74c1424fa27cc08e2a67caeb007c587a13ef31ea0cbd036827fb496e89b16668

Analysis

max time kernel
140s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e506aa1d68d200e897aba6f8385a4e40_NeikiAnalytics.exe
Size

92KB
MD5

e506aa1d68d200e897aba6f8385a4e40
SHA1

ca53b7dba8bfa51b58c0f52ee230b4e915905465
SHA256

74c1424fa27cc08e2a67caeb007c587a13ef31ea0cbd036827fb496e89b16668
SHA512

9e2e2e4bf2ca32b1e8e99993b14794415f255ebec9bfb123fe0008f967bcb4bc513bfb800a3252d04ec8ab9e8ae015262e6457e5393c4221928e78b09dd558fe
SSDEEP

1536:oTrs4VWJZWd59/8Qjme1EqDIMz0hMjXq+66DFUABABOVLefE3:es44ZWd59rjRE8z0yj6+JB8M3

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehimanbq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ehnglm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikbnacmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmmjgejj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opdghh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjmehkqk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chmeobkq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chghdqbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aglemn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocpgod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njnpppkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbbdholl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgddhf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfjjppmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mchhggno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlampmdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hofdacke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jplfcpin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Belebq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Baocghgi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Echknh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcioiood.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhfajjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boepel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkmefd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhidjpqc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhidjpqc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpnchp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmdkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amddjegd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbgipldd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dekhneap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qnjnnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqijje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ampkof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jidklf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndokbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghaliknf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmabdibj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkikkeeo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdgljmcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndfqbhia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aniajnnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcmnpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lboeaifi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmiciaaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdolhc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eefhjc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gohhpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcppfaka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glebhjlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Heocnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Heocnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipknlb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lphoelqn.exe

Executes dropped EXE 64 IoCs

pid	Process
2400	Ahmlgd32.exe
4460	Ajkhdp32.exe
4844	Abbpem32.exe
2416	Aaepqjpd.exe
820	Aniajnnn.exe
4128	Bahmfj32.exe
2368	Blmacb32.exe
928	Bjpaooda.exe
3536	Bbgipldd.exe
4972	Blpnib32.exe
2112	Bnnjen32.exe
1352	Behbag32.exe
4816	Bhfonc32.exe
4216	Bjdkjo32.exe
1328	Baocghgi.exe
4764	Bdmpcdfm.exe
3708	Bjghpn32.exe
2272	Baaplhef.exe
3084	Bdolhc32.exe
2556	Blfdia32.exe
512	Boepel32.exe
4952	Cacmah32.exe
2600	Chmeobkq.exe
4680	Cafigg32.exe
3608	Cddecc32.exe
4840	Cknnpm32.exe
4260	Cbefaj32.exe
4648	Cecbmf32.exe
4472	Chbnia32.exe
3700	Cbgbgj32.exe
1596	Cefoce32.exe
1180	Cdiooblp.exe
4308	Conclk32.exe
4800	Chghdqbf.exe
2828	Dekhneap.exe
1176	Dhidjpqc.exe
2900	Daaicfgd.exe
3612	Dhkapp32.exe
1380	Dkjmlk32.exe
1216	Ddbbeade.exe
2576	Dlijfneg.exe
736	Dohfbj32.exe
1664	Dafbne32.exe
812	Dhpjkojk.exe
1260	Dkoggkjo.exe
1764	Dceohhja.exe
2452	Ddgkpp32.exe
4620	Dlncan32.exe
2292	Echknh32.exe
64	Eefhjc32.exe
4820	Elppfmoo.exe
1280	Ekcpbj32.exe
3416	Eeidoc32.exe
640	Ehgqln32.exe
4112	Ekemhj32.exe
4116	Eoaihhlp.exe
3456	Eapedd32.exe
1532	Ehimanbq.exe
4280	Ekhjmiad.exe
5048	Eemnjbaj.exe
2692	Ekjfcipa.exe
1008	Eadopc32.exe
4388	Ehnglm32.exe
548	Fkmchi32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ojgbfocc.exe	Nnqbanmo.exe
File created	C:\Windows\SysWOW64\Ijcoimpn.dll	Gbdgfa32.exe
File created	C:\Windows\SysWOW64\Cjinkg32.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Elppfmoo.exe	Eefhjc32.exe
File created	C:\Windows\SysWOW64\Bnecbhin.dll	Medgncoe.exe
File created	C:\Windows\SysWOW64\Baacma32.dll	Ampkof32.exe
File created	C:\Windows\SysWOW64\Anfmjhmd.exe	Afoeiklb.exe
File opened for modification	C:\Windows\SysWOW64\Ojaelm32.exe	Ofeilobp.exe
File created	C:\Windows\SysWOW64\Kmdqgd32.exe	Kemhff32.exe
File opened for modification	C:\Windows\SysWOW64\Kibgmdcn.exe	Kfckahdj.exe
File created	C:\Windows\SysWOW64\Ddbbeade.exe	Dkjmlk32.exe
File created	C:\Windows\SysWOW64\Ohjgdmkj.dll	Flceckoj.exe
File created	C:\Windows\SysWOW64\Ogfilp32.dll	Chjaol32.exe
File created	C:\Windows\SysWOW64\Ahmlgd32.exe	e506aa1d68d200e897aba6f8385a4e40_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Ekjfcipa.exe	Eemnjbaj.exe
File created	C:\Windows\SysWOW64\Kdeoemeg.exe	Klngdpdd.exe
File created	C:\Windows\SysWOW64\Oncmnnje.dll	Pfhfan32.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Afmhck32.exe
File opened for modification	C:\Windows\SysWOW64\Flnlhk32.exe	Faihkbci.exe
File created	C:\Windows\SysWOW64\Qegnoi32.dll	Hcdmga32.exe
File opened for modification	C:\Windows\SysWOW64\Kbfbkj32.exe	Kmijbcpl.exe
File opened for modification	C:\Windows\SysWOW64\Ajhddjfn.exe	Afmhck32.exe
File created	C:\Windows\SysWOW64\Qlgene32.dll	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Bjpaooda.exe	Blmacb32.exe
File opened for modification	C:\Windows\SysWOW64\Kmdqgd32.exe	Kemhff32.exe
File opened for modification	C:\Windows\SysWOW64\Cagobalc.exe	Cjmgfgdf.exe
File opened for modification	C:\Windows\SysWOW64\Iifokh32.exe	Icifbang.exe
File opened for modification	C:\Windows\SysWOW64\Pcijeb32.exe	Pqknig32.exe
File created	C:\Windows\SysWOW64\Iqjikg32.dll	Beihma32.exe
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Bhbopgfn.dll	Njqmepik.exe
File opened for modification	C:\Windows\SysWOW64\Ocgmpccl.exe	Oqhacgdh.exe
File opened for modification	C:\Windows\SysWOW64\Aglemn32.exe	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Dmbcpkhj.dll	Bnnjen32.exe
File opened for modification	C:\Windows\SysWOW64\Chmeobkq.exe	Cacmah32.exe
File created	C:\Windows\SysWOW64\Lcgdbi32.dll	Gkkojgao.exe
File created	C:\Windows\SysWOW64\Gbiaapdf.exe	Gkoiefmj.exe
File opened for modification	C:\Windows\SysWOW64\Icifbang.exe	Ikbnacmd.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Jifhaenk.exe	Jfhlejnh.exe
File created	C:\Windows\SysWOW64\Eikdngcl.dll	Kepelfam.exe
File created	C:\Windows\SysWOW64\Oadacmff.dll	Ojgbfocc.exe
File opened for modification	C:\Windows\SysWOW64\Bnkgeg32.exe	Bganhm32.exe
File opened for modification	C:\Windows\SysWOW64\Bapiabak.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Dejacond.exe	Dmcibama.exe
File opened for modification	C:\Windows\SysWOW64\Bahmfj32.exe	Aniajnnn.exe
File created	C:\Windows\SysWOW64\Boepel32.exe	Blfdia32.exe
File created	C:\Windows\SysWOW64\Ebdijfii.dll	Beglgani.exe
File created	C:\Windows\SysWOW64\Hopnqdan.exe	Hmabdibj.exe
File created	C:\Windows\SysWOW64\Liddbc32.exe	Lffhfh32.exe
File opened for modification	C:\Windows\SysWOW64\Ognpebpj.exe	Odocigqg.exe
File created	C:\Windows\SysWOW64\Lpggmhkg.dll	Cajlhqjp.exe
File opened for modification	C:\Windows\SysWOW64\Ddjejl32.exe	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Pejjde32.dll	Elppfmoo.exe
File created	C:\Windows\SysWOW64\Fcmnpe32.exe	Flceckoj.exe
File created	C:\Windows\SysWOW64\Kfckahdj.exe	Kdeoemeg.exe
File created	C:\Windows\SysWOW64\Aihbcp32.dll	Mlampmdo.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	Bgehcmmm.exe
File created	C:\Windows\SysWOW64\Mgdjapoo.dll	Imdgqfbd.exe
File created	C:\Windows\SysWOW64\Miemjaci.exe	Mgfqmfde.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	Deagdn32.exe
File created	C:\Windows\SysWOW64\Heocnk32.exe	Hbpgbo32.exe
File created	C:\Windows\SysWOW64\Clghpklj.dll	Cnkplejl.exe
File created	C:\Windows\SysWOW64\Chdfonda.dll	Gdjjckag.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9404	9256	WerFault.exe	438

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhbffb32.dll"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfilp32.dll"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbnjmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohkhqj32.dll"	Lphoelqn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlednamo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhccdhqf.dll"	Kfankifm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldanqkki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	e506aa1d68d200e897aba6f8385a4e40_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbgipldd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmijnn32.dll"	Mcmabg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njqmepik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oneklm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcjnop32.dll"	Iifokh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clbcapmm.dll"	Ofqpqo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baacma32.dll"	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acnlgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckedalaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daaicfgd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbnafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcbdhp32.dll"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pcbdco32.dll"	Cecbmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehgqln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfnbea32.dll"	Kmijbcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhgfglco.dll"	Likjcbkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcijeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djnkap32.dll"	Qmkadgpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjghpn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckedalaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eeidoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Heapdjlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dndgjk32.dll"	Iikhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdlbjng.dll"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdmpcdfm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cacmah32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfpbkoql.dll"	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfanhp32.dll"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpjlklok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbdhjm32.dll"	Ngbpidjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ikbnacmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnpllc32.dll"	Nfjjppmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdqgmmjb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iehfdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlcadgkl.dll"	Dhidjpqc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cagobalc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkjmlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjlena32.dll"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnnjen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcmnpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hihbijhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbnjmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chmndlge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fomhdg32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2400	1636	e506aa1d68d200e897aba6f8385a4e40_NeikiAnalytics.exe	82
PID 1636 wrote to memory of 2400	1636	e506aa1d68d200e897aba6f8385a4e40_NeikiAnalytics.exe	82
PID 1636 wrote to memory of 2400	1636	e506aa1d68d200e897aba6f8385a4e40_NeikiAnalytics.exe	82
PID 2400 wrote to memory of 4460	2400	Ahmlgd32.exe	83
PID 2400 wrote to memory of 4460	2400	Ahmlgd32.exe	83
PID 2400 wrote to memory of 4460	2400	Ahmlgd32.exe	83
PID 4460 wrote to memory of 4844	4460	Ajkhdp32.exe	84
PID 4460 wrote to memory of 4844	4460	Ajkhdp32.exe	84
PID 4460 wrote to memory of 4844	4460	Ajkhdp32.exe	84
PID 4844 wrote to memory of 2416	4844	Abbpem32.exe	85
PID 4844 wrote to memory of 2416	4844	Abbpem32.exe	85
PID 4844 wrote to memory of 2416	4844	Abbpem32.exe	85
PID 2416 wrote to memory of 820	2416	Aaepqjpd.exe	86
PID 2416 wrote to memory of 820	2416	Aaepqjpd.exe	86
PID 2416 wrote to memory of 820	2416	Aaepqjpd.exe	86
PID 820 wrote to memory of 4128	820	Aniajnnn.exe	87
PID 820 wrote to memory of 4128	820	Aniajnnn.exe	87
PID 820 wrote to memory of 4128	820	Aniajnnn.exe	87
PID 4128 wrote to memory of 2368	4128	Bahmfj32.exe	88
PID 4128 wrote to memory of 2368	4128	Bahmfj32.exe	88
PID 4128 wrote to memory of 2368	4128	Bahmfj32.exe	88
PID 2368 wrote to memory of 928	2368	Blmacb32.exe	89
PID 2368 wrote to memory of 928	2368	Blmacb32.exe	89
PID 2368 wrote to memory of 928	2368	Blmacb32.exe	89
PID 928 wrote to memory of 3536	928	Bjpaooda.exe	90
PID 928 wrote to memory of 3536	928	Bjpaooda.exe	90
PID 928 wrote to memory of 3536	928	Bjpaooda.exe	90
PID 3536 wrote to memory of 4972	3536	Bbgipldd.exe	91
PID 3536 wrote to memory of 4972	3536	Bbgipldd.exe	91
PID 3536 wrote to memory of 4972	3536	Bbgipldd.exe	91
PID 4972 wrote to memory of 2112	4972	Blpnib32.exe	92
PID 4972 wrote to memory of 2112	4972	Blpnib32.exe	92
PID 4972 wrote to memory of 2112	4972	Blpnib32.exe	92
PID 2112 wrote to memory of 1352	2112	Bnnjen32.exe	93
PID 2112 wrote to memory of 1352	2112	Bnnjen32.exe	93
PID 2112 wrote to memory of 1352	2112	Bnnjen32.exe	93
PID 1352 wrote to memory of 4816	1352	Behbag32.exe	94
PID 1352 wrote to memory of 4816	1352	Behbag32.exe	94
PID 1352 wrote to memory of 4816	1352	Behbag32.exe	94
PID 4816 wrote to memory of 4216	4816	Bhfonc32.exe	95
PID 4816 wrote to memory of 4216	4816	Bhfonc32.exe	95
PID 4816 wrote to memory of 4216	4816	Bhfonc32.exe	95
PID 4216 wrote to memory of 1328	4216	Bjdkjo32.exe	96
PID 4216 wrote to memory of 1328	4216	Bjdkjo32.exe	96
PID 4216 wrote to memory of 1328	4216	Bjdkjo32.exe	96
PID 1328 wrote to memory of 4764	1328	Baocghgi.exe	97
PID 1328 wrote to memory of 4764	1328	Baocghgi.exe	97
PID 1328 wrote to memory of 4764	1328	Baocghgi.exe	97
PID 4764 wrote to memory of 3708	4764	Bdmpcdfm.exe	98
PID 4764 wrote to memory of 3708	4764	Bdmpcdfm.exe	98
PID 4764 wrote to memory of 3708	4764	Bdmpcdfm.exe	98
PID 3708 wrote to memory of 2272	3708	Bjghpn32.exe	99
PID 3708 wrote to memory of 2272	3708	Bjghpn32.exe	99
PID 3708 wrote to memory of 2272	3708	Bjghpn32.exe	99
PID 2272 wrote to memory of 3084	2272	Baaplhef.exe	100
PID 2272 wrote to memory of 3084	2272	Baaplhef.exe	100
PID 2272 wrote to memory of 3084	2272	Baaplhef.exe	100
PID 3084 wrote to memory of 2556	3084	Bdolhc32.exe	101
PID 3084 wrote to memory of 2556	3084	Bdolhc32.exe	101
PID 3084 wrote to memory of 2556	3084	Bdolhc32.exe	101
PID 2556 wrote to memory of 512	2556	Blfdia32.exe	102
PID 2556 wrote to memory of 512	2556	Blfdia32.exe	102
PID 2556 wrote to memory of 512	2556	Blfdia32.exe	102
PID 512 wrote to memory of 4952	512	Boepel32.exe	103

C:\Users\Admin\AppData\Local\Temp\e506aa1d68d200e897aba6f8385a4e40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e506aa1d68d200e897aba6f8385a4e40_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\Ahmlgd32.exe
  C:\Windows\system32\Ahmlgd32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\Ajkhdp32.exe
    C:\Windows\system32\Ajkhdp32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\SysWOW64\Abbpem32.exe
      C:\Windows\system32\Abbpem32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4844
    - - C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2416
      - C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:820
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2368
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:928
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3536
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2112
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1352
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4216
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1328
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3708
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:512
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4952
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2600
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        25⤵
        Executes dropped EXE
        
        PID:4680
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        26⤵
        Executes dropped EXE
        
        PID:3608
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        27⤵
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        28⤵
        Executes dropped EXE
        
        PID:4260
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4648
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        30⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        31⤵
        Executes dropped EXE
        
        PID:3700
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        32⤵
        Executes dropped EXE
        
        PID:1596
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        33⤵
        Executes dropped EXE
        
        PID:1180
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        34⤵
        Executes dropped EXE
        
        PID:4308
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4800
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        36⤵
        Modifies registry class
        
        PID:4368
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2828
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1176
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2900
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        40⤵
        Executes dropped EXE
        
        PID:3612
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1380
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        42⤵
        Executes dropped EXE
        
        PID:1216
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        43⤵
        Executes dropped EXE
        
        PID:2576
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        44⤵
        Executes dropped EXE
        
        PID:736
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        45⤵
        Executes dropped EXE
        
        PID:1664
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        46⤵
        Executes dropped EXE
        
        PID:812
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        47⤵
        Executes dropped EXE
        
        PID:1260
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        48⤵
        Executes dropped EXE
        
        PID:1764
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        49⤵
        Executes dropped EXE
        
        PID:2452
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        50⤵
        Executes dropped EXE
        
        PID:4620
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2292
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:64
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4820
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        54⤵
        Executes dropped EXE
        
        PID:1280
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3416
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:640
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        57⤵
        Executes dropped EXE
        
        PID:4112
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        58⤵
        Executes dropped EXE
        
        PID:4116
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        59⤵
        Executes dropped EXE
        
        PID:3456
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1532
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        61⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5048
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        63⤵
        Executes dropped EXE
        
        PID:2692
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        64⤵
        Executes dropped EXE
        
        PID:1008
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4388
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        66⤵
        Executes dropped EXE
        
        PID:548
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        67⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        68⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        69⤵
        Drops file in System32 directory
        
        PID:1600
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        70⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        71⤵
        Modifies registry class
        
        PID:2920
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        72⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        73⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        74⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        75⤵
        Modifies registry class
        
        PID:2760
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        76⤵
        
        PID:264
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        77⤵
        Drops file in System32 directory
        
        PID:2636
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2892
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        79⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1740
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        81⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        82⤵
        Modifies registry class
        
        PID:4876
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        83⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        84⤵
        Drops file in System32 directory
        
        PID:2708
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        85⤵
        Drops file in System32 directory
        
        PID:440
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        86⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3032
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        88⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4336
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        90⤵
        Drops file in System32 directory
        
        PID:2092
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        91⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        92⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        93⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        94⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        95⤵
        Drops file in System32 directory
        
        PID:5232
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5272
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        97⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        98⤵
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        99⤵
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        100⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        101⤵
        Drops file in System32 directory
        
        PID:5544
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5592
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        103⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5708
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5768
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        106⤵
        Modifies registry class
        
        PID:5828
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        107⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5928
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        109⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        110⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        111⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6096
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        113⤵
        Drops file in System32 directory
        
        PID:4836
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        114⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5264
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        116⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        117⤵
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5536
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        119⤵
        Drops file in System32 directory
        
        PID:5616
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        120⤵
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        121⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        122⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        123⤵
        Drops file in System32 directory
        
        PID:5980
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        124⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        125⤵
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        126⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        127⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        128⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        129⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        130⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        131⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        132⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        133⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5280
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        136⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        137⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4696
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5364
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5796
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        141⤵
        Drops file in System32 directory
        
        PID:6092
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        142⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        143⤵
        Modifies registry class
        
        PID:5152
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        144⤵
        Modifies registry class
        
        PID:5476
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        145⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        146⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        147⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        148⤵
        Drops file in System32 directory
        
        PID:6288
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        149⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        150⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        151⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        152⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6460
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        153⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        154⤵
        Modifies registry class
        
        PID:6548
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        155⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        156⤵
        Drops file in System32 directory
        
        PID:6628
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        157⤵
        Drops file in System32 directory
        
        PID:6672
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        158⤵
        Drops file in System32 directory
        
        PID:6716
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        159⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        160⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6844
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        162⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        163⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        164⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        165⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        166⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        167⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        168⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6184
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        170⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        171⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        172⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        173⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        174⤵
        Modifies registry class
        
        PID:6528
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        175⤵
        Modifies registry class
        
        PID:6620
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        176⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6744
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6812
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        179⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        180⤵
        Drops file in System32 directory
        
        PID:6972
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        181⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        182⤵
        Modifies registry class
        
        PID:7160
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6208
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6324
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        185⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6608
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        187⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        188⤵
        Drops file in System32 directory
        
        PID:6828
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        189⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        190⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        191⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        192⤵
        Modifies registry class
        
        PID:6440
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        193⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        194⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        195⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        196⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        197⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6792
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        199⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        200⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        201⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        202⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        203⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7212
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        205⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        206⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        207⤵
        Modifies registry class
        
        PID:7340
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        208⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7380
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7424
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        210⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        211⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        212⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        213⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7648
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        215⤵
        Drops file in System32 directory
        
        PID:7692
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        216⤵
        Drops file in System32 directory
        
        PID:7736
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        217⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7820
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        219⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        220⤵
        Modifies registry class
        
        PID:7908
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7956
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        222⤵
        Drops file in System32 directory
        
        PID:8000
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        223⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        224⤵
        Modifies registry class
        
        PID:8084
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        225⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        226⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        227⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        228⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        229⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        230⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        231⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        232⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7596
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        233⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        234⤵
        Drops file in System32 directory
        
        PID:7752
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        235⤵
        Modifies registry class
        
        PID:7828
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        236⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        237⤵
        Drops file in System32 directory
        
        PID:7964
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        238⤵
        Modifies registry class
        
        PID:8032
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        239⤵
        Drops file in System32 directory
        
        PID:8104
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8164
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        241⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        242⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        243⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7580
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        245⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7812
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        247⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        248⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8144
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7276
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        251⤵
        Modifies registry class
        
        PID:7412
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        252⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        253⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        254⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        255⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7492
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        257⤵
        Modifies registry class
        
        PID:7784
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        258⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        259⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7872
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7288
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        262⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        263⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        264⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8268
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        266⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8364
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        268⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8448
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        270⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        271⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        272⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        273⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8680
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        275⤵
        Modifies registry class
        
        PID:8732
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        276⤵
        Drops file in System32 directory
        
        PID:8772
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        277⤵
        Modifies registry class
        
        PID:8820
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        278⤵
        Modifies registry class
        
        PID:8860
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        279⤵
        Drops file in System32 directory
        
        PID:8920
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8976
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9032
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        282⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        283⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        284⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        285⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        286⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        287⤵
        Modifies registry class
        
        PID:8304
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        288⤵
        Modifies registry class
        
        PID:8356
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        289⤵
        Drops file in System32 directory
        
        PID:8436
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        290⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        291⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        292⤵
        Modifies registry class
        
        PID:8668
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        293⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        294⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        295⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        296⤵
        Drops file in System32 directory
        
        PID:9008
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        297⤵
        Drops file in System32 directory
        
        PID:9072
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        298⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        299⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        300⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        301⤵
        Drops file in System32 directory
        
        PID:8384
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        302⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        303⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        304⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8720
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        305⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8960
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        307⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9092
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        308⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        309⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8444
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        311⤵
        Modifies registry class
        
        PID:8636
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        312⤵
        Modifies registry class
        
        PID:8852
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        313⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        314⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        315⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        316⤵
        Drops file in System32 directory
        
        PID:8788
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        317⤵
        Modifies registry class
        
        PID:8932
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        318⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8432
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        319⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        320⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        321⤵
        Drops file in System32 directory
        
        PID:8280
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        322⤵
        Drops file in System32 directory
        
        PID:8568
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        323⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        324⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        325⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        326⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9388
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        327⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9476
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        329⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        330⤵
        Drops file in System32 directory
        
        PID:9556
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        331⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        332⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        333⤵
        Drops file in System32 directory
        
        PID:9688
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        334⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        335⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        336⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9864
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        338⤵
        Drops file in System32 directory
        
        PID:9912
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        339⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        340⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        341⤵
        Modifies registry class
        
        PID:10040
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        342⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        343⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        344⤵
        Drops file in System32 directory
        
        PID:10164
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        345⤵
        Modifies registry class
        
        PID:10208
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        346⤵
        Modifies registry class
        
        PID:9028
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        347⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        348⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9256 -s 404
        349⤵
        Program crash
        
        PID:9404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 9256 -ip 9256
1⤵
PID:9376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaepqjpd.exe

Filesize
92KB

MD5
363a5c2bfee32b4eb718ad00d04c3692

SHA1
a024529a311c2d8ed2d112e77479f9f1a8f5f04c

SHA256
d206a54c64fc2640f39adb3bc65bb07071ab1346d52633c0cc470a04de354cb5

SHA512
82cf67e0d1a705c0c642528b755d9aabdf18d0a20a560478faf3ec93b3bf324124a0f88c9d7e6c73705a124d1e724e770c67bc38ad28f9b52d9094cb66ae9bf9

Download Submit
C:\Windows\SysWOW64\Abbpem32.exe

Filesize
92KB

MD5
8587993c1e15d79baf35515f0b4f0946

SHA1
0ca7db0f6a7b392428a4eff8821a4b30e7f82ba7

SHA256
051adcbbd8069f67c62eaca88fff71678473fe95351af7831fddaa964256a12b

SHA512
b0f6fb737bbf3ea2d85d9c641fa19a0bbd61745df233d310ce3703e93a48ab8a20c52fa42959734e0cfd0a33a67fa4cf388b98f7ed400e96ce525e6b2d51f3a3

Download Submit
C:\Windows\SysWOW64\Ahmlgd32.exe

Filesize
92KB

MD5
1316d94a26a2a9fef5938de05f562064

SHA1
37a5a4c6a61c7a071e352a492e9458b19e1eedb3

SHA256
08f5a0ca5b7741d689e31860a54145928c70bd16ce45032a04d748fdaab7e0ba

SHA512
3893e1a5ee2e9d913c274a0339ae4d9fd425ed8d4f892a690595d08af08dbd632973112616a0059952918b2cd217259b57d2e1af8cf136548ef980b2778c9a5b

Download Submit
C:\Windows\SysWOW64\Ajkhdp32.exe

Filesize
92KB

MD5
47997cc66de94280adb7872b832fb954

SHA1
1ece68d19622436e4a817392d0d542790de52394

SHA256
1fec028ac0dadaf0f4b9c1d724ef9195b201cd34a272fe9b982e5336d2cd41d6

SHA512
b62d1b7f748eed45a9ccd3fd9fd4ebb844979efca4c4a3d380612cd1636108b3116798c8c8822205a324a4c445f9791a3de026f1870276d70f9d8d91a45a30cd

Download Submit
C:\Windows\SysWOW64\Aniajnnn.exe

Filesize
92KB

MD5
d197439b9ef4cdc8b5e1673f9441bef7

SHA1
aeec93af50ccca5bbd1853663201b0a4e885d6d4

SHA256
08fe4aff74de4c583bc3ba63f86093ed3495553fc520fffaf4457e62750965aa

SHA512
c951b0318c6cd29c6b8c43eb3f1d665de2df787624771d53abb0382537eb57a30a144f9aa9ab5bf716eb796493c4a943d7b7e47288103c575927df0228041dc1

Download Submit
C:\Windows\SysWOW64\Baaplhef.exe

Filesize
92KB

MD5
04c2e72fff7d7468698dca0d4fe7b695

SHA1
e34cd21a5809bda9dbc840cdc901a14c3879540b

SHA256
bfe1db2194c5d25cb0c7209ab1e1cfde3a9c6fe2021cfa7f2ed195ce3797094f

SHA512
e45145e8f46a9816fb1e6a36c7ac865a90d6fceb2cfa07b0efd6f530d0542f82bff59d5ba0ae05729f52fb0dfd6c6d7af5eb06cecab449cd495f9dc958babe7d

Download Submit
C:\Windows\SysWOW64\Bahmfj32.exe

Filesize
92KB

MD5
eb1fe56a68984be136340b8036d2b4c2

SHA1
399d136aeb31ffbafc0fe6531ed55f612a7b6adc

SHA256
ead5441b58e8d1fbc39874cfa343a5814a55bba6efa02963bc8f04c0285ac6ea

SHA512
a855272d9e2c70eaa296ba71e1bdf315c0eeec4e0ee5e814c3068f6a78401d5f583fcf77fdd2dc146fda4203fb2e5b52fb4b19a9dcce310dff89bb69fe2b9a25

Download Submit
C:\Windows\SysWOW64\Baocghgi.exe

Filesize
92KB

MD5
31d79489a6e6258184604e92a1e8adf4

SHA1
570998c592e4b8b56f91a0eb5b6531868c9f9429

SHA256
213bffa6f22055b5a1f4e4b304282f323d270350718c8848ec81875480994d47

SHA512
bd68c7b6c3f04b8813d7996dd635195a00b0c7b878a539ada17f7e11d15bb3c033f64502ee5bc1098e589f40d0cea667ad0ccd9e18d47f9f16398661d6de9244

Download Submit
C:\Windows\SysWOW64\Bbgipldd.exe

Filesize
92KB

MD5
49678ea4099e22268fce52c2bec8da9e

SHA1
01945f3c32bf015876ce32d30baa095381553c98

SHA256
ce5fd7a514c99d08662994b9eacf9a8c0b6e517b64be936811c670abad05061e

SHA512
fa0e8847cbfc41ec209b97b7de631cb18f4de7508adad03623a30694ed8893a41dd28e0ee9eaf31c6eec685aef1de9b60240e6fd43aa053e0ea8ba1b13e7a446

Download Submit
C:\Windows\SysWOW64\Bdmpcdfm.exe

Filesize
92KB

MD5
df76b7e085488c68bd60c052f17101a2

SHA1
11d502492676882a6fdcbdd739536f27579ab971

SHA256
a54ae4713e314334c74524e13a3c06c825fd10e03b3dd95c3df863db74e1635c

SHA512
b7984317f877e03a9cbfed345213cd2ac10bab093c60ecbccaf059e68714d4b7edd168497143d232d10c911d687ea5dc32bd342d199d93bf0e3bb67119ed1b3c

Download Submit
C:\Windows\SysWOW64\Bdolhc32.exe

Filesize
92KB

MD5
2aea7729140aba184a2fbb180381b913

SHA1
bba701cd3f1262270e606957f9e7555c6b37610c

SHA256
1fdcaa69274c1f5cdfde58262a73583e2784589b02a1219ceccf743371be667f

SHA512
9dd7fc44b4b9d46b288aebb447394c23a20b44d6719a9aa4fc088d314fa1239a7d38013285549f9d0e085b3ab2ad5e465595e20700caca84ea7a9702099898fe

Download Submit
C:\Windows\SysWOW64\Behbag32.exe

Filesize
92KB

MD5
cb361f103f1980647da2377388d0f99d

SHA1
8945aa5be582451ce64048a9143ffe24fa23e7d2

SHA256
a0456120aeea351a201f1d91dc076e52c8f271f3e2660844172a2bb74bee1a1c

SHA512
d3fe5caeae23c3db50e6c90123fa3145d0658e6314484cfafd144bdeb5b738cbabaf768a655ac1dc5463a107ee114d53913f1194638777acb471edce03a93c1d

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
92KB

MD5
c55eaefb60403560fecb30e304d953d5

SHA1
3acc7d7dafbb9794b967c1ccd522049f3de758dd

SHA256
0c59f3e3c7148405f41fcf131260c9edb936bb0c4365eb9c1562881087063dde

SHA512
3e8dde87702de152b79f57fc91555f770c28a3dc7505a181b83e767db6d0c72ec487042d06766e0d1f4bf502aac9c0616e4bf7a742ecbae117383b5c65cc3fef

Download Submit
C:\Windows\SysWOW64\Bganhm32.exe

Filesize
92KB

MD5
617d30ae747ac8108d96ddd8a6ee7b2a

SHA1
a5ac93340209bb604fb5898e770ae99b628cc09d

SHA256
ef42d8bddac6121c777a05c3b6033552f7b068f0c98ed3967d0eb2a6ef3f1435

SHA512
b0a1bed17303875d7030010bfee19f8a569acea66e39067afa668adc93ded4dcd994bb5aa84288efc5bf67f7d21981624b814ec31d4554a50d013013dd81ee5d

Download Submit
C:\Windows\SysWOW64\Bhfonc32.exe

Filesize
92KB

MD5
8846fb37f386ad5ab5e534b4dae3a642

SHA1
6f1c7350061bc54f826b82189116332d871165f4

SHA256
b1f2f20f35625da5c1dc31722ec32f51f2fa1670d9d12c6584639de559d69ece

SHA512
314fa0942c34797bdc50eb0755f6d99c130df99c2a2380b50a8564b1037fb748fccf3e8a924fc697b7a543f849a97062f2cdc82d8cbb39daf971a37d37eef469

Download Submit
C:\Windows\SysWOW64\Bjdkjo32.exe

Filesize
92KB

MD5
4ec8ef919dca9ae7e4f81bfa357505ca

SHA1
54b7b6c37adcdbd061855b6e39a30ee537384a27

SHA256
6f5c4faaa2593c677a1906c18b2cd008c175b14ca636592393c0039d15477aeb

SHA512
2fd22e4375da3279f201b5ab602d38c58b46071310982584bd8fcd2375dde42c2952b98818f0a5088707ab6f4b60ddc448bf04bb13e08e2b68b8b064ee03c167

Download Submit
C:\Windows\SysWOW64\Bjghpn32.exe

Filesize
92KB

MD5
a597e2d90e9c6f763640b1b43e692c31

SHA1
38765371b2f4b2f7ddbe203fe55e2ce3403408be

SHA256
f720d27f048f407b54a5e4c40ba16fa95f93d8215951a80aaff7d62c3bfd52e1

SHA512
db59faa117a5f9832203c4567a0dd580462de68b3af98c9a850a4ab148677c6af04bf582b2ff260a7b53061621c2870dbb1bf89bb02512a6410a27d6d0740302

Download Submit
C:\Windows\SysWOW64\Bjpaooda.exe

Filesize
92KB

MD5
278c8d6febe0ad46ffc1985b5e4d1599

SHA1
5ace2aa0d538004118c74239fa69455febd9a0f6

SHA256
ef33df9c85753926c8513a30881387c3a03cd5a58ce74e922b393fc8225872e5

SHA512
cc33b139454f12f062c9bbab2924e72b300e1dbe416d556e02c11f7c131f66f0395884bf7da85546b0d3f1f2d255fc80f2e511792574118f710ff02b4d81f4b2

Download Submit
C:\Windows\SysWOW64\Blfdia32.exe

Filesize
92KB

MD5
e7f5240425f3992b50b32c3807f7e8dd

SHA1
a0cb18b9480de8f92c27d6943e7bd840aaf0a5dd

SHA256
738716ac6389b0ef1e5a0e85f4043b3740c892d414688cd9fe46438eb51d32f5

SHA512
e5f21dba58d3b01671717cda2ceb5a23d6c2ee6988c397b3099425962093986dc4cde4b975ae260c857013d5d0333cb37d117eed8384e69b2a8d2f6fe4135d54

Download Submit
C:\Windows\SysWOW64\Blmacb32.exe

Filesize
92KB

MD5
f0bc69af7b53880610143175f154d1b4

SHA1
27703a508b22c422b7cd1d7f3e6aca18f36826ea

SHA256
c2d2a046087cda8aced301712e8b28819776b902f240921b2a1ca53a6aee4aec

SHA512
4e8f045f1b001c3f7ccc62ba5a3c7d9ac2299ac018ebeaa095c62ba632f9bd9f8b0caf2c2336448ca0349365e3090002c92943cbceaa86f7d866d3380dbe173e

Download Submit
C:\Windows\SysWOW64\Blpnib32.exe

Filesize
92KB

MD5
23c99035d6af45ba8ba4bc73a0a14978

SHA1
f63692a9656bab6de22e1fca5103bfcb1a38830c

SHA256
d7edd56b52d479c1f44793f3776e7efa87345fea4fc18ee358b15df14c680478

SHA512
2a4b8156d39e5bfc6ac7cc623b41cd8e27e0f975e461ef89c63d9231e776e7aa4e074bf016a1f5a95042020befdbe7982715b9ac96c86b02ed1013df84f70f49

Download Submit
C:\Windows\SysWOW64\Bnnjen32.exe

Filesize
92KB

MD5
1f6d6e4b8d357037a7eca36d0312c3a8

SHA1
b7313e5cd8ad5e394a517cc1abc08258f790c0fa

SHA256
62c1ad390943cc4b34e73242e84c520f4aab2eed1b8f9e369902189ee087d95f

SHA512
3fce55ffa4a466598b2ce0aa092cab088627159d6dc9bb4275b2b7093071b434a72ecb73975ecb6e4236cf139eb388719272bc272c0f6dbdcad4b76c11899891

Download Submit
C:\Windows\SysWOW64\Boepel32.exe

Filesize
92KB

MD5
6c3324c4d686b0b21508ad4bdff6e405

SHA1
ea4b7e9614f12280f7afb18291f282f6f57ca02b

SHA256
063f13440b4e2b9f71f58f91ff0b8a66290fecf4b63b3ef12e48cb3783893942

SHA512
05045a8f2c9a8335d943b21039828e2f142ec1da31caf16e2994c060559c76c4a111a76420032850782113302917b18c008bba42ac2b2e2ec9d081e209a99db5

Download Submit
C:\Windows\SysWOW64\Cacmah32.exe

Filesize
92KB

MD5
1149cfeaecebab6893dd7a9de4b9e840

SHA1
2ccfbd5d703a2cfc867c7bc6df68c94b34735b88

SHA256
8447d4da978e806d34ec5117c63e1f3cd974e3481d13b151ebbabe7da1a74b2d

SHA512
6dad7bbcc2d7bd2810420f69a27b7038643f07ddaa9a9d60f113ab9473eb5364e359789b583b41a2d80a9486d1df43cf41c0abe6ea8104ca0c01f2f4270dd44a

Download Submit
C:\Windows\SysWOW64\Cafigg32.exe

Filesize
92KB

MD5
3048023587f34f294c81308efa1a33f7

SHA1
fa7cee7a2d654929d7f09b6fe0346af48a6feb28

SHA256
fd4cc8fa61042e431d1add47368aa3674ba51728ca16614dd2e03f67c3f456a2

SHA512
b783c9f814bb0cae59c60f43bb6e99352cedd407326749145c5a0c0cf5e94f2cbc2119f53c00cc978fe95559a3ad8c08dc763fad4f5f93f248a8d023809afd50

Download Submit
C:\Windows\SysWOW64\Cbefaj32.exe

Filesize
92KB

MD5
48f60ddbe14740c3e1fb61dc6b4b71df

SHA1
8fa7c882613a19c509553aa1c6f3ea253eed9ccc

SHA256
08f9728f540fdf48ca3bed62df8d13299652270bf26ec5b9a4b1d52f47a28e33

SHA512
d4e6fac970ed5342fcea65c42f1eeb385e7c89d674b2d4c46ff8451de03b42ed0629d0fab62717e770b397c5921e784922a1b52c813cc84fe8a1eacc5b483f9c

Download Submit
C:\Windows\SysWOW64\Cbgbgj32.exe

Filesize
92KB

MD5
928bbbf1e04c9f14c02cb6a4818a7af8

SHA1
bf98f10b969c71636d357fb1f0dc269e13b7b50d

SHA256
22f4190db9dcf7e41febb5ae09a26a964affc5188f52ab321c0548ae8daacfa8

SHA512
0202411c4d0b4a3574223828d4156d0af77a3d4ae247c21f9a8cb844fc891ca2bf933c85e6cf7145cd07359f464316b32adebc3cfbc87dd5b52e0a3f7d557a15

Download Submit
C:\Windows\SysWOW64\Cddecc32.exe

Filesize
92KB

MD5
796f8ae7f8a6bc3be9b53b9f7adf2d66

SHA1
9799304f69087a9b1e3edc96cc04074201ed81ab

SHA256
1d30009e28e6afde5f7d14c060f61d69ffccbf4ccd054d40b96ea1fbb4b8430e

SHA512
104240aba80854f6892df1df420e407120b87921e9d73b145004b66b416d0a26f82570d2ab7bd3fbef51da3b60c89269030ef02de8f97f6f8c71943afdd5aaf1

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
92KB

MD5
1b85356ff8afeebd1068de906d476c92

SHA1
992e5887097dbb7cdad4644616a9b6d1e9c4c84c

SHA256
4b7ce68d40f8b03063e9980a5ae36a409c01b2c2779d61c7e6ffeb7e6dac2895

SHA512
a98c9b95311cfba310b654ea18f11eb96683241c6a7f69111e7d1a03db55c64a5a0508f97218dbe7d700a6de5d6fb916d4c9f3add200cfe9a311cc914b4a59dd

Download Submit
C:\Windows\SysWOW64\Cdiooblp.exe

Filesize
92KB

MD5
de80162cbdea3ff564cf3413baa86e70

SHA1
c35a49b022ec6162a93626822842545976d7bf15

SHA256
1da959543f0f1675abb400980796cd541ec1ef0d9f664879a77b6c6ccc5c23eb

SHA512
ffe018ca38930193421fc59502725123e3b6ff4a3bf64e92f20f2dca60269ac4de6bf153facb5f4d9a038ea5885ab454dd7597b06cb55792f2106d03d689f8b5

Download Submit
C:\Windows\SysWOW64\Cecbmf32.exe

Filesize
92KB

MD5
ec6fb7ad2361f975753f5e551af8183d

SHA1
a09e661613c07b274b2f7ec40514572a21348a84

SHA256
c4b9d0f3587485b6248141caf7b582c2c49aab5afabe08cd3863d9561249b02b

SHA512
efd23e12a0f8a533e65575ef56c07d3940da79305b01856a55e0774ef0585c5b39aa1f26690560abf0efc665d16568dce224b0001d3c722eb61fb40d39d3e941

Download Submit
C:\Windows\SysWOW64\Cefoce32.exe

Filesize
92KB

MD5
b10757cd9c4954a30c996fad1a8ef793

SHA1
e8a73e760ed809215133a96d02cadcd7ae92c393

SHA256
715ab7c9dcd77bc36c810ea40faa9a116853c8d97390a7491fe794981e7a54bb

SHA512
fb154612ecc4f3f893f4f7fc7a40d6b5f78fa0e232204238a1b8447f11a44f1253bf1e01cdff8fc21b2be65bb541714fb85aeaeadfb86e53fe32610733d3eae7

Download Submit
C:\Windows\SysWOW64\Chbnia32.exe

Filesize
92KB

MD5
4aead4e0ba6e0a4dd2587b600d73b5ad

SHA1
d57b725189732314be3bd6cb5e4144acc8a8957a

SHA256
453219f5bf39dc18576b79910743a75f4de0fc901a8b8a8cc78bf1fca8553c5e

SHA512
03ca33f9f951043e800cb62880076f967c147c737795bf027ee447028a7b2e0d78b3ad35feff576262f619bff6ca6f144b52bb76a21ec583f9c607d35319644a

Download Submit
C:\Windows\SysWOW64\Chmeobkq.exe

Filesize
92KB

MD5
cf36c9843aef8f9ebccf31300ec77b27

SHA1
31cc6c2f5da4c466b17200e0a7fcfe22ced4d02e

SHA256
1ae029430b5c98e4f9ddadae83f93b9953cbc3e85da9aae850413ac1dc6b0dde

SHA512
b569d6c808cdbe2a6f05aff5ec5584cef20f825e120551ae1c4ecbe7fc56facc1b49f233e29fcc1531ba0f2f1ceaf0c5d78dec35fadabfe157eb197988f9f68a

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
92KB

MD5
b76b3000f633731b59fb3ad0e9145247

SHA1
bcd92fdc9e3c4f70fc65ddbeeee5c84b75a2402a

SHA256
609c12219f89c3493b89fb9605f90d3964cce645db62acbf5c0092186e18f5bf

SHA512
934b73e8739102aad506332346cd216d37c68eef9cd7b71c29292228d02be7c96263ca2d77a77f57e32f203f77d15a469a26c3e53e78cc53fc5575a28b772c4b

Download Submit
C:\Windows\SysWOW64\Cknnpm32.exe

Filesize
92KB

MD5
8c139b90d43a063103513417507ddd08

SHA1
2e3d15daa57a00880f14ca4a59e3afbc1e14a13d

SHA256
6e8123a96dc43e184d563afe2a5f235b5f687af29d6d57b7d8d797d0232d2188

SHA512
320591f38665e7fac15458aa62ce292f49df04bb18982ea7dc7a3aac22b0687824970ac383d02e6260596b6bdbeb788274fac1ff281e7964b822ab6473b5b26c

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
92KB

MD5
63ac2e268556deb9b656077fedd24395

SHA1
dbf230041ad1556d2fb5ae0cb49112ad6ad18a31

SHA256
924ca7b5bbf831ad8614ab7a3abd3ba95e20db6abc1d016b96292971970a1e56

SHA512
f2ffa34f86fa1cfc6ca44eb92926c2deda34f4830fd515ff869ea115a23ad76e42da16be40919804270137857ad2057123171316963ac4ca291cbd5a5f8f2cd1

Download Submit
C:\Windows\SysWOW64\Ddbbeade.exe

Filesize
92KB

MD5
ad4f3a9c920fbc021906cff46831936b

SHA1
731c2f6a04272481bbdaa930eb9059a2a98107d2

SHA256
18eba495cd0e9b24777c2130f9136f1d8501fcd740685113f32971ceb77cbc7c

SHA512
7af5db879ae002dd467a2a29771d3dec9bfc76f7fdd0b3a9648b1498e384ad9fac70f2ab481e2cfe17b580cbcad11d70b7b2b5dda325d58227411e839baf26a0

Download Submit
C:\Windows\SysWOW64\Faihkbci.exe

Filesize
92KB

MD5
4d136c1b99f65837fca1aa9089439120

SHA1
7bfd3d452c323fab32528eb3ae2d3b151a692a79

SHA256
dae1dbe20adb612692798aee34548e9aebca948cd06daf86e8d3c98358afaffd

SHA512
0e2df996d5adf9d89cbded4133d538975d1464599534933e658161cab4545bf2bd581ed51b9846a9f499a1b89e7f996607812a05403760485c32614bfc8009bc

Download Submit
C:\Windows\SysWOW64\Fcmnpe32.exe

Filesize
92KB

MD5
930acf7d2f2bcaa9bf47025a357778ce

SHA1
4c372378c50645cac894c8aa967a269061f99188

SHA256
a7a5dc4e39f7b08df6efa5d247bdeed18b83ba3bb1fa860bc7de129992975a99

SHA512
59d48f389a9f295c4857210703694e29e682e96e0b01e8ffed6f8ff7d3cf7375b577bf2ee0c3d356273cd81654d595a796d52ac477f2e85ad21353d85742c7bb

Download Submit
C:\Windows\SysWOW64\Ibcmom32.exe

Filesize
92KB

MD5
a31dfa958b5797d98afb4789b3401fa0

SHA1
2c8309d1344957a44294e3e004885a82e2af6415

SHA256
2fed43c909e1333e894d46cf05fe7be3ab67a61e9787e53b60459418ae788789

SHA512
0af08bb6016a4b2f50a8d72942d65da763b579addfbc7413f2b3c6e9d3679920a3e70bed2d049ce5505b4f33fc34bccadd8fa70a39d8528ac96dfba0655580b1

Download Submit
C:\Windows\SysWOW64\Jcbihpel.exe

Filesize
92KB

MD5
ed2b5642b1d3198d0915e8398b4ab345

SHA1
9287fced9580c5fa77c76939f91d20720e54ebbf

SHA256
f9d5cacd3c8360c6bf9a49582e056f05454aa874dfb7d8ede1f5e921336d227a

SHA512
01f413a38372f5d689d774f4de604b6104c8eda0b93cb3e5b95bddeb2b043c12b000e4ca316cb0702aab3b5b4172add65a2b0e22d538bdfc07f05cfbfd5651cd

Download Submit
C:\Windows\SysWOW64\Jcllonma.exe

Filesize
92KB

MD5
e695183db37ccebe7045fc42d1c57f38

SHA1
8552c6ee51f7364d01d393de378879a5d08349d8

SHA256
2964a7c93d064d1e12465262aa90eac0acc868b5f96ee9cb3bc73e7677bda3dc

SHA512
fa7fae096c48b0fd18ff8084a9d97a84ba1c2bc0058a6f0ecfbb4fa8c78149483e59d16231c62c6f2242ba59d3f84672b5f23e995662a9a505f9921c4acdceb3

Download Submit
C:\Windows\SysWOW64\Jfhlejnh.exe

Filesize
92KB

MD5
fc310c1f7619c42bc94a4431dac3a808

SHA1
bc497d580ff8d4a09170bb0d66a5bae2d27acee3

SHA256
564ee87be5627772b1a87bee236880cc90db262e04cd8bf00599f09048ba81b8

SHA512
898e54621afa3b3af421a3859b4293e117549ddbca5569301777f92d5fb53ba3361f3d05b1afe504a960f45eca1d5ab0da431739954c73510d245d3fbb8e04f0

Download Submit
C:\Windows\SysWOW64\Jidklf32.exe

Filesize
92KB

MD5
e5f4eca3390b12b93a064101fdd464e5

SHA1
5ec7aafdfbc57efb1de2bc59e407c56db5b54010

SHA256
addc8eceaa7dc119e935f5effd4a646fd565ceeefe6355660cbd6a3af30c0dce

SHA512
a54f416763a5401a5d7c60d5f8962187cc544a0a0401768211a547daa517eb67c58e634d80fba228aaa1934aabb5ce3c280b823202f627c8e4cd974e889da207

Download Submit
C:\Windows\SysWOW64\Jlnnmb32.exe

Filesize
92KB

MD5
c6128cb3861e599fbb173a695ce652d2

SHA1
aa3d98e724f8fd9c8eec562f77a87d282a7b8bc1

SHA256
c567982552776d857e4654ac652564f20510e2ad34e96ecd35778ec3290c95d5

SHA512
41f70fcfa10c6cc8873cb8926d179f17c8eb27b25ae03de705a79837ab4b0a255c6fa02c4c4720e589951a0888c8a0aab9a4af31fc9821ac5936007b206ec427

Download Submit
C:\Windows\SysWOW64\Kbceejpf.exe

Filesize
92KB

MD5
30b8c2b3295c6136c2dff8dc81325145

SHA1
f196f84b2cfc66b9b349fbecc83cb13f114d8bf1

SHA256
1784f787c36ea0711353c1af4661749fffc007ec5eb42e156dfed2ef15125df8

SHA512
8f3933e61e3f8a084bfd96bb9ca00034b1c24757840c14978c0ad5fb053fdf9dd14b8e3bc86452e7fe484adcb058211ebe65abe9e8e5d769e610a80eae6af48d

Download Submit
C:\Windows\SysWOW64\Ldjhpl32.exe

Filesize
92KB

MD5
3bc8856e8bcd4161a62bc3d8682a88b2

SHA1
8479dd87f33d2fcca92b6098415da943025d99a6

SHA256
a4d358ce8b75d2e03553c36de5ddeb888ae8db0908446fbb0e47a8f0ff5481c9

SHA512
c6041f12864b066d5951e194a33366a4999a6a1404d707813c413efd1b929c4de933f2ed4568b165da8b670853a9544a3815be860cbddfe894043c49b733398f

Download Submit
C:\Windows\SysWOW64\Likjcbkc.exe

Filesize
92KB

MD5
42bb0834a923f950646ceac98725ec3c

SHA1
092ac5c610d6ca8b1ad3a2caf2fb23ac79e3dcf3

SHA256
6954d98def9cfe27f33299d26c205a5401a3add6a9f2c68c3e233914ad8b53f7

SHA512
bc3a36ffa02001992e81e6694e5e1eb2ef73ff7338471da728fd99680d79284deb1605137bd72d735334191651a311885181b6ad39e30cecb2e05310abf1ae12

Download Submit
C:\Windows\SysWOW64\Mdmnlj32.exe

Filesize
92KB

MD5
c75fd878d1952a11e9dd504dde6d1038

SHA1
2712588ded1246e3397163904eb26313aa78de56

SHA256
aa35307389ebaadb105c0daee470c8c7eb6ada35ee1ff7b7f9379e67da89458a

SHA512
8a8c6fdeb1d5a3067b99bfeafc808f3fdd32f7babde5dafb743e0b0b2a1c698ce482c13ca6fab648363a5721fb318d9d0dd77d36d69cc598054c4c1be55ed26d

Download Submit
C:\Windows\SysWOW64\Mlhbal32.exe

Filesize
92KB

MD5
a4306b429f8336020b04883af06d8fdc

SHA1
8b130e7bad4f403cf5621233c8514c59a4f8765d

SHA256
7adc780acab2e5b4517a49957ab582ce45e9f300f14c2aa875819e88a85ebf7f

SHA512
d0da84805f3c66e527fe240d9afcbbef2348e40721a4cee381b18db24df862ebb8378d5bce473cefdf7d8e20d069021ee17772497e109ac417563da19099d370

Download Submit
C:\Windows\SysWOW64\Nngokoej.exe

Filesize
92KB

MD5
7ae73ae64280d69f3734a42956ce577a

SHA1
3d7f3a0ca7c0983d9879ec73fd2426d46e881cf5

SHA256
568e25992cd212f250197c1bbb4f94f59784d58ae22fb950df3cd7e906f80e11

SHA512
7d79d9ae3c6768023c2706f9402897d45fd1cbab8e73e03b33fc13f93459135114f699aa447101f6f788ea4e53c43dc8389aa08e3e0bfd722de4522cef5ce4c0

Download Submit
C:\Windows\SysWOW64\Nnqbanmo.exe

Filesize
92KB

MD5
27552173beb759218151816b681af8c6

SHA1
af7762cf1e89f663872a2d591ff31cee0731abec

SHA256
6fb314361fee0ecfd3b897d16adc910342d210a797a0416b3bfb44d6b758442a

SHA512
3b63cff762fce4a1d7087862cec65bd8979bdf8ee69844c2bb806dd848def7bd05b7c75a299419e50fc01d5bef0bfaff2ed30dcfec6de1ad47bc72410643f9f9

Download Submit
C:\Windows\SysWOW64\Opakbi32.exe

Filesize
92KB

MD5
48f1a4793e6444a081807101219e8ac3

SHA1
05ef3f20e8e0f24ebd1211694368c0fa38b09539

SHA256
d169d9bcbe519af2d9ee22220649f65b231afd4e923a9922d0880b2a37c45ad9

SHA512
9e5e2c4e9c13fe170756ad1e8696aca766a15cacecace05c1f2463d5ea9f07adc7e693c1f21b3e1e4e18e719457d8909c936e200e313889a6179b81df0c1f6d0

Download Submit
C:\Windows\SysWOW64\Pgnilpah.exe

Filesize
92KB

MD5
88da0ced50ffff5e51aa1ca7756cf658

SHA1
7b06694e270bace99863876bc9b4466af1d8c4a8

SHA256
e7a210f62fb8073510aae995a2e63772e3320ac3db65803a4190a1100c81581e

SHA512
2826b3c3bb1dc0a51167273b233ca416d57c5c26111c1c3b0120f829255399eeae9f0f7fbc3d5a9d0cfa98b33ad0d0ca01e8857536b008c6b4491e4f34c7be3d

Download Submit
C:\Windows\SysWOW64\Qnjnnj32.exe

Filesize
92KB

MD5
01ce33758fa955935e92c126d19cefd2

SHA1
6840d944313f8f7b3285f88518c9d45259b08e51

SHA256
c09bc3fe2b04d152d5232dcb945df659cdd50507220a420230a035d6c9323fae

SHA512
bc67f51b0b9904181265ad14e51784c7880fc053375108cca5be1aeda233f40f1c9c05c3469112e1de2192f2464373921d011a96a332165141502972add14d62

Download Submit
memory/64-366-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/264-511-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/440-569-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/512-173-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/548-450-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/640-394-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/736-318-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/812-330-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/820-45-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/820-578-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/928-70-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1008-438-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1176-282-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1180-262-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1216-306-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1260-340-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1280-378-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1328-121-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1352-97-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1380-300-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1532-414-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1596-253-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1600-468-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1636-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/1636-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1636-540-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1664-324-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1740-538-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1764-342-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1924-572-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2092-599-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2112-89-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2272-145-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2292-360-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2368-57-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2368-592-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2392-541-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2400-13-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2416-571-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2416-33-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2452-348-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2556-165-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2576-312-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2600-184-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2636-516-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2692-432-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2708-564-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2760-508-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2828-277-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2884-492-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2892-526-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2900-288-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2920-480-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3032-579-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3044-553-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3052-491-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3084-158-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3196-528-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3416-389-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3456-409-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3536-72-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3608-205-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3612-298-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3700-252-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3708-137-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4112-396-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4116-406-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4128-53-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4128-585-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4216-113-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4240-502-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4252-590-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4260-217-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4280-420-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4308-263-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4336-598-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4368-270-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4388-448-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4460-21-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4472-238-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4620-358-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4648-230-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4680-198-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4760-479-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4764-129-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4800-269-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4816-105-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4820-377-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4840-213-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4844-30-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4876-551-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4932-456-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4952-176-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4972-80-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5048-426-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5092-462-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads