf6d517fbbd084781ebe76eed4beed1de833f5b0340105729f45d3207733dba072aafd141e54666f5360dffc6f95cf99cc38cbe37358d35e996349d

Download Submit
C:\Windows\SysWOW64\Lcpllo32.exe

Filesize
59KB

MD5
b45360ab7e03d69111f9766881e04604

SHA1
43f8fe09dec54828d39bad7e1d734fca0e7d0b27

SHA256
8f6a4be09f4ae1284d350ce361c715c92a8dc5fc381e65c6f45f10276969b02c

SHA512
2608d4bb41a0fccb0cfac94c33759748031859f9fdfa02a4c065f8e9386e027497715e5511b13a46d5d1617ed499b79784caff855f8bf63b7305e7e1fa18c7a9

Download Submit
C:\Windows\SysWOW64\Ldaeka32.exe

Filesize
59KB

MD5
2241544ceb65232fb4a2085d09edd36c

SHA1
5367c4d43cac2766b9e55af3fc28cd1261786705

SHA256
4ff24e203b1b7e8ce05424fa1782a5c21fa04fd6de26855c9a8eb193532dc7af

SHA512
645ac116d81881b5e2409bd07d499ad1b2167156c9b57d8d4dd34ef1dcb95ae3cccfbe1aee15f79c971d31170607bd2f3aa27acecf773babbe399ed23d8a6bff

Download Submit
C:\Windows\SysWOW64\Lgikfn32.exe

Filesize
59KB

MD5
ef2c05b38bd60715b265edacf741112d

SHA1
c35225ef9600c5b24da94313fa6b1dacc00db8fc

SHA256
251561f206aaf846248ce8617e40dd0492b417274868fcff931f7829356711b2

SHA512
0574fd17968616e7b339e282b11fd3d24aae7103364cbe0ebbaa744a78a8a202a4b3837c3a3077e86a2fd89476e8a2c7122c88fd1366809a822466cb4e2975e9

Download Submit
C:\Windows\SysWOW64\Lgneampk.exe

Filesize
59KB

MD5
1525197913d503113c4b14fe64ca0414

SHA1
b9941c9358621892514f0c715cad9640289f3c6c

SHA256
e69f7f9b316eda04ade6f0dd6240e1f6b81511a9dae4d6a7f18bcab70fcb323b

SHA512
aee8ddbbae213cddb866568a21060a23f6b07b9be8aa07b60474dd58029fb5441a1681bfbeb3a478d0301f934e3c87aebc71ae8a77b1406ad30d97114732804f

Download Submit
C:\Windows\SysWOW64\Lgpagm32.exe

Filesize
59KB

MD5
a557c72181885c301ad1f5e4a161027b

SHA1
d2501375063b6d3534a88982822ed32ca55a9dfe

SHA256
f693afa56e2cae1bd5857a6c308fd452c0ba735c54cd6e8a3b03067e80561072

SHA512
0dcb89d0322dff5b098fa5a4f04a2b4e4943270cae108e7697787d35d93b51b4e99b524aa78f35afa0e2a80c7b00df8abdce7338d9276dbc495958a12a4f6309

Download Submit
C:\Windows\SysWOW64\Liggbi32.exe

Filesize
59KB

MD5
1dc648294b5dc562eadd60629f4752f9

SHA1
631d3586d0f7178025ec7988651596645027948e

SHA256
326b7395e27549c47a25ef6518092c258c23b4c2fc6939acf17ae192d2d051b4

SHA512
fa0670ffa6fe2fcc7a24cb1da3d7e98d5f931de3b46df5d79da0f354e6df6460839beaa5037e535e8f5b6bdc3367e9021c47655456798da5d7f8a5a68bcb901d

Download Submit
C:\Windows\SysWOW64\Lijdhiaa.exe

Filesize
59KB

MD5
a99f5b5477e65267421dc773e85438ac

SHA1
cdb68ab5d1e39dd38d86a9d3f278c1c9f6ff6775

SHA256
5a5248069f0c24b13859ce9074828e64f6d17ded0260ba67f3cfb3621fe6f0a3

SHA512
21a49f9e5904867838b35056ec714750ebd67d6fe0d5ccb7987a1d58e069f02a084fcb0cc12cd3441c920c542c2890409884f70612ecfc13ca46c868402e5a27

Download Submit
C:\Windows\SysWOW64\Lkdggmlj.exe

Filesize
59KB

MD5
fa0bce7c2b15ae11c0427db47582b9fd

SHA1
709aa19de1b023a3963f91bbd5ac1808eee96fa6

SHA256
622cb392cdc67fc926e8bb3d7f95769ed8b58a54b579d9c834363751df419257

SHA512
51db6a0ab6506ccc33173bb741339037c1f91b27a79d5c028a956e51daf4b030a9c208e8600a3814504d178151ffc37e151339e91aca36af1f6bed174dd01acf

Download Submit
C:\Windows\SysWOW64\Lknjmkdo.exe

Filesize
59KB

MD5
8a03da4c8093253cb10eb7fb343292d1

SHA1
6e222c0a1b8b551df0a8b247019af6e775329feb

SHA256
120978a3b05b07b1accfcf7099c9edc8f34eec5661332121bf9e0fe4148189b0

SHA512
ad581211e10eb009cd192cf3e70962b036d5b1791079703dbcb93a4b93814aac7f8108d9c15ec8bde98bf23747abd3789087cb0a9d3e0a910afde43efbb1faef

Download Submit
C:\Windows\SysWOW64\Lnjjdgee.exe

Filesize
59KB

MD5
775f8abe903e1b3fafefc777cdef4de6

SHA1
a01a99f28878a9b496d33d7ae7495e66883de344

SHA256
6038c3d6943967948cdca728edce1db73fdec5eabeec55dfff8f914810251a90

SHA512
8a29671e544378a8a42f7ef70ff14e8fc316ae59ab366e11b6beda692300b7fa8b192bec25a7d4d35d67ebd0ce7f256a52a53e2ad38d4895e49a5a765218f666

Download Submit
C:\Windows\SysWOW64\Lpappc32.exe

Filesize
59KB

MD5
066774fc01118e9e70f8cfe1c3697460

SHA1
73da3e8a710ae657c205933233d9b5e02cdab1c5

SHA256
7118b46b0ee4294d72aa4bb9179e65115c33a90ce8757424ef0ce3ab36eb9b11

SHA512
756cf31a501daee09223e429b74a28c0a60ce69bd5a6dbc89f46cb2e2078b56973cab9e9652f86c388bbe7e4f1f27e358380643613b96b8d42c26f9f4f1373d3

Download Submit
C:\Windows\SysWOW64\Lpcmec32.exe

Filesize
59KB

MD5
b0d79495556171aeea71c3e5f17aa034

SHA1
305470dc96fb3e0cada559b20b6432834b5e4506

SHA256
a3fb82104b26f6ec0846f6149773e0d8bdb519b4116d060b71ca6cda164924e8

SHA512
1b3580e0af8048aafc3e1505ad195575b1ee96d15fc2c1a0695ef16907fe5dc48247dad2a70ea2de2195fc822054089403f8c3b66825016084ff6d6f2385db34

Download Submit
C:\Windows\SysWOW64\Lphfpbdi.exe

Filesize
59KB

MD5
428107727cd8b12d22fdd009d2e2deec

SHA1
2d210e284621244753a5cb64e3a3dc74cac866d2

SHA256
f9d32a137135b50ef0029ce1c12f74034eeb1c3ad028130ad683674dcd0f5dbe

SHA512
20d98da405bd5a3a9af5ca4038928e5065d780d023f8f4af4f0ddda19a02e8d267fcf068dd0adfb53c21ae36170c6c8cd8b39d166b100d260ed57d6cd41f62b1

Download Submit
C:\Windows\SysWOW64\Lphoelqn.exe

Filesize
59KB

MD5
0689296ff99909b1f3b119bab138b7b2

SHA1
ddcb5119040129e5b779b034df27ac228da3d2be

SHA256
8981e8eb6191687b7502c5ce5ab4e0f5ca50152dd4376128b598a5589c528d8d

SHA512
df3e5325b213ee524c19e03ea6cd8e9b09a3d006b89b379517ad2aaa564a36ba464ba636c19f6b14e858e6e841873c8f997e37f60a3b5b2cf77a5704f162f5bb

Download Submit
C:\Windows\SysWOW64\Lpocjdld.exe

Filesize
59KB

MD5
60944f13778dd198913dbd6e53813ab4

SHA1
abbd0f69cd8f4f021f3990c9bf21fe37a2808cde

SHA256
25db779638f4833e25fae2a1ca9c90e29362de3bc9d6479d573491c2e8fc2624

SHA512
0fa7c6cebc18b1fc87b33286a3b7c9a8c7a37b5e0ca16354ce9f099e31ba66306c996ae8b5cbf8750e7db7bf42acbd4dee03fce831260f925ebc9678fec24a0a

Download Submit
C:\Windows\SysWOW64\Mahbje32.exe

Filesize
59KB

MD5
4f88c07cf1050bf99ee64506db66aaeb

SHA1
252597831911412531a8b4531fb766ac4ce39101

SHA256
0008e996b9361cea419b2569307c4e068a98778013af37f89c8df9256987dda6

SHA512
f3e4b7ff6ccf8d9b774b85f75e498f86c6d6a0df77b081986c0d126ef0e289f7c1195962514e37291bc10f613b04837bed9746cd02ae2a13a8d56c837c81a438

Download Submit
C:\Windows\SysWOW64\Mamleegg.exe

Filesize
59KB

MD5
a68d2970aeb7ee6016a56f9e392ba21b

SHA1
aab538403141ff5d625dbc7d4126d3c2b68e1c28

SHA256
e9f29c77ceeaf39af5b1288aa45ed73898a5551da29b58f9f255e1e7a3e79875

SHA512
d20baf1f2c95a3d39b813dd37b1b7763f8cd9c19aeeee9475175068a6ab98d330bfde4861af57291e6781be156fe26e847b4abc433529ea1b6f551e4a45b655b

Download Submit
C:\Windows\SysWOW64\Mdfofakp.exe

Filesize
59KB

MD5
137fa498820093b43a51d23ce7e82c29

SHA1
24ecefa2fa5b0fc6da0edfa1a739475ef610a8c6

SHA256
ddcebbc25060ae6c25a7438c94703ea37e6c36f23c079004b25f5a5268f57b3d

SHA512
718b814a445411655101a3d031bba3f5c29cd1b15a0adab2d8e528e5c4d249b0fbf56466b77d7440b2a45f5f9260f87ca9e843d4d19f99570c6b00b46afcb378

Download Submit
C:\Windows\SysWOW64\Mdkhapfj.exe

Filesize
59KB

MD5
26396f0d40ca1262bf3526cde0d5ecaf

SHA1
c19bcd08efeb77df6a6a7d8b80a5bccc0cba1f40

SHA256
270840024a1d48f12fd953ad667c0e5daf8fc9d8e5a8580e7302cd135f13082b

SHA512
b9897cc401d6b2c5b38b02288687894d12d5bb8d1edde149d4466014fed73c34169f413005d1d1ba8b58dfc48422884daa546e185ca4e320cfa8991d7104bee6

Download Submit
C:\Windows\SysWOW64\Mdpalp32.exe

Filesize
59KB

MD5
8752d4f6bb6c952455501dc43b402fe5

SHA1
000bbad76c45088c5856652795d688d610e9113f

SHA256
8489aa7b395b52a476c0467687ea90e84ec422d2d7744ceada310c35f6c9c87e

SHA512
5c08bca096a76229a508c50993cca368a33898d7250a3e4e10ae6e9aa0fb9ad2fcd3f1b3144654715980742c0f56b0eba8a55cac2a95c4eb5eba33a820ef4629

Download Submit
C:\Windows\SysWOW64\Meiaib32.exe

Filesize
59KB

MD5
5f9db45fab854958e9fc7cabf4873bba

SHA1
ede52c0df033ac614bb14dc21aeb6761b58cccb7

SHA256
fda698c81fc0dbc438be4fcfb9dad5976f000ad33f8ecfbf21139925c223c1b7

SHA512
bda5275dd7b136e580774d194b04773247d7b4cd8c5bb3ba368a48e60041f707a6a9e7134e1ce5a01376e5c3ff7340cb94031f93180c67d393375113887ee79f

Download Submit
C:\Windows\SysWOW64\Mgekbljc.exe

Filesize
59KB

MD5
bead6de1d7c701c8a86d83a82f785ef3

SHA1
c40ac9301b1c38b189a9a711f36509c266ba516e

SHA256
78c1265b5a1ca7c48febe96eff11d7ec1902f7dfdbd8104fadc30ef000ce7f3d

SHA512
f75557484410fd4cdd3281d68cc8297f2c70e4e4d739df2d030ea0066beed7844ba2c1e3d65e555faed11a7d97ba2d14cc9a9137f7a580a2eb02c7a5ce2b0c17

Download Submit
C:\Windows\SysWOW64\Mgghhlhq.exe

Filesize
59KB

MD5
ec7f9e74e63d57438a4957dada68e448

SHA1
576b415441ce3bfcb51a1c746c3cea7ce5cb9fc8

SHA256
8b27bd96fd380a3bfb174ad4ed12e80bc9d48c9f0b53b80367d205d7a9fb8df0

SHA512
26515fc573181af2d856e1cb3b96e61bfd081c32c6893991d24f03c052d8c66ba200070c70e0ef8b2c3e64e36ba3be65ee7532a2bd30bfc1e55df0ae88619993

Download Submit
C:\Windows\SysWOW64\Mgidml32.exe

Filesize
59KB

MD5
076b31b56117d3d86feda46c14b3236c

SHA1
f767d79260c5887dbaa651b5978cb0fcb8e5908f

SHA256
54ce6032537aa6f5eb3f7e8923005499761217788ee5c0427d8a24f518577e29

SHA512
59c6807eaff98851f6ab5663d0a8407c4283b5ec50e6e363c5eb7a24f23b2d95e7b458829320377fff42ac491ddc35d9458f73881aa7e61f9d5a3d1933a0e9aa

Download Submit
C:\Windows\SysWOW64\Mglack32.exe

Filesize
59KB

MD5
badd508dac06f2dca9e40e3aab88264f

SHA1
67ca361dc54174256244a291030114dc5693603e

SHA256
f1e21a2474d12344cf3b2179fb153debe440f3125dc9d460e6c4fbe6c2cbee23

SHA512
4e8e76ebf7f3c8443b3f1e87d8322c32386704d0bfac23f4120b010719d78581f02891747104606ade7c7e74c0f49e236ee8c65637e6ce2a789e950e7c547da4

Download Submit
C:\Windows\SysWOW64\Mjhqjg32.exe

Filesize
59KB

MD5
a797fdac2249059f515bc101d1464f59

SHA1
c47d9e9a90833aafed2a8e9cef71b5478cccc397

SHA256
0be6399a618572dbeea3b716a90af84a1af27be85ed73394764b43abe47fd7e3

SHA512
a0060b34489b909ec021b6287866ce957f856620edbdd590d3eb723453f8f8021dd077be66bb62e83f52c191590912421b2c30c40077a20b7846ec3315d1514a

Download Submit
C:\Windows\SysWOW64\Mkbchk32.exe

Filesize
59KB

MD5
b52284b5493a444e218a1612e5339480

SHA1
7e946cdbc25ff82abea4bf5f2a483f834a8e10a1

SHA256
1b3c61192e2e5c42738b9f0c98662df416cb905238b200d801f49f25d988a699

SHA512
890e24f233c4bd6bd88b7ebffa95b0fcd17492a2ef0562789abd6431269368146590d10fcaff6bd122ebfea114347d88fd4fe6b529521eccf35d13c73234323e

Download Submit
C:\Windows\SysWOW64\Mnfipekh.exe

Filesize
59KB

MD5
2ee7b6cf7f8a28b83bceeabb17be86c4

SHA1
aec5f21adb8b9fd595c66ebfa08becefa207a419

SHA256
51e2349aec2d375ec0d9411d2b11f64fdafdbf2a01928b5fefd1472e5084ecd3

SHA512
dd4c499d86dda755b2e035b886202dae683dd4c521abefe57ad2732af0d1781ba978be6204a57253d0615d70134be4275ba4807a6e3d1b68d68dac76846ad53b

Download Submit
C:\Windows\SysWOW64\Mpaifalo.exe

Filesize
59KB

MD5
0954d40c388e0354c84536a5ff3d6bfb

SHA1
258650225b9cda3efe06ec0de84f4ff3ee48a578

SHA256
5d75fab0c4faa78d4abd6e1fcfa9de8e3d317dab5d5925ba6557b9526253c731

SHA512
3b7f0caed8f17a3a01f1c1cede2dfc50e5cc50b4456c926cfa5e198ae72c8f8b161120067b6bffe0124e64cd98f4e379c19ec6bcf73aa1607c20c01c1df72823

Download Submit
C:\Windows\SysWOW64\Mpmokb32.exe

Filesize
59KB

MD5
3bc3b273739fe7fd4f20c3f4508b67a7

SHA1
864d79047cea00bf5972c556babea204f64cdd0a

SHA256
e3ced662a3ca7edbb79af6b41ad2e0c9994dd5fdb0244fca397abc181135ddbe

SHA512
2408e20e713f92a726b824100a85d111f0f84473580c5c26f1ef8b3d82c57dd63d507471ef157b893beb5e94c573cffec8329f194ef63e6f18c50d6778ba1504

Download Submit
C:\Windows\SysWOW64\Nbhkac32.exe

Filesize
59KB

MD5
5e63de94d7b9b58b4f1aeda9d8b6b4c6

SHA1
7442796438a32cebb30e504f9fd65ee4fe1decba

SHA256
465e26c6ac7734159361f1e3d072e293204ba4cae46b324f2e9ac3f6f1e999db

SHA512
78b53df31498e96f8abb84d1628f492a475cbe622e5c81b82bc3fe1bd186182be6c5545d639093f1f586bcb06f7c360202b8a82734a35f95f67b41e754966910

Download Submit
C:\Windows\SysWOW64\Ndcdmikd.exe

Filesize
59KB

MD5
9022e037c26e7dc3fcb277c17126dccb

SHA1
978729c7b82bd995e7821a48b480605ac9cea3d7

SHA256
cc8d4272514fb14c24ee5bd0559c17241c5a060166fac892866d5b1c9e9fa5b1

SHA512
3a2746f69a2caaea346e6d4af3302869a3501818dd0e601f984ea360ad2f8f3cf813b09a891edd33989714ce9984719051ffcc1afb7955da2dd5b3fce9ed19a0

Download Submit
C:\Windows\SysWOW64\Ngcgcjnc.exe

Filesize
59KB

MD5
c2979f857c3d139d1a4e19c9b66fd0d3

SHA1
8c8e87bbe66a7005136c021fdb47f62e84883bb5

SHA256
436e4ad772015ff37b8f8f0d092220e661003af30bf3ff050bac5cb04e274c50

SHA512
884bbee2b1747a7f4871714a3108985978cf1e0b0b33cb3e98699b4500b114ee3be77d0eecd1fabaa2d2ff60af074ab109f04ff5509306b6c6af16cb67876ac9

Download Submit
C:\Windows\SysWOW64\Ngdmod32.exe

Filesize
59KB

MD5
6c099e00c6ccdec63c04157edc75d27b

SHA1
0bc7217daa2dac469d6758e1c024a7acf0eacd97

SHA256
763fc2847d35e1bd31356989ba245ba518435513dc404bd9b070a5b366744f5b

SHA512
798c06e824b7c77a6a7b17d20bc1acd548c2b07c4330b1bd74495cae2e0516832d08dbeee70fbff533473dc48066cdbdd75d7a1093ffc076604d8341903fecb4

Download Submit
C:\Windows\SysWOW64\Njefqo32.exe

Filesize
59KB

MD5
378ea956c113f66b2244f048920fabf2

SHA1
3614a61a3fcc8412794033d41ec47c4a7e69f3c1

SHA256
5295925e170005523d53e5f49d00862f0b1464f6613fa79c145c0aece1c60818

SHA512
8355126a4dcae39ae2b210935003313c0182dcb4c66ce787e6198be52644db8cd68ef12ea1a0d424c9e355d78ced8899de729e2770ef39bd769f681ce96e3c21

Download Submit
C:\Windows\SysWOW64\Obdkma32.exe

Filesize
59KB

MD5
76a669465f5c4af17013b97ddbe04275

SHA1
6fbbea9469ae392370745a5e92edfcac733a94e0

SHA256
e14b43bf5d850c3ee9d8e86a7b147b3e332ac4bf00995db80b0b8f448236dc34

SHA512
724627f4562ef60bdccb3fa07963ea49f1f489a3738a31e5ddf0c9ebf01de61d8294ec31deae747c79f65746237ec11ab1710e6402994b4b7ba03d5338ddbd74

Download Submit
C:\Windows\SysWOW64\Ojopad32.exe

Filesize
59KB

MD5
1d00ebb802c5d0c0755b72222e50573d

SHA1
563b813acf87372ab512068df7a23175543eaf9f

SHA256
266c61598919fe117c953be5546a0d84352b88334ae46ae0b69bca681728ac45

SHA512
fee6467a3160473e8c849c6efb915f86cbd74d2ce56c0f17c4e7dbd5bcdf93e6efe2158500bc62eb27f5e9faa486f8c8fd9e82b0550149e103ba5c2b484b5ffb

Download Submit
C:\Windows\SysWOW64\Onfbfc32.exe

Filesize
59KB

MD5
353d60e7c004844db1e0bf16516bf0da

SHA1
4c1634ee8070fd32245fbd8637ecdeae4122687c

SHA256
8c3acd65c0d8a011fdbce3047a87bb416f8e39b490996025ebf058661cc912d5

SHA512
45a430e93afbf033f3f65f9163d1bb8db3c9e5b31e4a11f0912aa61ccd27729cbfedf0d1a7a929d3bd3e640642708f9f00071e2c44763096a2cc7ef84bd940e2

Download Submit
C:\Windows\SysWOW64\Opdghh32.exe

Filesize
59KB

MD5
94604b263c99dfd85360128dee702ed2

SHA1
3d20fd06d3a3415ebe4d4eabf024aa4484e7ca21

SHA256
2f7455eb07acfbd77317e99bfa3ce1d059a7b3a96dc2716daa4732cd37bae160

SHA512
ac3745f0969c023693bd6ac525d2bbf8b9ee1e2fa41e9a831fefd9dd5a5d978edcbfc88093ccdcfac26dc9e54c2bbd945890ef525f90cd662c52ee38c6c06677

Download Submit
C:\Windows\SysWOW64\Pcijeb32.exe

Filesize
59KB

MD5
3cc2e7a78f66e53fc71fe237b993f5fe

SHA1
7516079d407847cc03c691dcb6798a0cd8cd7fcb

SHA256
b288e5b16a768bdf1f904a230dbce9b76653547a78f4a0833534a51c96133022

SHA512
675fb1aae5ee952a2186d5011571464979ee62686c99eded0ed73a50780d4cad68aac343ede4ee046bdb45b79745d150b1400d93e8b8a309bdd600cac7c2860a

Download Submit
C:\Windows\SysWOW64\Pjmehkqk.exe

Filesize
59KB

MD5
51c3da1457369e3d3a831febc834f6aa

SHA1
2e334bcbc1530c0f7a1c75ae5cb800276003e428

SHA256
2018d17866db79325818b955d925c8fdade1161264952bb6a4b50e7914dd05c9

SHA512
d6921c8dde8c65f4fe63e18aef24d92da7f424ca943a52cd23d5c9204eb926c878ddd0336fb9ae36483f88afd8da239e3105504e6b7c221d034f312ce7e40d20

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
59KB

MD5
0c2f124b05f931141d041b196ba425c1

SHA1
ccf073c98c683a5510ab400c1ff90402fe32f1ab

SHA256
255671aed084e6ae6723fa35e587603706dec0058a943df3102e5b3cf6597faa

SHA512
a79cae3304daa09b90658e960700670167886288db896199716dab7c42b8b166bdde50ad5602d6e8c1cd43737be983811f8f7add48258253bcb1ffc4e7b2fd3f

Download Submit
C:\Windows\SysWOW64\Qgcbgo32.exe

Filesize
59KB

MD5
988002d3239b8ade2662534c72a328e5

SHA1
247058d79593a66b604699b271b2d3a15fd233aa

SHA256
28014059758cfa9b7d95d0ca163177363257c293a7c8f1f622c9cccee4954e01

SHA512
2761c47bd65de67f2e5aaddfe6b91c1b8efa2b76acc01cc3e0652604973cd16451c638d9e827042e4c86789728219c35643de87f5e83918b0c16de91f0bd339a

Download Submit
memory/100-601-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/216-415-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/452-516-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/528-295-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/612-566-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/940-367-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/968-347-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1076-457-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1156-283-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1184-445-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1204-313-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1304-571-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1336-574-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1352-591-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1352-62-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1540-197-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1632-467-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1764-607-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1764-87-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1840-349-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1844-391-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1900-614-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1904-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1904-534-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1972-559-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1972-36-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2028-186-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2068-331-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2088-294-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2108-205-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2208-173-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2224-373-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2256-237-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2312-264-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2456-301-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2540-114-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2552-498-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2716-134-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2872-252-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3016-385-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3160-474-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3168-165-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3224-379-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3240-581-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3320-427-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3364-433-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3464-486-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3524-158-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3592-55-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3592-580-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3648-83-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3648-600-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3684-475-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3700-439-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3788-95-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3788-613-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3816-337-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3832-142-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3968-515-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3988-277-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3992-103-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4000-28-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4000-557-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4016-213-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4024-311-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4048-594-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4108-560-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4120-220-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4132-487-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4232-397-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4268-319-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4328-547-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4332-361-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4364-265-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4384-527-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4400-409-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4528-8-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4528-540-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4532-244-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4584-118-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4600-271-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4604-355-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4624-51-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4624-573-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4664-19-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4664-546-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4700-593-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4700-71-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4744-451-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4756-231-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4760-504-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4900-421-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4980-150-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/5024-325-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/5072-403-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/5080-528-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads