b10befc4b729c314cc9d0ae2a2c7589c95ff0f5c8eaf6d28b553bf07b5cb3732

Analysis

max time kernel
140s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da47f0f7a932a08b90f79accb353da70_NeikiAnalytics.exe
Size

128KB
MD5

da47f0f7a932a08b90f79accb353da70
SHA1

8c83d385d18f342db54ce82004959cd5f512ee25
SHA256

b10befc4b729c314cc9d0ae2a2c7589c95ff0f5c8eaf6d28b553bf07b5cb3732
SHA512

4c47483dec94bf6e868a43f02f61e512aef96ddf56f94461d166137ba3a4d219410d6b6948e8b07e05ee1e903906fba78b7a585614ef7bc8e60a7b9079ed9cbc
SSDEEP

3072:WoJOj7PLrQwXaL9k8YmwPxMeEvPOdgujv6NLPfFFrKP9:Qj7TrQwG5YmwJML3OdgawrFZKP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqmhbpba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obdkma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qalnjkgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahkobekf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edpnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ghopckpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkmefd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iefioj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nebdoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nloiakho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngdmod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogpmjb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoahijl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjkombfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjbndobo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhnnep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbmelbid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chbnia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lekehdgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Onhhamgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qkmhlekj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Colffknh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chdkoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkljak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dceohhja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aepefb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilghlc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdjagjco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjffbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gkmlofol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lffhfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aelcfilb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Elgfgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fchddejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fbpnkama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alabgd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ednaqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hfqlnm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcbihpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpijnqkp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njefqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pncgmkmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qajadlja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nepgjaeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aanjpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hkfoeega.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmncnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	da47f0f7a932a08b90f79accb353da70_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kimnbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlcifmbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjcbbmif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bebblb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcojkhap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pagdol32.exe

Executes dropped EXE 64 IoCs

pid	Process
1728	Ngcgcjnc.exe
2184	Nnmopdep.exe
4524	Nqklmpdd.exe
3564	Ncihikcg.exe
4692	Nqmhbpba.exe
3916	Nbmelbid.exe
1960	Okeieh32.exe
3560	Oboaabga.exe
2540	Ogljjiei.exe
3308	Obangb32.exe
632	Ogogoi32.exe
4916	Obdkma32.exe
4844	Okloegjl.exe
2972	Ogcpjhoq.exe
3208	Oqkdcn32.exe
640	Pbkamqmd.exe
3392	Pghieg32.exe
3384	Pjffbc32.exe
4676	Pqpnombl.exe
4420	Pcojkhap.exe
1608	Pndohaqe.exe
3540	Pjkombfj.exe
5104	Pbbgnpgl.exe
4784	Pcccfh32.exe
2400	Pkjlge32.exe
4980	Pnihcq32.exe
2528	Pagdol32.exe
692	Qcepkg32.exe
3832	Qkmhlekj.exe
4300	Qjpiha32.exe
3892	Qbgqio32.exe
2920	Qajadlja.exe
4664	Qchmagie.exe
2948	Qloebdig.exe
1704	Qnnanphk.exe
1144	Qalnjkgo.exe
3284	Alabgd32.exe
3820	Aanjpk32.exe
3620	Aldomc32.exe
2000	Anbkio32.exe
1208	Aaqgek32.exe
1164	Aelcfilb.exe
952	Ahkobekf.exe
2392	Alfkbc32.exe
2256	Andgoobc.exe
3964	Aacckjaf.exe
2692	Aniajnnn.exe
1280	Bhaebcen.exe
844	Bajjli32.exe
2368	Bdhfhe32.exe
4440	Bjbndobo.exe
3212	Bbifelba.exe
4504	Bopgjmhe.exe
1324	Bldgdago.exe
5012	Bbnpqk32.exe
1200	Bemlmgnp.exe
1620	Blfdia32.exe
3656	Cbqlfkmi.exe
4460	Ceoibflm.exe
464	Cklaknjd.exe
5048	Ceaehfjj.exe
2120	Cojjqlpk.exe
2424	Chbnia32.exe
2820	Colffknh.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fgfkkboc.dll	Eepjpb32.exe
File opened for modification	C:\Windows\SysWOW64\Flnlhk32.exe	Faihkbci.exe
File opened for modification	C:\Windows\SysWOW64\Fdnjgmle.exe	Fbpnkama.exe
File opened for modification	C:\Windows\SysWOW64\Nnmopdep.exe	Ngcgcjnc.exe
File opened for modification	C:\Windows\SysWOW64\Bopgjmhe.exe	Bbifelba.exe
File opened for modification	C:\Windows\SysWOW64\Kibgmdcn.exe	Kfckahdj.exe
File created	C:\Windows\SysWOW64\Pqmjog32.exe	Pmannhhj.exe
File created	C:\Windows\SysWOW64\Pkmlea32.dll	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Eckgieoo.dll	Dhpjkojk.exe
File opened for modification	C:\Windows\SysWOW64\Ednaqo32.exe	Eapedd32.exe
File opened for modification	C:\Windows\SysWOW64\Helfik32.exe	Hmabdibj.exe
File created	C:\Windows\SysWOW64\Cihmlb32.dll	Nphhmj32.exe
File opened for modification	C:\Windows\SysWOW64\Onhhamgg.exe	Ofqpqo32.exe
File opened for modification	C:\Windows\SysWOW64\Qnhahj32.exe	Pgnilpah.exe
File created	C:\Windows\SysWOW64\Qjoankoi.exe	Qgqeappe.exe
File created	C:\Windows\SysWOW64\Pcbdco32.dll	Cojjqlpk.exe
File created	C:\Windows\SysWOW64\Eifnachf.dll	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Mnbcedcn.dll	Ilghlc32.exe
File created	C:\Windows\SysWOW64\Oneklm32.exe	Ofnckp32.exe
File created	C:\Windows\SysWOW64\Ladjgikj.dll	Ofnckp32.exe
File created	C:\Windows\SysWOW64\Oqkdcn32.exe	Ogcpjhoq.exe
File created	C:\Windows\SysWOW64\Eocenh32.exe	Eleiam32.exe
File opened for modification	C:\Windows\SysWOW64\Glebhjlg.exe	Fdnjgmle.exe
File opened for modification	C:\Windows\SysWOW64\Kpgfooop.exe	Kimnbd32.exe
File created	C:\Windows\SysWOW64\Acjclpcf.exe	Aqkgpedc.exe
File created	C:\Windows\SysWOW64\Gfogkano.dll	Ogljjiei.exe
File opened for modification	C:\Windows\SysWOW64\Gdhmnlcj.exe	Gbiaapdf.exe
File created	C:\Windows\SysWOW64\Eleiam32.exe	Ednaqo32.exe
File created	C:\Windows\SysWOW64\Mgagbf32.exe	Lllcen32.exe
File opened for modification	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cjkjpgfi.exe
File opened for modification	C:\Windows\SysWOW64\Gokdeeec.exe	Ghaliknf.exe
File opened for modification	C:\Windows\SysWOW64\Pjkombfj.exe	Pndohaqe.exe
File created	C:\Windows\SysWOW64\Iddoeojd.dll	Dhbgqohi.exe
File created	C:\Windows\SysWOW64\Gcagkdba.exe	Gkkojgao.exe
File created	C:\Windows\SysWOW64\Bhbopgfn.dll	Nloiakho.exe
File opened for modification	C:\Windows\SysWOW64\Njciko32.exe	Ngdmod32.exe
File opened for modification	C:\Windows\SysWOW64\Pcojkhap.exe	Pqpnombl.exe
File created	C:\Windows\SysWOW64\Fcjkaiib.dll	Andgoobc.exe
File created	C:\Windows\SysWOW64\Ckedalaj.exe	Ckcgkldl.exe
File created	C:\Windows\SysWOW64\Ednaqo32.exe	Eapedd32.exe
File created	C:\Windows\SysWOW64\Fafkecel.exe	Fohoigfh.exe
File created	C:\Windows\SysWOW64\Ghlcnk32.exe	Gfngap32.exe
File opened for modification	C:\Windows\SysWOW64\Kboljk32.exe	Jmbdbd32.exe
File created	C:\Windows\SysWOW64\Fpdaoioe.dll	Dkifae32.exe
File created	C:\Windows\SysWOW64\Ngcgcjnc.exe	da47f0f7a932a08b90f79accb353da70_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Pkjlge32.exe	Pcccfh32.exe
File created	C:\Windows\SysWOW64\Dnqmalhn.dll	Daolnf32.exe
File created	C:\Windows\SysWOW64\Booogccm.dll	Ocpgod32.exe
File opened for modification	C:\Windows\SysWOW64\Oneklm32.exe	Ofnckp32.exe
File created	C:\Windows\SysWOW64\Kfgeem32.dll	Pghieg32.exe
File created	C:\Windows\SysWOW64\Jcpfco32.dll	Ckedalaj.exe
File created	C:\Windows\SysWOW64\Elbmlmml.exe	Edkdkplj.exe
File opened for modification	C:\Windows\SysWOW64\Fafkecel.exe	Fohoigfh.exe
File created	C:\Windows\SysWOW64\Jfoiokfb.exe	Ipdqba32.exe
File created	C:\Windows\SysWOW64\Jiopcppf.dll	Jcbihpel.exe
File created	C:\Windows\SysWOW64\Oendmdab.dll	Jmbdbd32.exe
File created	C:\Windows\SysWOW64\Djkahqga.dll	Kikame32.exe
File opened for modification	C:\Windows\SysWOW64\Blfdia32.exe	Bemlmgnp.exe
File created	C:\Windows\SysWOW64\Njefqo32.exe	Nggjdc32.exe
File opened for modification	C:\Windows\SysWOW64\Pfolbmje.exe	Pgllfp32.exe
File created	C:\Windows\SysWOW64\Qddfkd32.exe	Qmmnjfnl.exe
File created	C:\Windows\SysWOW64\Ceckcp32.exe	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Ijfjal32.dll	Mgagbf32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8868	8320	WerFault.exe	404

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akalojih.dll"	Colffknh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejckel32.dll"	Jedeph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pgefeajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kpjcdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lmppcbjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pbkamqmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjmcmj32.dll"	Pqpnombl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pbbgnpgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hfqlnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeheh32.dll"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qnnanphk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fhemmlhc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gcddpdpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgokmgjm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	da47f0f7a932a08b90f79accb353da70_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nggdeh32.dll"	Aanjpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhhbcf32.dll"	Fbpnkama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hkfoeega.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iqjpdi32.dll"	Pndohaqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlmbpgdl.dll"	Ednaqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enoogcin.dll"	Hcpclbfa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Flceckoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hkmefd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chempj32.dll"	Qgqeappe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bchomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ecjhcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jehokgge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ocpgod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bbnpqk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ojgbfocc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdmpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jffldcca.dll"	Dkljak32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gbiaapdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gdhmnlcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nabqkgan.dll"	Ifllil32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Obdkma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbcbgk32.dll"	Ecjhcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngknngal.dll"	Glebhjlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhondp32.dll"	Gkmlofol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mlhbal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Olkhmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ingbah32.dll"	Lingibiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhbopgfn.dll"	Nloiakho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Olfobjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omocan32.dll"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Elgfgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fhemmlhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bagplp32.dll"	Jpnchp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiopcppf.dll"	Jcbihpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmoahijl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Calhnpgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Anbkio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ckcgkldl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Edpnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Imfdff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jedeph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lingibiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aepefb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkfcej32.dll"	Lgokmgjm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncbknfed.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 1728	224	da47f0f7a932a08b90f79accb353da70_NeikiAnalytics.exe	83
PID 224 wrote to memory of 1728	224	da47f0f7a932a08b90f79accb353da70_NeikiAnalytics.exe	83
PID 224 wrote to memory of 1728	224	da47f0f7a932a08b90f79accb353da70_NeikiAnalytics.exe	83
PID 1728 wrote to memory of 2184	1728	Ngcgcjnc.exe	84
PID 1728 wrote to memory of 2184	1728	Ngcgcjnc.exe	84
PID 1728 wrote to memory of 2184	1728	Ngcgcjnc.exe	84
PID 2184 wrote to memory of 4524	2184	Nnmopdep.exe	85
PID 2184 wrote to memory of 4524	2184	Nnmopdep.exe	85
PID 2184 wrote to memory of 4524	2184	Nnmopdep.exe	85
PID 4524 wrote to memory of 3564	4524	Nqklmpdd.exe	86
PID 4524 wrote to memory of 3564	4524	Nqklmpdd.exe	86
PID 4524 wrote to memory of 3564	4524	Nqklmpdd.exe	86
PID 3564 wrote to memory of 4692	3564	Ncihikcg.exe	87
PID 3564 wrote to memory of 4692	3564	Ncihikcg.exe	87
PID 3564 wrote to memory of 4692	3564	Ncihikcg.exe	87
PID 4692 wrote to memory of 3916	4692	Nqmhbpba.exe	88
PID 4692 wrote to memory of 3916	4692	Nqmhbpba.exe	88
PID 4692 wrote to memory of 3916	4692	Nqmhbpba.exe	88
PID 3916 wrote to memory of 1960	3916	Nbmelbid.exe	89
PID 3916 wrote to memory of 1960	3916	Nbmelbid.exe	89
PID 3916 wrote to memory of 1960	3916	Nbmelbid.exe	89
PID 1960 wrote to memory of 3560	1960	Okeieh32.exe	90
PID 1960 wrote to memory of 3560	1960	Okeieh32.exe	90
PID 1960 wrote to memory of 3560	1960	Okeieh32.exe	90
PID 3560 wrote to memory of 2540	3560	Oboaabga.exe	91
PID 3560 wrote to memory of 2540	3560	Oboaabga.exe	91
PID 3560 wrote to memory of 2540	3560	Oboaabga.exe	91
PID 2540 wrote to memory of 3308	2540	Ogljjiei.exe	93
PID 2540 wrote to memory of 3308	2540	Ogljjiei.exe	93
PID 2540 wrote to memory of 3308	2540	Ogljjiei.exe	93
PID 3308 wrote to memory of 632	3308	Obangb32.exe	94
PID 3308 wrote to memory of 632	3308	Obangb32.exe	94
PID 3308 wrote to memory of 632	3308	Obangb32.exe	94
PID 632 wrote to memory of 4916	632	Ogogoi32.exe	95
PID 632 wrote to memory of 4916	632	Ogogoi32.exe	95
PID 632 wrote to memory of 4916	632	Ogogoi32.exe	95
PID 4916 wrote to memory of 4844	4916	Obdkma32.exe	96
PID 4916 wrote to memory of 4844	4916	Obdkma32.exe	96
PID 4916 wrote to memory of 4844	4916	Obdkma32.exe	96
PID 4844 wrote to memory of 2972	4844	Okloegjl.exe	98
PID 4844 wrote to memory of 2972	4844	Okloegjl.exe	98
PID 4844 wrote to memory of 2972	4844	Okloegjl.exe	98
PID 2972 wrote to memory of 3208	2972	Ogcpjhoq.exe	99
PID 2972 wrote to memory of 3208	2972	Ogcpjhoq.exe	99
PID 2972 wrote to memory of 3208	2972	Ogcpjhoq.exe	99
PID 3208 wrote to memory of 640	3208	Oqkdcn32.exe	100
PID 3208 wrote to memory of 640	3208	Oqkdcn32.exe	100
PID 3208 wrote to memory of 640	3208	Oqkdcn32.exe	100
PID 640 wrote to memory of 3392	640	Pbkamqmd.exe	102
PID 640 wrote to memory of 3392	640	Pbkamqmd.exe	102
PID 640 wrote to memory of 3392	640	Pbkamqmd.exe	102
PID 3392 wrote to memory of 3384	3392	Pghieg32.exe	103
PID 3392 wrote to memory of 3384	3392	Pghieg32.exe	103
PID 3392 wrote to memory of 3384	3392	Pghieg32.exe	103
PID 3384 wrote to memory of 4676	3384	Pjffbc32.exe	104
PID 3384 wrote to memory of 4676	3384	Pjffbc32.exe	104
PID 3384 wrote to memory of 4676	3384	Pjffbc32.exe	104
PID 4676 wrote to memory of 4420	4676	Pqpnombl.exe	105
PID 4676 wrote to memory of 4420	4676	Pqpnombl.exe	105
PID 4676 wrote to memory of 4420	4676	Pqpnombl.exe	105
PID 4420 wrote to memory of 1608	4420	Pcojkhap.exe	106
PID 4420 wrote to memory of 1608	4420	Pcojkhap.exe	106
PID 4420 wrote to memory of 1608	4420	Pcojkhap.exe	106
PID 1608 wrote to memory of 3540	1608	Pndohaqe.exe	107

C:\Users\Admin\AppData\Local\Temp\da47f0f7a932a08b90f79accb353da70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\da47f0f7a932a08b90f79accb353da70_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\SysWOW64\Ngcgcjnc.exe
  C:\Windows\system32\Ngcgcjnc.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\Nnmopdep.exe
    C:\Windows\system32\Nnmopdep.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Windows\SysWOW64\Nqklmpdd.exe
      C:\Windows\system32\Nqklmpdd.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4524
    - - C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3564
      - C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3308
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:632
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3384
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1608
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3540
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5104
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4784
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        26⤵
        Executes dropped EXE
        
        PID:2400
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        27⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2528
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        29⤵
        Executes dropped EXE
        
        PID:692
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3832
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        31⤵
        Executes dropped EXE
        
        PID:4300
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        32⤵
        Executes dropped EXE
        
        PID:3892
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        34⤵
        Executes dropped EXE
        
        PID:4664
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        35⤵
        Executes dropped EXE
        
        PID:2948
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1704
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1144
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3284
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3820
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        40⤵
        Executes dropped EXE
        
        PID:3620
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2000
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        42⤵
        Executes dropped EXE
        
        PID:1208
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1164
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:952
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        45⤵
        Executes dropped EXE
        
        PID:2392
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2256
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        47⤵
        Executes dropped EXE
        
        PID:3964
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        48⤵
        Executes dropped EXE
        
        PID:2692
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        49⤵
        Executes dropped EXE
        
        PID:1280
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        50⤵
        Executes dropped EXE
        
        PID:844
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        51⤵
        Executes dropped EXE
        
        PID:2368
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4440
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3212
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        54⤵
        Executes dropped EXE
        
        PID:4504
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        55⤵
        Executes dropped EXE
        
        PID:1324
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5012
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1200
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        58⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        59⤵
        Executes dropped EXE
        
        PID:3656
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        60⤵
        Executes dropped EXE
        
        PID:4460
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        61⤵
        Executes dropped EXE
        
        PID:464
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        62⤵
        Executes dropped EXE
        
        PID:5048
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2120
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2424
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2820
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        66⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4340
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        68⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:824
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        69⤵
        Drops file in System32 directory
        
        PID:4292
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        70⤵
        Drops file in System32 directory
        
        PID:4088
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        71⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        72⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        73⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        74⤵
        
        PID:336
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        75⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        76⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        77⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4544
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4312
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        80⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        81⤵
        Drops file in System32 directory
        
        PID:2068
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4160
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        83⤵
        Drops file in System32 directory
        
        PID:4804
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        84⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        85⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        86⤵
        
        PID:916
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        87⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        88⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        89⤵
        Modifies registry class
        
        PID:4700
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        90⤵
        Drops file in System32 directory
        
        PID:4848
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        91⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        92⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        93⤵
        Drops file in System32 directory
        
        PID:5144
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        95⤵
        Drops file in System32 directory
        
        PID:5236
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        96⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        97⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        100⤵
        Drops file in System32 directory
        
        PID:5456
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        101⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        102⤵
        Drops file in System32 directory
        
        PID:5544
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        103⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        104⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        105⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        106⤵
        Drops file in System32 directory
        
        PID:5712
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        107⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5796
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        109⤵
        Modifies registry class
        
        PID:5852
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        110⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        111⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        112⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        113⤵
        Modifies registry class
        
        PID:6076
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        114⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        116⤵
        Drops file in System32 directory
        
        PID:5244
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        117⤵
        Modifies registry class
        
        PID:5336
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        118⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        119⤵
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        120⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        121⤵
        Drops file in System32 directory
        
        PID:5700
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        122⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        123⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5980
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        126⤵
        Modifies registry class
        
        PID:5152
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        127⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        128⤵
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        129⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        130⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1408
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        131⤵
        Modifies registry class
        
        PID:5828
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        132⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        133⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        134⤵
        Drops file in System32 directory
        
        PID:5528
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        135⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6000
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        137⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        138⤵
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        139⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        140⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        141⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3472
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        144⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6280
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        146⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        147⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        148⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        149⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        150⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6572
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        152⤵
        Modifies registry class
        
        PID:6616
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        153⤵
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        154⤵
        Drops file in System32 directory
        
        PID:6716
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        155⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        156⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6868
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        158⤵
        Modifies registry class
        
        PID:6912
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6956
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        160⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        161⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        162⤵
        Modifies registry class
        
        PID:7088
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        163⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        164⤵
        Modifies registry class
        
        PID:6160
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        165⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        166⤵
        Drops file in System32 directory
        
        PID:6308
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        167⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6448
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        169⤵
        Drops file in System32 directory
        
        PID:6536
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        170⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        171⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6760
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        173⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        174⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        175⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        176⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        177⤵
        Modifies registry class
        
        PID:6156
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        178⤵
        Drops file in System32 directory
        
        PID:6304
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        179⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6516
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        181⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6808
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        183⤵
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        184⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        185⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6208
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        187⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        188⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        189⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        190⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        191⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        192⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        193⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        194⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        195⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        196⤵
        Modifies registry class
        
        PID:6264
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        197⤵
        Modifies registry class
        
        PID:7180
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        198⤵
        Drops file in System32 directory
        
        PID:7228
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        199⤵
        Drops file in System32 directory
        
        PID:7276
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        200⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        201⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        202⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        203⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        204⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        205⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7592
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7636
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        208⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        209⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        210⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        211⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        212⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        213⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        214⤵
        Modifies registry class
        
        PID:7948
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        215⤵
        Modifies registry class
        
        PID:7992
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8036
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        217⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        218⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        219⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7200
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        221⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7272
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        222⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        223⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        224⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7540
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        226⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7688
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        228⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7800
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        230⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        231⤵
        Drops file in System32 directory
        
        PID:7944
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8020
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        233⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        234⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        235⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        236⤵
        Modifies registry class
        
        PID:7300
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        237⤵
        Modifies registry class
        
        PID:7396
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7508
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        239⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7624
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        240⤵
        Drops file in System32 directory
        
        PID:7716
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        241⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        242⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        243⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        244⤵
        Drops file in System32 directory
        
        PID:7176
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7364
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        246⤵
        Modifies registry class
        
        PID:7464
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        247⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7808
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        249⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        250⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        251⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        252⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7656
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        254⤵
        Modifies registry class
        
        PID:6560
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8144
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7308
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        257⤵
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        258⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        259⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        260⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        261⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        262⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8244
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        264⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        265⤵
        Modifies registry class
        
        PID:8360
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8420
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        267⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        268⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        269⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        270⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        271⤵
        Drops file in System32 directory
        
        PID:8652
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8696
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        273⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        274⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        275⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8828
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        276⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        277⤵
        Drops file in System32 directory
        
        PID:8916
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        278⤵
        Drops file in System32 directory
        
        PID:8960
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        279⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        280⤵
        Drops file in System32 directory
        
        PID:9044
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        281⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        282⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        283⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        284⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        285⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        286⤵
        Modifies registry class
        
        PID:8372
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        287⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        288⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8600
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8664
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8736
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8824
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        293⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        294⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        295⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        296⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4472
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        298⤵
        Modifies registry class
        
        PID:2212
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        299⤵
        Drops file in System32 directory
        
        PID:9120
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        300⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        301⤵
        Drops file in System32 directory
        
        PID:8236
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        302⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        303⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        304⤵
        Modifies registry class
        
        PID:8628
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        305⤵
        Modifies registry class
        
        PID:8760
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        306⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        307⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        308⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        309⤵
        Drops file in System32 directory
        
        PID:2760
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        310⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        311⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        312⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8320 -s 408
        313⤵
        Program crash
        
        PID:8868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 8320 -ip 8320
1⤵
PID:8732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
128KB

MD5
82d86695ad90041bef2ad9c9389ef729

SHA1
cd3c7417d1e0c3cf725b58ddfe37cf3650af417c

SHA256
327a0df14adb1b2c46fc030db146412d44c1ec73af09db45d15e89d9bef00e77

SHA512
ebd54798bec653757fb577baeef7e7e8903ad7102403fafd58fdbf23904b81de3cdffc822f535d8d115027401d50081cc57501eb6d3652e238aebc8d99d61866

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
128KB

MD5
b3496c941b3650c8024837f6f0a6ebc5

SHA1
a20b0b0cbad97c57152de2200b700190e786ef18

SHA256
45b69c94a55b5d6188b199b1a540aa7bc04184898e79b58ddf68066306a4c450

SHA512
a791f9c373a80b2e2d6c3d45f7de4bdad929d9ed8a4b176f53078ed760019a56cd009d9db78596e6dc8251df4a7c76e2ad6cc6ccfdfe0b236c107611949ddee1

Download Submit
C:\Windows\SysWOW64\Bgehcmmm.exe

Filesize
128KB

MD5
682d4fdb49c151315e8369713fd7091d

SHA1
63f976c26df4609eeb811d6bf2d72cdcb75ddb94

SHA256
3af6831449e562a28f1289cd1925dbdd9cc6be5a8527b2b308a783a5a287ca01

SHA512
78f12877e5c65d3bc116cc5973e384b717faf4a2f550e13555eb6a443f7cb2671da3720f2fc0307a896e290844b238f1e6965e65313912424f89dbac96c24768

Download Submit
C:\Windows\SysWOW64\Bghhihab.dll

Filesize
7KB

MD5
523411e4faf894d1fb2c87bf7fc301f8

SHA1
b4c9aef49bc14e42f782bc2267a9c036451ca932

SHA256
9bb0b20a69e89f4f1c6e0f19730efe2fad5d685932c1498fec768e974548a176

SHA512
9a051403c76b0227043fefdceb75d9c04fc4cbdce0542067813f8a59ad27d5f3f190e82e404af7968bc83f23e5aaa831312fd093a3906e81881c79bab9c1f89a

Download Submit
C:\Windows\SysWOW64\Bopgjmhe.exe

Filesize
128KB

MD5
ad8f23cb72383fe91f82f50c2ae677a7

SHA1
332d0d0d942b3171554dfbe06f83bcbaa4a2477e

SHA256
06ac0761fb95de8dc77dd3fed31e6cf96893285b0351013f5350f01dc3e4178b

SHA512
08b0be89e3cbe84b5d15ef35e3b26dc1db4b94d5d3f25a97f808153dee1d3993ea44625c698786fc6e7e4b4e26bf439234ff054012b5836f97402ff1c409854b

Download Submit
C:\Windows\SysWOW64\Calhnpgn.exe

Filesize
128KB

MD5
fb25cf50780feaf89cf92870efcd712a

SHA1
f9da939ad0c07b4e8d08d972a2c0bda2de38a4b3

SHA256
22e88a2188c4e5a1a6d78a55143fd6922c31edee3db901b3a3188e163074a6bc

SHA512
a4c0fc420c59737c59fad62190cdaf28f31b58609c0a0f684f8bcf07c3088a21f7354889633a35d7c96364b5f24bd5b4c25644f5d173acca00dac75c02cc089c

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
128KB

MD5
5e88f0c94eddc4f9ee4598b7807fdc1c

SHA1
8750a5097b14e3658d9bb3d0085c14ad3f3e0be1

SHA256
e92429c69beb155faf5e11498e2c47554d02d9717f54b3a5dcf9c5e7b93eba4d

SHA512
01a145f6fafc484bccd3c9e3506e722191af48f1178ffbfd267632209eeaba00ef07797cf6abc61a4c8d0d4416a800aef079f01bf30869a7a7a202fbe463d777

Download Submit
C:\Windows\SysWOW64\Ckcgkldl.exe

Filesize
128KB

MD5
aab36a1ea28a563c39736536d8c76b99

SHA1
ad0926bb0dc2cde550d599388939f48e195b3e48

SHA256
7944df6a18396ff0713a40fc0a91a6ebe007780467b46dd79f95595eae11838e

SHA512
0b631c872540161a5d82249e7f93c416fcf9333dc025bd6066b1a3964d370bebdbcc9b1743b3f390ab4148ce84760e90afc2cc51d745e872dcfd5c1166660006

Download Submit
C:\Windows\SysWOW64\Dceohhja.exe

Filesize
128KB

MD5
dec0aa9d25f0032e0cd1ce5dbc48ac90

SHA1
75cb5cd38ba1c21d230e4f81332d0878936b256f

SHA256
3145f719633b511c9024de1d3a2c6369bd2a57884adfc7d0d70e5f1628a8c6b1

SHA512
7f1dfe567976a78fb30b0e51b19c92fd273bf648d37fcf205710da7392a891a07176940c567afd7fb904bb5a6ed6040c9156190d02edc3769cf45fb6ada645ef

Download Submit
C:\Windows\SysWOW64\Dejacond.exe

Filesize
128KB

MD5
fe66b74990b2b6fab78ea4146a3fb0ec

SHA1
9fc4eb6d71c5e38272473e33a88a1a774174d4f2

SHA256
3d54b4a1cd875c689b785e44a33c363e125efa8f627954b4403825076db46af3

SHA512
b9fa7fccefc952379bc406ee07ced5943e3db56d7c6b28b5ef294dec9030e5e865611ee571866a5c6bba8a17088eb0f0f99e174a7b08347217277266ae4797ca

Download Submit
C:\Windows\SysWOW64\Edpnfo32.exe

Filesize
128KB

MD5
75733c8cb015161a8b0a3f6909408f8f

SHA1
7176ead8973850a4646551f011e950e3402bbdb7

SHA256
639cba95a5142153009c44871bf40d39cb47571cf5809d1c1381ee61e40bff47

SHA512
f61af248e4da9f0f2542a5555f4b38c51d2332fccbae82400cddd4b89393b929c0adad1055c0481bdd93b2bf083acc7326d5bb36f233aa247f4144bac84daafc

Download Submit
C:\Windows\SysWOW64\Elbmlmml.exe

Filesize
128KB

MD5
42003a2100110762bc5e70ff7612da48

SHA1
5156c770a7c8eec578520e2464f4f029c8d0bcae

SHA256
122d8e1f47dd0572338c89d660dbf1185fca81cb0b4d1d11f6e7216c531401ee

SHA512
68e7cc7f2b816c67984171c21fbe12ba03e25db4a8a6817a66903c79fbed65e836741f231dc128636f8bff7b4f5a37831d6def3d9c440d0f635222d7cc7da01c

Download Submit
C:\Windows\SysWOW64\Faihkbci.exe

Filesize
128KB

MD5
0b2a2d12e1d0f62b2aeff88a79291dce

SHA1
662f62535130745e285bdd78edb790b1c13daf77

SHA256
aa56a9d6c46ae34b7bd598bb1131ef390968e1ba6898fcc2e177c645fb49ecf8

SHA512
2ea9812993c07206c2bf71b3d56fec8aeb216b1866172216ff91a7156acf2dabacf3d1d2e5d7bf701196155be67bb1325bb9750bced79af184885bb8c33f9254

Download Submit
C:\Windows\SysWOW64\Fdegandp.exe

Filesize
128KB

MD5
73837f56ed04a0f7176c8faea0c61c18

SHA1
1baa609799cde2e9b94cefddee737f568790e2b8

SHA256
13bacbde4016fd07748749ed3a17adc0b75a4946a47007451919ceb3604f4bca

SHA512
35e2ae58c9fd7bf055102bda2f5b1cda1840b3a2c0de1cf7109ac2441229292c9e04062a3f0447ce5b763e159c3a2d06022a0c881c2302b053eec09f3c0eba20

Download Submit
C:\Windows\SysWOW64\Gbiaapdf.exe

Filesize
128KB

MD5
577c234f8d0840ecfa4b790154ca8ff7

SHA1
af45bedfbb5dc7d2658195735b2c3478946e97ef

SHA256
796496a09f22654d19dc1d423efc1acd116dc461848ac252523d6171072699ac

SHA512
4ede82fffdd33c32b364b03d2917a4f029286aabf6c8fb396dabb6848b5bef7552497c7fac8ec306ef88b87002178a4d38c4f01f702fc58c9e5718e639c425b5

Download Submit
C:\Windows\SysWOW64\Gcimkc32.exe

Filesize
128KB

MD5
b614ffe4d0f3f69c16d93651a6224737

SHA1
eb99ec94eaa0a98caae26d693119e7497e43b6b5

SHA256
9533c3d1698679d48acd6ebe66a7d854e5c512d189db1044248ce327f39fd456

SHA512
fc5d57583aad2bb719bae65f2d0eb8011542a21808e66a7c6019fc2029979d5068c43c0740b910d8082bb76783597e96f102cd549335c50d7b1efa99fbe22da6

Download Submit
C:\Windows\SysWOW64\Gfbploob.exe

Filesize
128KB

MD5
c2c71dd5cda6be2dba2e7bcd48c29040

SHA1
2f400df9f1d7eb09fa0bf485b74a583d35619a4a

SHA256
6ebc1e2ceb19bf4c48ba5654066552441812f1fd4c9705414c2a826e80e5ca6e

SHA512
4bac313ba67fbfb0e09233fa71b44194c8c8b47319a1ac92e7b4ab7d0e3be5333c4cf4f65e0c86ccd52de0479d38aba14f1449211cbedfb3d4921f5d740565ca

Download Submit
C:\Windows\SysWOW64\Ghopckpi.exe

Filesize
128KB

MD5
d2c67ebf9052fcdfa0da240a89574112

SHA1
c56aad9c6ae0de72daa6e753bc5a22d6351d1618

SHA256
2d6fbd462f54c539866f5507bf2f599d573d9802ba6906cf3b65653cddaf5734

SHA512
5943f4ae2ba2db6bed0c67855efc831383519363267eba5e320de747fafda41cd85d1d9bec15659ab4377dad82470c0e0e232fc84d2201a98840f8cb03f5f026

Download Submit
C:\Windows\SysWOW64\Gmoeoidl.exe

Filesize
128KB

MD5
621a2011a3c88820bdf1fb7256bcc7c9

SHA1
614b973bbba125280da5da9a318008761a211361

SHA256
2381e1d158c8e42aa16f71dc44f6d63577951d34d9683cdc59f7456291493dc9

SHA512
b0e4ee3fdf9f5137b0d34ec5a517daa66f8a081f9eff5730bf8298eb6d03dbd9cd5f7215a4aff5e412fbac6c322b8b9534e3059168001836fab7fe6286959e8d

Download Submit
C:\Windows\SysWOW64\Hcdmga32.exe

Filesize
128KB

MD5
d8f08fa87dda2211d41420cffed9ceb0

SHA1
0f495a4174cf5916f2491748156baad60415aecd

SHA256
ca96378e33d5eedf810c62fbdd49396f80d21f7905fce9f999cbbd6ef3ffcec9

SHA512
1391e774183c845704b5daf0ab352bbde081e24b6abce503cb8334b831e38ec85d2c63e56966859b83476908f6dd78c70c9dad91d390890bbca8296d261a88fe

Download Submit
C:\Windows\SysWOW64\Hfnphn32.exe

Filesize
128KB

MD5
bf9fe755323c304ab6575d6c6f286ab1

SHA1
3680316d09d375d8e3c5db190c42ce87622f71d8

SHA256
506a4e95410e6777263dca946effa1b615f97ea226b672c6e7786f5909fac74d

SHA512
2094411f55ae52f3025727b1daef9cb522cf8c7f77c39f62b2960ccffdb7784578cf3485f884a569ef15edc1fb746a8d361838af201191856289b37afab45987

Download Submit
C:\Windows\SysWOW64\Hfqlnm32.exe

Filesize
64KB

MD5
16f917f5f87152eef40c72f56f1d8c26

SHA1
c9c83e36cb876dcb8c219aef4316fac7c875819b

SHA256
8161fc178882e70423be23f1f0f56d11cab18a6a794d8e585da8ea317e6fda78

SHA512
0be98b43db28842dbbe464e6955cd296595d173da669d27e5cf0cd6fc3536122345672e3fd77a59452a8339bd076efa290d6bff2c08ce03a46bd750724a09a6d

Download Submit
C:\Windows\SysWOW64\Ifllil32.exe

Filesize
128KB

MD5
8ad0a66ed4f592d93f1d84b76edfcbb2

SHA1
062b3caefd09a6b15c82979be12599982bce3df3

SHA256
fb0d97b2cf3fc2fec0c1254065c3e23cdfba57c4807525a2c7a07e1c89a1ea5e

SHA512
20d211e47b18e8a8ae33dbbaef775add2e1431a4af6de47c09e72187a88cb711e1c033c7c241c34335f1ee90266801e361057acbd156b4e2ff6b69679f808095

Download Submit
C:\Windows\SysWOW64\Iifokh32.exe

Filesize
128KB

MD5
15de3100e0be331031eff32aea5903bc

SHA1
5462017a7b1197c25964e6e4bc90b4985d439345

SHA256
103664a8319d09ce63fc7ae63be8b56bff28e95a6d8be372b43a27aa7f2f39a0

SHA512
e25d5d50634db643903ec844476ee04480371be0b3b1d79aa8a084c90869c0accb6c98314a0b3b11b8c0485884dd078ac12a3e06cf592ef870417473dda7899d

Download Submit
C:\Windows\SysWOW64\Jefbfgig.exe

Filesize
128KB

MD5
b86b938912e43ed6008118591dcbb2ec

SHA1
0dc84b01fcf7a95f5779d2fcc76e0d3b7c68b83f

SHA256
f0e31d6fbb746bb75f04c629ed7c32f9b0123db36d6a95cb7d2703ad488fdb73

SHA512
254bf1e90ac081353558ef9df9c45ef9435ef9b98b52cd8500be6009ee278a0787ca53b76b082e84b907a056ea5c39b32d4e77f494012883e21053657d908441

Download Submit
C:\Windows\SysWOW64\Jidklf32.exe

Filesize
128KB

MD5
ad10096cd468967da120422e26aecf8a

SHA1
01902a366796b8aeae2e607549e60cb42a24724e

SHA256
0e4fba937b76317fcd0911aac04dd6cfe7c34a96e986fdedfe158300c16811be

SHA512
d3a9bae68f8d5a226741c2e24a012073b6a1ca809ba5cce1c2547afc09ddd59750d81afec1f63005aa97647dd05c4f737d30f054c0ea32bebfdd67f3c11b7c0e

Download Submit
C:\Windows\SysWOW64\Kdnidn32.exe

Filesize
128KB

MD5
78ef06c35f28b69bfbfdbe31bb9b4ce5

SHA1
93c312127cf903c5b60a50890f3029d690489d7f

SHA256
439a72c909761c777876988a33f92db0c4230cb10dcdc8bbdb4b4d375fdcfe69

SHA512
6e958d994ec5c91d371cb619859eb44e3d5d89cb4eac8fa6648e91feae63dd74ea92a07974c58d8524cf2e754da2d453a14be1fbfdf99d3051d0eb68551766d7

Download Submit
C:\Windows\SysWOW64\Lffhfh32.exe

Filesize
128KB

MD5
c5342de0e5ca2a1464320188f07a407f

SHA1
003800cceaf848c68974029b37dd7c87e99154cd

SHA256
d05175dd47f937e11497e1706b04a2e36cd9fb700c7e49154e0c4e6be7f767f4

SHA512
f96695e57c16d408c57c4f3d9069738ebfcf715edae37c996a0ebc75567570bff094d15f42b579662bbac1707be86b30de73d0fde3c27caf17c5d9e6904ba59a

Download Submit
C:\Windows\SysWOW64\Lpnlpnih.exe

Filesize
128KB

MD5
c2785039c82fc6315c2f6afa7efc87ff

SHA1
854be3b2c8e1026a22da76eac47bd9f6c9ff8be7

SHA256
571479a8d16bc8dc1a98fafc84f52be326508725da70e4d7f90f692282781605

SHA512
44741b273b999b4b81eae37f3e9c5ebad7079c79680db911e02b12a316539469b17e602864f11f1e3e7ed1a396a5eecc3e3a90dd31aa6e55e0c032ff30c89b96

Download Submit
C:\Windows\SysWOW64\Mchhggno.exe

Filesize
128KB

MD5
604f9b0d58eb0234b232462127c86540

SHA1
30c65ec9287ffc918b1e07cb02a7fd241170261f

SHA256
02e29f7ae15e6ff71192e65066e627f41b931acd1111b3327c53f81e40490532

SHA512
e41ec7f83321d2e7f9de1daa108e61e5ea0236d21db0304b4411217a109f0b5e5061b479e2c8563a6dc14cf96b43a4e6067d28033b63c71bedb592f0b00956c6

Download Submit
C:\Windows\SysWOW64\Mlcifmbl.exe

Filesize
128KB

MD5
7dc439073eba86a52d799ed4a764f5c4

SHA1
bf0c5b758630d55f36f22591480b79277abdb4b8

SHA256
5a6b45e53feb744df0d246f437c40be55f2b4a7ecc0248dc473a9f130307d9b4

SHA512
13800c43eefffa2dddfa5c3f3836c901afda11d93f3500096e541e664742fd5c76bef7b373a7176879b34333a9089db66a7148226eb510529323706a99580722

Download Submit
C:\Windows\SysWOW64\Nbmelbid.exe

Filesize
128KB

MD5
635a7f5b20c7f3c142d11c4f69d29ef5

SHA1
9ecd2dcce0f84e3b8812e558e02b1d1da37530b9

SHA256
b52d2441e667e9a8c469150f4772ae944d5f7d15b5269daff0aedbc62f9e16a6

SHA512
f5efea5579622deff5999030be5d9cf79471084e9c18d3df510ca26dfb273ce7fa5799272e1f7b4fd9d7aa5b7d8c86ce8f1f8dea3a9a3e2de995fdaa92a6d5b3

Download Submit
C:\Windows\SysWOW64\Ncihikcg.exe

Filesize
128KB

MD5
d32c029f798ade6eda104068c2795736

SHA1
17eed0d89f96c89821c1bddf0375926a193355d0

SHA256
05368b08e250e8751237bf2d5632ac91ca232e87cec90aa1c10d7f65529f625f

SHA512
37ced11a98f5ff6419a6b6fb164c5db1f219e2bd7d6b559a5f28ea009a522188b55d64564479e753abf259322acb5efae2d74be45669212709a7b649fa26c968

Download Submit
C:\Windows\SysWOW64\Ngcgcjnc.exe

Filesize
128KB

MD5
a6314bee0ab4d1b4f054c9cf5ca98b0b

SHA1
d89f140941dd1939b0dd5256cbc2de0014ec7a95

SHA256
d9b3b06d3a493e01377b1903eb76de1050865100acbdbcb26aba652da1f5ff14

SHA512
72c84db075614a2f1d3e8c76c9b8199979c45d2f823a52d0a5c7fb351be633fd08d224d2a97cb4f296f8a10a32be8c0452d4c4d2561ac3f18cbf2f8be2999211

Download Submit
C:\Windows\SysWOW64\Nggjdc32.exe

Filesize
128KB

MD5
f967ca2d2089d7d5cf9ffd59a5c219be

SHA1
b3e6857a2c50a47eb3f7d102067bc091242ddb2e

SHA256
39e05d4f57ee100b147341a244fa8f2fc5d8e87647bf16bf28baf354a5bde3ae

SHA512
c79ff48b705ded0c1977fe60afaaeb8b7e19b8cf1248e2e6861ef8c71a2e526182ca809f85d043411da4fc0d943d334a641c43a9320b341228d530be5b3d9497

Download Submit
C:\Windows\SysWOW64\Nnmopdep.exe

Filesize
128KB

MD5
ac0bfea614533e5138a9cd5102601b55

SHA1
a577a8604602ed88ec50a1bf3b15fae9217becb5

SHA256
f42208d490047147cb5810bb37d3af08aae0514da657212f707a01a16a707c93

SHA512
a6b65a6e181dad1fdcab62e3c13d5aa26f70648f019f13aa845ea20d241db5559d550fe6e0fec5b33a706bf64487bd7085e144f3c2d77075d6ef8d5d068fe643

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
128KB

MD5
2c9ab195c26b4fcd342b2af5d87de0ff

SHA1
171f42d1eac48d9cda3de0cd905f840eb66279d8

SHA256
2529ca9b7d98a1b9fa081cb6f4afc64aa06911198e588850372c2c6501abe03e

SHA512
49e8e7433f3ed71031fb29d72e10b2bdbde17665ba92f277c54008d6aa1d69400ec48b5ef68b3bf10e91940cfff0742882411acdd535b74d326e9faca6a1e2f8

Download Submit
C:\Windows\SysWOW64\Nqklmpdd.exe

Filesize
128KB

MD5
1cfb896cc968c808cb0950ca3440b766

SHA1
b7c54dc52700a9f8d5cf50873ced13bd31c1320b

SHA256
c4f18ca86c913cb21025994ffadc1527af04eff13bb106893b32bf55031d1a19

SHA512
d3a7553b6f6165ddfba9caa36d5636c38fc9e20f21f4186e6d9977c0fc0d6b6257f04186cf30efd37d1636f47d31430cb9733cfcd55515763877917d4add2002

Download Submit
C:\Windows\SysWOW64\Nqmhbpba.exe

Filesize
128KB

MD5
4fedf66bdc1c4a72abd2ac5a7c9dc4d7

SHA1
790727a0b545ab2f1938537b88e4d193757fa8b7

SHA256
48c04f7d9ee7b0f0511cc8a8ba58d1e0c0bd9a277160b0e7f8b71a98f6bbdfbc

SHA512
968e65b9b7b73fa9e394c2f38ab283462be2988444381139808625a4d7a7500142eae658218afb4633c72b2b913a640c65ed819029801412d7c1c4015f3fe3b1

Download Submit
C:\Windows\SysWOW64\Obangb32.exe

Filesize
128KB

MD5
4bea2416abab8e91c713dc17352193fc

SHA1
98f4b6b07351c02f91d7e24f6d0212e89be7e9a2

SHA256
7990859e7e4757f22f44304b187ce89f3874072d502bcb3b214d41d73891db80

SHA512
dbd9a876fdd4a08284430b448da00263f5bde5c824e02c07a0f35cc96f6f6a949061f382a19d2c39e3b8139b973ff5185d5d633646d68ece0b367091e472e461

Download Submit
C:\Windows\SysWOW64\Obdkma32.exe

Filesize
128KB

MD5
c8de7dfd25f7dfe1f3f888c3984e64b0

SHA1
e48991bc6d64d27f282e5186c4ea96771cb1929b

SHA256
1eb646f30afd13c542cfb62881ec563c1c5a174676392f02196cf7a2b9f08885

SHA512
aff1539ba0313b85efc9876fed45570def29bf689bfe38a601009fd564bd50f98fd83d4c148c32869db25a856599eda808e7b9fc39dd0d71cef24f237fc0ec6a

Download Submit
C:\Windows\SysWOW64\Oboaabga.exe

Filesize
128KB

MD5
54fd68c03d9355773533864ecf47623a

SHA1
4c0ca330a823e410b21a163fdbbd7e0bc9a7d398

SHA256
55bd64cba90d68ea457dbae323f1d8e2d7d80b55d219ccc19e31444821354804

SHA512
225c629c3d6cd2c7fdbeaacf77c44d8ff2da60f214856149484aeb10af8848e67fafd6e56cab703900bca4376b4f3981c87401edd2cc7dcda1d07af8be98e33f

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
128KB

MD5
668f15a04d1042ca11e25ddc41abe0da

SHA1
a1f6a310a62161bc9547fe9d888d55f07e7bb7e1

SHA256
a4ea710d564c3cd980c5570ac7b57544582981a5af2e226c8125697b0e531ea1

SHA512
668ca839b09f06c4f913dc408b6e19180ff16fb1301450b974ab1d2056b9e207e550c080a265fc354d3ceebb33e10108cb6e01accb7338d355d4f692dfbb0f7d

Download Submit
C:\Windows\SysWOW64\Ogcpjhoq.exe

Filesize
128KB

MD5
37f74c25bffd2fa67314de33cabe4dac

SHA1
c62c0e0b184664227b8bc8cccea5ab911f312b84

SHA256
1639713bb0ea618918c784d1e633312c7681ad61ccb0fcb55eaa853c8eb38bdb

SHA512
9dfd88f0e5bd1043d1e26c1c67d5b21bb048926fd2957bb571d7ce8562ab208de8732ecdc17b554da614a0713dcc805fb7ceef1fe7bd57ea897e5c271624cc52

Download Submit
C:\Windows\SysWOW64\Ogljjiei.exe

Filesize
128KB

MD5
c9ca25618b491dc9f82f1d88c8f1fd7e

SHA1
cb4eaefd055e52fe83b71397deae6f0ac9c39611

SHA256
fec33042d1daf89d7a7405559ce2600e8d96d9ff46995e0c63aacf20276a41bc

SHA512
df718b500af4d809cd0863c913fe233c16d3a0a01ddcd1be933029c768a35ba454e3d512b383c978c96c2904602f6496f3aff09d6a6d2df15165d12beb0c01bd

Download Submit
C:\Windows\SysWOW64\Ogogoi32.exe

Filesize
128KB

MD5
a75cf1a27da2b825f1aaf0bc50addf1a

SHA1
4fc22187fe2e7808700d9d3620fae901a0520eb5

SHA256
ff28129df56e13838f9e7370313f57c52d608d1980e641eb9a21ae9e2f94e6c0

SHA512
f19d7ced404ad2b3272808f09c1de3398ea34157126764003c9f91a04008c4aa40bec716892e34466b2949089276c05a263225fe85fa72994f48b9762a2b18cd

Download Submit
C:\Windows\SysWOW64\Okeieh32.exe

Filesize
128KB

MD5
93963756b2765a0c1d22e2cbff232f1e

SHA1
38c21127318dbeb076706a9be4e0a1ad1f4097e9

SHA256
e5c2f17ea481b752bbb8ee4be3618fe3757a4fe424f858b908866afb01fd8951

SHA512
ae92e0d86f42a41fa364797f016918fd441733e362ffe9b8ed3c2b26991f107b1169aa96aeebb740987b59c2405507faa8c827a5def7b49a14af73c33a9d0cc4

Download Submit
C:\Windows\SysWOW64\Okloegjl.exe

Filesize
128KB

MD5
58d5b510be08f1a92863b14c1aa5679c

SHA1
b53121a3960a0624337b24730abf6fcc3957624f

SHA256
6fe2cd0a85855ced4a29d4de36efe08bc69a22bf59289481e833a73f260e87dd

SHA512
9ef620a60da7896a6d7f3d6ce6713adac1e424d884eae82cf3970d8a6fe90ab19874ec70660965442559e9a156a145e7be4b8d28231bc20071a0c99c36363d58

Download Submit
C:\Windows\SysWOW64\Oqkdcn32.exe

Filesize
128KB

MD5
2f985cd54192fd505aaa5f2d64ccffc9

SHA1
09c905952a53b1629cb6085309fae97ff5564d6f

SHA256
f864fef6b171a09933f390c7dcb130d79eccf1f699782782958acdf570777338

SHA512
3ed50a8d83b6abab2143a61eb746b4e464df0b901529572c118e1d48f4d689cd00c8cddfca35a7a9c0743477830e32a7fb97b99d810ef370d98f01b9f41767a8

Download Submit
C:\Windows\SysWOW64\Pagdol32.exe

Filesize
128KB

MD5
1e2fd48067a9aaae7502d18b7b1330c4

SHA1
25bc1573045d7d00778f0cef4cc64b7b953998f0

SHA256
e2495aee14995c11449dc0a0d918be603c8cf49a886c7c374ac3575422d9cd64

SHA512
a23a0fb3f01ac35afd5e9dc892eb0b6854750e5450670a01418ea6830f532e8b04bc144c754fa5196c5e11327364ff72a5aeae33f5285853de7047f6c1a8f534

Download Submit
C:\Windows\SysWOW64\Pbbgnpgl.exe

Filesize
128KB

MD5
4b1c1f2337de6a4065f238cbc7876281

SHA1
91bd4568ee9843029194102ec2ae424f2779e31e

SHA256
a2a42789e86f4be10c4647c1db46101ef233d4661b901e0670c5d5373b6d1002

SHA512
2509d08782bcbc2d4ff1f936177f37f6b1087a102c384e4100d663f5b1aae74bbd082527d6466d5486c75617d16704d1eed2628a22d2e5a8b2356c7b7dc0081f

Download Submit
C:\Windows\SysWOW64\Pbkamqmd.exe

Filesize
128KB

MD5
c0713609dba10ab831f92e9c2e419e96

SHA1
9acd68e011406a4536e91efac2e0c86815cf3e65

SHA256
0ae06832f1e144f2598e6a67aa44306126d83903f7f4036a78caeab94b4e975d

SHA512
b9f04b45ee870cffaeb4d553ee069a48e1ccd6d3e971887f9c58e99e8ebe033d8f56a39a5aad93f1c73814a4e16b1500e7c7001c425a32ed293e35a7b7eecd24

Download Submit
C:\Windows\SysWOW64\Pcccfh32.exe

Filesize
128KB

MD5
5812cdeb69a26bdfe4d45254b7dade6a

SHA1
94e3184974be4776599492775a5bfd294161a1b4

SHA256
1dd4ac4fcdcc853d5304b592177777902b4edc57a95e8746f2e91a46d2744164

SHA512
c62c4d152717084058bff040ae1229d7484d5132f5c1c79f4d190a77c3bf32a7dcb0ffc905bf72c76832b3148c055709f3991729eacee693ce1cdf0f16d0626a

Download Submit
C:\Windows\SysWOW64\Pcojkhap.exe

Filesize
128KB

MD5
3792c1c764a7cafafd969c50eb60733d

SHA1
cc3a52caf5704fbab3ba912055d2c56c6e8efab8

SHA256
5513448e8bae4bab61b72d774d33b3e5d0b4459a90c47b126940b588ea4d4b5e

SHA512
2339a74d33d3428ca1734454bf12d36df00d2a9b569967d34e820e46d19db4a683e1d7edb3b0dab4ff3ffbd051b7cfc6d00de432a38d81301d3f900f99209fd9

Download Submit
C:\Windows\SysWOW64\Pghieg32.exe

Filesize
128KB

MD5
c1421c83ddd21bc84ab3997e4dcaefda

SHA1
0270dbb32d392bb9e9d59c72813c3f43f0e55c3e

SHA256
e134d243511836f833652e262a6f84f5e0613e549f9dde4a0df1aaee9a23a30a

SHA512
5bff5df6d2105153b326be6f9b3db069c06921cf0c7f02ff52f0cfb9e2a6c4847dc9306d89051cf9fbf9e5e46e69ee487b9b305b775c329d57612f6140f34608

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
128KB

MD5
50df08c1263778bb5a2b7b0280ca2781

SHA1
c8973f2a1f7b7ae7f13cc6d8efd0f3327e755f67

SHA256
da46b2e5a5dc5c06cfeefff803500df9e13f2a318c9c33aa390ceed95c458d9d

SHA512
914a3f65f1c539c495f884a45e3371fe3f43aef5ea1109fd08b78b264f3685ce3595b3155f7c2468d5678d9652487c8390ccd3faa0220e636394e8d5e22594a9

Download Submit
C:\Windows\SysWOW64\Pjffbc32.exe

Filesize
128KB

MD5
b9c9bf0d90b06fc0ab5d05449c07c46d

SHA1
521f72eac85aef6809912383e433dafd8f6238bf

SHA256
e563f21efa227ad0312febbb892b0a7c528054b207cc488ad9c68efabe20d5fc

SHA512
84fecb39c41e1ced9e9a27ce53311e2a8afe7c0c6c3caf8b80f0effb89eddcc9414aa40cb5098a37c200c64236ee1c08d2264ec848ff27721f32de47d36adff6

Download Submit
C:\Windows\SysWOW64\Pjkombfj.exe

Filesize
128KB

MD5
a62d6d3cd5ab68cbcd3c3f3a475507a0

SHA1
947bca37c54e8c67b5366b8a9be5ee78a5d82fb5

SHA256
b04f708fb64e3e75c0524f868e56e6af5f02d0c51d0470ffa319891ccc1b8582

SHA512
e0795d33efcada25f844b41021cbda797d987ae265e2811e6902d367f46186ad361305ae8521b44a10ff585111c43d162abfe09dcf7524b5408ef7721fa437f3

Download Submit
C:\Windows\SysWOW64\Pkjlge32.exe

Filesize
128KB

MD5
8647e2cb4a51a92bbeb0facbec276ce4

SHA1
7ee0c5f83d3ed57939742bd6938155aa87d61c97

SHA256
b72950a51e2d85f359a75ce27f322719e7196a2e7475cf70ad26e97b4730b8e7

SHA512
b46c9766afaaf0a9e55e073d125f059cfcd76d774f725d3c7d2dea7dce5654bcd4d30a18a5bd081ae7dd07f27aa51e86490727321dc266f40bb89253540ff660

Download Submit
C:\Windows\SysWOW64\Pndohaqe.exe

Filesize
128KB

MD5
3179178e1efe05b73190fc052299d96b

SHA1
b47319b7a0a5fe201b67b47a1d42277e666542bc

SHA256
6633f988b830a66b3fbaaea057d8caf9733113d2b9ee1a5bec296eebbd03ea93

SHA512
76d1557ab73a4cf9836102323537bfa431c2d6e1677925efa43afbb312fed7f35b0ad81f76a04f7bef2882a674911121394f2b6011054e2c312f00d5d5ce343b

Download Submit
C:\Windows\SysWOW64\Pnihcq32.exe

Filesize
128KB

MD5
da500e17d9c082d838322323ad2ba9cd

SHA1
15cdae949f85f11ad4d470a3371f62c039ae426b

SHA256
eec37b1b6e3c50a6bd23cedaaf70f50d2ad3b696a437f80b914d8ccb195c0a99

SHA512
161ae29385bb9e6d872cec4703e81c5e43346b3d40006c1710935a71a1d3170f6c7d4b3195bb56a74f029fbc9cd7f86ce787e450e4b38f4662f28be099de58fb

Download Submit
C:\Windows\SysWOW64\Pqpnombl.exe

Filesize
128KB

MD5
fd669b99caaef85d425e168298531042

SHA1
6e34af7cb65f7aa5681e7587eca036bde4bcf9b7

SHA256
8be37138e1843852b84d91b89302c7ffb8bc963f86d12c4d5f74f4b56a7e5f78

SHA512
18ec0662cd5a7160c9a2eac941e3c7cfcc65eea415a680611dc6908860247c02a9cd66a9042eddba686f9603c9b3315f77426c707e4da63879d7f649cb0d657e

Download Submit
C:\Windows\SysWOW64\Qajadlja.exe

Filesize
128KB

MD5
9d70d1468e3f62645f537f80aad637e3

SHA1
a8e22cbb5aa35411fda5a55ed468d2b0a3aa877e

SHA256
6939393f3203c2be5e60f90d9f2b0753b56fc4d89e6ea013617e20f2c6dbafc6

SHA512
2f7e77ebbd64858fdd00d16f0636d73fbbb98973340cccbdd77f05b6f72e36248ffb4bc60282cd8a50c82b646589d762a9cf0740135f3ba953a46cf7c7096c8b

Download Submit
C:\Windows\SysWOW64\Qbgqio32.exe

Filesize
128KB

MD5
d6ab5b9d6efc4ed59bf935651de73307

SHA1
fed65c51d9f98e5c75d37fb6301e1d61fc368ecb

SHA256
1a9c83f83bacb104f7476d9ae0dbfd95379248cd28b14f1e375f87b801ab15a1

SHA512
fe31778244e0cdf4cb55760b930f205b5224400c400af75ae5e4bc74d6bb6c7de81741019f43f6251bc9f932d73fe4210211c1b3b09ec32fa26453e51875101e

Download Submit
C:\Windows\SysWOW64\Qcepkg32.exe

Filesize
128KB

MD5
dd9ce26f0014668543c8caf991553518

SHA1
0375c5f442dbd2f5b311afd992849350176bb93a

SHA256
4327a5f2823e1860c726912018eb6fb10aee5dd0af79c51d19eddfa9cedd888d

SHA512
632bc7981209837252afae65ab0a9d56485ca16e8129a6c5c4f11625e1161ceb68face70f98024bc566be0d26aa05cd661bd9ffe34a323c8e3d8285b6e2697bf

Download Submit
C:\Windows\SysWOW64\Qjpiha32.exe

Filesize
128KB

MD5
9458152c0cc799e6ad45abd362bd6457

SHA1
e2a296c1377ec96da7c47ac97ae478be61dd1b3e

SHA256
b977a2d53c9940592b9d7bd7f35ad2b18d26b587f2e33e470dd442ec79fa13db

SHA512
e95cf6d798bed1c8d99f9b53823f2c21237dcaec683ed641d1a372926ef5bc7c2ab1fc6bcf69ae9283f8d59871596ee7aceb27ee2826778d1e20e093d326883a

Download Submit
C:\Windows\SysWOW64\Qkmhlekj.exe

Filesize
128KB

MD5
fff347885e4a3ddf3fc6c435c0dd5aa4

SHA1
ba5e138dc84b29c4b8ee14d23fbb327ac0fe0391

SHA256
1b8ae243504386cb76304ddacf0d9133343dd941788f9059d0a376f89da489f3

SHA512
02bdc8b9ff6c1499a19c82ecc058041c13711250ffcc63c6c3b3e1abe11ba40aa5daecf7a3b55be3e1eea2d232bd818c6eb1137b430331b8868a5130702cea90

Download Submit
memory/224-79-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/224-0-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/464-448-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/632-89-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/632-186-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/640-300-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/640-134-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/692-286-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/844-380-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/952-352-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1144-402-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1144-294-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1164-351-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1200-494-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1200-424-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1208-350-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1280-434-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1280-370-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1324-475-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1324-410-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1608-178-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1608-369-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1620-428-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1704-293-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1728-88-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1728-7-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1960-142-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1960-56-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2000-347-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2120-462-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2184-20-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2256-354-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2328-487-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2368-387-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2368-447-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2392-353-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2400-216-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2400-395-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2424-473-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2528-285-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2540-172-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2540-71-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2692-367-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2820-476-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2920-290-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2948-292-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2972-215-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/2972-115-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3208-125-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3208-283-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3212-396-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3212-461-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3284-301-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3284-409-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3308-80-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3308-177-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3384-159-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3392-143-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3392-342-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3540-191-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3560-64-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3560-158-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3564-114-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3564-32-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3620-344-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3656-435-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3820-343-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3832-287-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3892-289-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3916-48-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3916-132-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3964-361-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4300-288-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4340-488-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4420-173-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4440-389-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4440-454-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4460-441-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4504-468-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4504-403-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4524-105-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4524-24-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4664-291-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4676-160-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4676-358-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4692-124-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4692-39-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4784-208-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4844-106-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4844-207-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4916-102-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/4980-284-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/5012-420-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/5048-455-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/5104-195-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/5104-382-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads