7c5bd756f2d336f88bee2b9724a40962d1fbbe55ab308c216d33e891dbbdf558

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 08:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e19d33bc2ec4aa67a0e18164fdb10a20_NeikiAnalytics.exe
Size

57KB
MD5

e19d33bc2ec4aa67a0e18164fdb10a20
SHA1

b3d624476ea1d692b3757618165e335d245675db
SHA256

7c5bd756f2d336f88bee2b9724a40962d1fbbe55ab308c216d33e891dbbdf558
SHA512

d24687ba8eb8f29cd587245d9fdfa43ec6acdc158c9ffb9df5c77c3f4c5b3cfb7a0cd06975626256b373aa4c45e2f59169c4c93e1ad24efb9cac625769aca9dc
SSDEEP

1536:NlamMoaWXwub9xkQLf9KkHTJb6+xQ3L35a/Hn:6mMoJXVpxkQLfEkHTJb1xQb3IHn

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddbbeade.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fakdpb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipbdmaah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kipkhdeq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcepkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kepelfam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ambgef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hioiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcmabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nilcjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npjebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aealah32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbbkaako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfembo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmoeoidl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmpcfdmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkoiefmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Faihkbci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hodgkc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmncnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocbddc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnkdhpjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cliaoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhkapp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlncan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcppfaka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdfkolkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhdbhcck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klgqcqkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgkjhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icnpmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lepncd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Meiaib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edkdkplj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhgjblfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmoeoidl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imakkfdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dopigd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onjegled.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qffbbldm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Foabofnn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ickchq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jehokgge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdqgmmjb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbeidl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpnlpnih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqkdcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkjlge32.exe

Executes dropped EXE 64 IoCs

pid	Process
1556	Odednmpm.exe
4320	Ogcpjhoq.exe
3240	Ojalgcnd.exe
4612	Onmhgb32.exe
4972	Oqkdcn32.exe
1548	Pcjapi32.exe
3928	Pkaiqf32.exe
3772	Pbkamqmd.exe
2264	Peimil32.exe
3604	Pghieg32.exe
4264	Pnbbbabh.exe
2896	Pqpnombl.exe
876	Pgjfkg32.exe
4160	Pkfblfab.exe
4936	Pbpjhp32.exe
4728	Pengdk32.exe
4672	Pgmcqggf.exe
4712	Pjkombfj.exe
2160	Pbbgnpgl.exe
2856	Peqcjkfp.exe
388	Pgopffec.exe
3740	Pkjlge32.exe
3588	Pnihcq32.exe
4640	Pagdol32.exe
4664	Qcepkg32.exe
1336	Qkmhlekj.exe
4952	Qnkdhpjn.exe
2544	Qeemej32.exe
1664	Qgciaf32.exe
1824	Qjbena32.exe
4512	Aegikj32.exe
4492	Ajdbcano.exe
2900	Abkjdnoa.exe
4592	Aanjpk32.exe
1924	Ahhblemi.exe
32	Ajfoiqll.exe
2716	Anbkio32.exe
2056	Aelcfilb.exe
4168	Acocaf32.exe
4236	Alfkbc32.exe
3572	Aeopki32.exe
3548	Ahmlgd32.exe
1404	Alhhhcal.exe
3048	Ajkhdp32.exe
1540	Abbpem32.exe
4348	Aealah32.exe
968	Ahoimd32.exe
1328	Ajneip32.exe
2844	Bahmfj32.exe
3664	Becifhfj.exe
4172	Bdfibe32.exe
816	Bjpaooda.exe
3800	Bajjli32.exe
2816	Bdhfhe32.exe
3764	Bhdbhcck.exe
2200	Bjbndobo.exe
224	Bbifelba.exe
2180	Behbag32.exe
1120	Bdkcmdhp.exe
1796	Bjdkjo32.exe
3676	Bopgjmhe.exe
3104	Baocghgi.exe
3452	Bdmpcdfm.exe
1888	Bjghpn32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Colffknh.exe	Chbnia32.exe
File created	C:\Windows\SysWOW64\Ingfla32.dll	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Cddecc32.exe	Cogmkl32.exe
File created	C:\Windows\SysWOW64\Paadbk32.dll	Fhemmlhc.exe
File opened for modification	C:\Windows\SysWOW64\Hcmgfbhd.exe	Hkfoeega.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Agjhgngj.exe
File created	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bjagjhnc.exe
File opened for modification	C:\Windows\SysWOW64\Ecjhcg32.exe	Ekcpbj32.exe
File created	C:\Windows\SysWOW64\Heocnk32.exe	Hcmgfbhd.exe
File created	C:\Windows\SysWOW64\Jcefno32.exe	Jedeph32.exe
File created	C:\Windows\SysWOW64\Klljnp32.exe	Kimnbd32.exe
File created	C:\Windows\SysWOW64\Odgdacjh.dll	Ngmgne32.exe
File created	C:\Windows\SysWOW64\Pflplnlg.exe	Pcncpbmd.exe
File opened for modification	C:\Windows\SysWOW64\Aclpap32.exe	Ambgef32.exe
File created	C:\Windows\SysWOW64\Peqcjkfp.exe	Pbbgnpgl.exe
File created	C:\Windows\SysWOW64\Fohoigfh.exe	Fljcmlfd.exe
File created	C:\Windows\SysWOW64\Ickchq32.exe	Imakkfdg.exe
File opened for modification	C:\Windows\SysWOW64\Mlhbal32.exe	Miifeq32.exe
File opened for modification	C:\Windows\SysWOW64\Onjegled.exe	Ofcmfodb.exe
File created	C:\Windows\SysWOW64\Ahhblemi.exe	Aanjpk32.exe
File opened for modification	C:\Windows\SysWOW64\Fljcmlfd.exe	Edbklofb.exe
File created	C:\Windows\SysWOW64\Mdckfk32.exe	Lllcen32.exe
File created	C:\Windows\SysWOW64\Bcoenmao.exe	Bapiabak.exe
File created	C:\Windows\SysWOW64\Hafgeo32.dll	Gcfqfc32.exe
File created	C:\Windows\SysWOW64\Jijjfldq.dll	Bjagjhnc.exe
File created	C:\Windows\SysWOW64\Gjeieojj.dll	Ldanqkki.exe
File created	C:\Windows\SysWOW64\Ohjdgn32.dll	Ofnckp32.exe
File created	C:\Windows\SysWOW64\Eflgme32.dll	Bgcknmop.exe
File opened for modification	C:\Windows\SysWOW64\Eaklidoi.exe	Echknh32.exe
File created	C:\Windows\SysWOW64\Gcfqfc32.exe	Gkoiefmj.exe
File created	C:\Windows\SysWOW64\Hkfoeega.exe	Hihbijhn.exe
File created	C:\Windows\SysWOW64\Hqdeld32.dll	Kimnbd32.exe
File created	C:\Windows\SysWOW64\Ncmlocln.dll	Kdgljmcd.exe
File opened for modification	C:\Windows\SysWOW64\Oqkdcn32.exe	Onmhgb32.exe
File created	C:\Windows\SysWOW64\Qjbena32.exe	Qgciaf32.exe
File created	C:\Windows\SysWOW64\Ncfmpnfb.dll	Bjpaooda.exe
File created	C:\Windows\SysWOW64\Paihpaak.dll	Ffgqqaip.exe
File created	C:\Windows\SysWOW64\Dndgjk32.dll	Iikhfg32.exe
File opened for modification	C:\Windows\SysWOW64\Beihma32.exe	Bmbplc32.exe
File opened for modification	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bjagjhnc.exe
File opened for modification	C:\Windows\SysWOW64\Dfiafg32.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Ddbbeade.exe	Doeiljfn.exe
File created	C:\Windows\SysWOW64\Ehedfo32.exe	Edihepnm.exe
File created	C:\Windows\SysWOW64\Enlqgg32.dll	Hioiji32.exe
File opened for modification	C:\Windows\SysWOW64\Kmncnb32.exe	Kefkme32.exe
File opened for modification	C:\Windows\SysWOW64\Onhhamgg.exe	Ofqpqo32.exe
File created	C:\Windows\SysWOW64\Echdno32.dll	Cmlcbbcj.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Cegdnopg.exe
File opened for modification	C:\Windows\SysWOW64\Ajneip32.exe	Ahoimd32.exe
File created	C:\Windows\SysWOW64\Jffggf32.dll	Cagobalc.exe
File created	C:\Windows\SysWOW64\Onmhgb32.exe	Ojalgcnd.exe
File created	C:\Windows\SysWOW64\Flgmek32.dll	Bemlmgnp.exe
File created	C:\Windows\SysWOW64\Imakkfdg.exe	Ifgbnlmj.exe
File created	C:\Windows\SysWOW64\Eikdngcl.dll	Kepelfam.exe
File created	C:\Windows\SysWOW64\Cegdnopg.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Ocbddc32.exe	Opdghh32.exe
File created	C:\Windows\SysWOW64\Bmngqdpj.exe	Bjokdipf.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Ngmgne32.exe	Ndokbi32.exe
File created	C:\Windows\SysWOW64\Mgjpndjd.dll	Aegikj32.exe
File created	C:\Windows\SysWOW64\Aelcfilb.exe	Anbkio32.exe
File created	C:\Windows\SysWOW64\Cdbinofi.dll	Jehokgge.exe
File created	C:\Windows\SysWOW64\Flpafo32.dll	Klgqcqkl.exe
File opened for modification	C:\Windows\SysWOW64\Kdcbom32.exe	Klljnp32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10004	9860	WerFault.exe	458

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qghlmgij.dll"	Gkmlofol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfnphn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdmnlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehfnmfki.dll"	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oammoc32.dll"	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmnpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajfoiqll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Echknh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eemnjbaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgefeajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qqfmde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdhfhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnmqkjel.dll"	Fohoigfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmbmibhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilabfj32.dll"	Blfdia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Colffknh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Faihkbci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndokbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qffbbldm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	e19d33bc2ec4aa67a0e18164fdb10a20_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcjfkm32.dll"	Ehimanbq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agocgbni.dll"	Ndokbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocdqjceo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Genaegmo.dll"	Dllfkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbcbgk32.dll"	Eamhodmf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkopnh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpcfkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Miifeq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klgqcqkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idodkeom.dll"	Mlhbal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Boepel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ickchq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejfenk32.dll"	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahmlgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nghjpm32.dll"	Gkhbdg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdgljmcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgjfkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjqaij32.dll"	Dkoggkjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcfqfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhqeiena.dll"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhpili32.dll"	Eofbch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ickchq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilidbbgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglncdoj.dll"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlcadgkl.dll"	Dldpkoil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fomhdg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffgqqaip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aelcfilb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmmjgejj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdckfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgbpghdn.dll"	Aadifclh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkoggkjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpdkcl32.dll"	Klngdpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qceiaa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qfcfml32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 1556	2956	e19d33bc2ec4aa67a0e18164fdb10a20_NeikiAnalytics.exe	83
PID 2956 wrote to memory of 1556	2956	e19d33bc2ec4aa67a0e18164fdb10a20_NeikiAnalytics.exe	83
PID 2956 wrote to memory of 1556	2956	e19d33bc2ec4aa67a0e18164fdb10a20_NeikiAnalytics.exe	83
PID 1556 wrote to memory of 4320	1556	Odednmpm.exe	84
PID 1556 wrote to memory of 4320	1556	Odednmpm.exe	84
PID 1556 wrote to memory of 4320	1556	Odednmpm.exe	84
PID 4320 wrote to memory of 3240	4320	Ogcpjhoq.exe	85
PID 4320 wrote to memory of 3240	4320	Ogcpjhoq.exe	85
PID 4320 wrote to memory of 3240	4320	Ogcpjhoq.exe	85
PID 3240 wrote to memory of 4612	3240	Ojalgcnd.exe	86
PID 3240 wrote to memory of 4612	3240	Ojalgcnd.exe	86
PID 3240 wrote to memory of 4612	3240	Ojalgcnd.exe	86
PID 4612 wrote to memory of 4972	4612	Onmhgb32.exe	87
PID 4612 wrote to memory of 4972	4612	Onmhgb32.exe	87
PID 4612 wrote to memory of 4972	4612	Onmhgb32.exe	87
PID 4972 wrote to memory of 1548	4972	Oqkdcn32.exe	88
PID 4972 wrote to memory of 1548	4972	Oqkdcn32.exe	88
PID 4972 wrote to memory of 1548	4972	Oqkdcn32.exe	88
PID 1548 wrote to memory of 3928	1548	Pcjapi32.exe	89
PID 1548 wrote to memory of 3928	1548	Pcjapi32.exe	89
PID 1548 wrote to memory of 3928	1548	Pcjapi32.exe	89
PID 3928 wrote to memory of 3772	3928	Pkaiqf32.exe	90
PID 3928 wrote to memory of 3772	3928	Pkaiqf32.exe	90
PID 3928 wrote to memory of 3772	3928	Pkaiqf32.exe	90
PID 3772 wrote to memory of 2264	3772	Pbkamqmd.exe	91
PID 3772 wrote to memory of 2264	3772	Pbkamqmd.exe	91
PID 3772 wrote to memory of 2264	3772	Pbkamqmd.exe	91
PID 2264 wrote to memory of 3604	2264	Peimil32.exe	92
PID 2264 wrote to memory of 3604	2264	Peimil32.exe	92
PID 2264 wrote to memory of 3604	2264	Peimil32.exe	92
PID 3604 wrote to memory of 4264	3604	Pghieg32.exe	93
PID 3604 wrote to memory of 4264	3604	Pghieg32.exe	93
PID 3604 wrote to memory of 4264	3604	Pghieg32.exe	93
PID 4264 wrote to memory of 2896	4264	Pnbbbabh.exe	94
PID 4264 wrote to memory of 2896	4264	Pnbbbabh.exe	94
PID 4264 wrote to memory of 2896	4264	Pnbbbabh.exe	94
PID 2896 wrote to memory of 876	2896	Pqpnombl.exe	95
PID 2896 wrote to memory of 876	2896	Pqpnombl.exe	95
PID 2896 wrote to memory of 876	2896	Pqpnombl.exe	95
PID 876 wrote to memory of 4160	876	Pgjfkg32.exe	96
PID 876 wrote to memory of 4160	876	Pgjfkg32.exe	96
PID 876 wrote to memory of 4160	876	Pgjfkg32.exe	96
PID 4160 wrote to memory of 4936	4160	Pkfblfab.exe	97
PID 4160 wrote to memory of 4936	4160	Pkfblfab.exe	97
PID 4160 wrote to memory of 4936	4160	Pkfblfab.exe	97
PID 4936 wrote to memory of 4728	4936	Pbpjhp32.exe	98
PID 4936 wrote to memory of 4728	4936	Pbpjhp32.exe	98
PID 4936 wrote to memory of 4728	4936	Pbpjhp32.exe	98
PID 4728 wrote to memory of 4672	4728	Pengdk32.exe	99
PID 4728 wrote to memory of 4672	4728	Pengdk32.exe	99
PID 4728 wrote to memory of 4672	4728	Pengdk32.exe	99
PID 4672 wrote to memory of 4712	4672	Pgmcqggf.exe	100
PID 4672 wrote to memory of 4712	4672	Pgmcqggf.exe	100
PID 4672 wrote to memory of 4712	4672	Pgmcqggf.exe	100
PID 4712 wrote to memory of 2160	4712	Pjkombfj.exe	101
PID 4712 wrote to memory of 2160	4712	Pjkombfj.exe	101
PID 4712 wrote to memory of 2160	4712	Pjkombfj.exe	101
PID 2160 wrote to memory of 2856	2160	Pbbgnpgl.exe	102
PID 2160 wrote to memory of 2856	2160	Pbbgnpgl.exe	102
PID 2160 wrote to memory of 2856	2160	Pbbgnpgl.exe	102
PID 2856 wrote to memory of 388	2856	Peqcjkfp.exe	103
PID 2856 wrote to memory of 388	2856	Peqcjkfp.exe	103
PID 2856 wrote to memory of 388	2856	Peqcjkfp.exe	103
PID 388 wrote to memory of 3740	388	Pgopffec.exe	104

C:\Users\Admin\AppData\Local\Temp\e19d33bc2ec4aa67a0e18164fdb10a20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\e19d33bc2ec4aa67a0e18164fdb10a20_NeikiAnalytics.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\Odednmpm.exe
  C:\Windows\system32\Odednmpm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\SysWOW64\Ogcpjhoq.exe
    C:\Windows\system32\Ogcpjhoq.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Windows\SysWOW64\Ojalgcnd.exe
      C:\Windows\system32\Ojalgcnd.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:3240
    - - C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4612
      - C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1548
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3772
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2264
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3604
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:876
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4728
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4672
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4712
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:388
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3740
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        24⤵
        Executes dropped EXE
        
        PID:3588
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        25⤵
        Executes dropped EXE
        
        PID:4640
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4664
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        27⤵
        Executes dropped EXE
        
        PID:1336
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4952
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        29⤵
        Executes dropped EXE
        
        PID:2544
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1664
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        31⤵
        Executes dropped EXE
        
        PID:1824
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4512
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        33⤵
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        34⤵
        Executes dropped EXE
        
        PID:2900
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4592
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        36⤵
        Executes dropped EXE
        
        PID:1924
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:32
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2716
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2056
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        40⤵
        Executes dropped EXE
        
        PID:4168
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        41⤵
        Executes dropped EXE
        
        PID:4236
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        42⤵
        Executes dropped EXE
        
        PID:3572
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3548
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        44⤵
        Executes dropped EXE
        
        PID:1404
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        45⤵
        Executes dropped EXE
        
        PID:3048
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        46⤵
        Executes dropped EXE
        
        PID:1540
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4348
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:968
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        49⤵
        Executes dropped EXE
        
        PID:1328
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        50⤵
        Executes dropped EXE
        
        PID:2844
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        51⤵
        Executes dropped EXE
        
        PID:3664
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        52⤵
        Executes dropped EXE
        
        PID:4172
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:816
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        54⤵
        Executes dropped EXE
        
        PID:3800
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2816
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3764
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        57⤵
        Executes dropped EXE
        
        PID:2200
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        58⤵
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        59⤵
        Executes dropped EXE
        
        PID:2180
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        60⤵
        Executes dropped EXE
        
        PID:1120
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        61⤵
        Executes dropped EXE
        
        PID:1796
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        62⤵
        Executes dropped EXE
        
        PID:3676
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        63⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        64⤵
        Executes dropped EXE
        
        PID:3452
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        65⤵
        Executes dropped EXE
        
        PID:1888
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        66⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        67⤵
        Drops file in System32 directory
        
        PID:2360
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        68⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        69⤵
        Modifies registry class
        
        PID:1744
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        70⤵
        Modifies registry class
        
        PID:4232
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        71⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        72⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        73⤵
        
        PID:988
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3208
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        75⤵
        Drops file in System32 directory
        
        PID:5052
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        76⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        77⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        78⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        79⤵
        Drops file in System32 directory
        
        PID:4960
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        80⤵
        Modifies registry class
        
        PID:3948
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        81⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        82⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        83⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        84⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        85⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        86⤵
        Modifies registry class
        
        PID:3316
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        87⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1420
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        89⤵
        Drops file in System32 directory
        
        PID:3476
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2592
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        91⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        92⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        93⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        94⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        95⤵
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        96⤵
        Modifies registry class
        
        PID:5232
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        97⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        98⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        99⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        100⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        102⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        103⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5648
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        104⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        105⤵
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        106⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        107⤵
        Drops file in System32 directory
        
        PID:5820
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        108⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        109⤵
        Modifies registry class
        
        PID:5924
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5976
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        111⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        112⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        113⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        114⤵
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        115⤵
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        116⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        117⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        118⤵
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        119⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        120⤵
        Drops file in System32 directory
        
        PID:5624
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        121⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        122⤵
        Modifies registry class
        
        PID:5768
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        123⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        124⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        125⤵
        Modifies registry class
        
        PID:6000
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        126⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2500
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        128⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        129⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        130⤵
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5668
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        132⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5788
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        133⤵
        Drops file in System32 directory
        
        PID:5908
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        134⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        135⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5332
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        137⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5752
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        139⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        140⤵
        Modifies registry class
        
        PID:6044
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5228
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5724
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        143⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        144⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        145⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        146⤵
        Modifies registry class
        
        PID:5636
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5224
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        148⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1152
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:980
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4604
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        151⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        152⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        153⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        154⤵
        Drops file in System32 directory
        
        PID:6188
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        155⤵
        Drops file in System32 directory
        
        PID:6240
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        156⤵
        Drops file in System32 directory
        
        PID:6280
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        157⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6368
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        159⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        160⤵
        Modifies registry class
        
        PID:6456
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        161⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6544
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        163⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        164⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        165⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        166⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        167⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        168⤵
        Drops file in System32 directory
        
        PID:6812
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6856
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6900
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        171⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6996
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7052
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        174⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        175⤵
        Drops file in System32 directory
        
        PID:7148
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        176⤵
        Modifies registry class
        
        PID:6184
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        177⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        178⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        179⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        180⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6512
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        182⤵
        Drops file in System32 directory
        
        PID:6576
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        183⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        184⤵
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6800
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        186⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        187⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        188⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        189⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6164
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6220
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        192⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        193⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        194⤵
        Drops file in System32 directory
        
        PID:6584
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        195⤵
        Drops file in System32 directory
        
        PID:6720
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        196⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6908
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        198⤵
        Modifies registry class
        
        PID:7028
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        199⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        200⤵
        Drops file in System32 directory
        
        PID:6320
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6484
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        202⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6716
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        203⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7160
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        205⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        206⤵
        Modifies registry class
        
        PID:6644
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        207⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        208⤵
        Modifies registry class
        
        PID:6344
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6712
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        210⤵
        Drops file in System32 directory
        
        PID:7144
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        211⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        212⤵
        Drops file in System32 directory
        
        PID:6564
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        213⤵
        Modifies registry class
        
        PID:7004
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        214⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        215⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        216⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        217⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        218⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        219⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        220⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7496
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        222⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        223⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7628
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        225⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        226⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        227⤵
        Modifies registry class
        
        PID:7760
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7800
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        229⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7836
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        230⤵
        Modifies registry class
        
        PID:7888
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        231⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7932
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        232⤵
        Drops file in System32 directory
        
        PID:7976
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8020
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        234⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        235⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        236⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        237⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        238⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        239⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        240⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7444
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7524
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        243⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        244⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        245⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        246⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7952
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        248⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        249⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        250⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        251⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        252⤵
        Drops file in System32 directory
        
        PID:7348
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        253⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        254⤵
        Drops file in System32 directory
        
        PID:7596
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7708
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        256⤵
        Drops file in System32 directory
        
        PID:7824
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        257⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        258⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        259⤵
        Modifies registry class
        
        PID:8148
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7340
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7480
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        262⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        263⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        264⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        265⤵
        Modifies registry class
        
        PID:7264
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        266⤵
        Modifies registry class
        
        PID:7516
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        267⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        268⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        269⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        270⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        271⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        272⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        273⤵
        Drops file in System32 directory
        
        PID:7796
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        274⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        275⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        276⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8336
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        278⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        279⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        280⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        281⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        282⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        283⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        284⤵
        Modifies registry class
        
        PID:8632
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        285⤵
        Modifies registry class
        
        PID:8688
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        286⤵
        Modifies registry class
        
        PID:8732
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        287⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8808
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        289⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8908
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        291⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        292⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        293⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        294⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9128
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        296⤵
        Modifies registry class
        
        PID:9172
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        297⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        298⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        299⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        300⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        301⤵
        Drops file in System32 directory
        
        PID:8452
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        302⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        303⤵
        Modifies registry class
        
        PID:8588
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        304⤵
        Modifies registry class
        
        PID:8660
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        305⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        306⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        307⤵
        Modifies registry class
        
        PID:8872
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8948
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        309⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        310⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        311⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        312⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        313⤵
        Drops file in System32 directory
        
        PID:8280
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        314⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        315⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        316⤵
        Drops file in System32 directory
        
        PID:8604
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        317⤵
        Drops file in System32 directory
        
        PID:8716
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8824
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        319⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9060
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9148
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        322⤵
        Drops file in System32 directory
        
        PID:8256
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        323⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8572
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        325⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        326⤵
        Drops file in System32 directory
        
        PID:8928
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        327⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        328⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        329⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        330⤵
        Modifies registry class
        
        PID:8816
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        331⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        332⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        333⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        334⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        335⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        336⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        337⤵
        Modifies registry class
        
        PID:9224
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        338⤵
        Drops file in System32 directory
        
        PID:9280
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        339⤵
        Drops file in System32 directory
        
        PID:9344
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        340⤵
        Drops file in System32 directory
        
        PID:9404
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9452
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9496
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        343⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        344⤵
        Modifies registry class
        
        PID:9596
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9648
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        346⤵
        Drops file in System32 directory
        
        PID:9692
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        347⤵
        Drops file in System32 directory
        
        PID:9736
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9772
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        349⤵
        Drops file in System32 directory
        
        PID:9816
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        350⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9904
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9948
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        353⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        354⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        355⤵
        Modifies registry class
        
        PID:10080
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        356⤵
        Modifies registry class
        
        PID:10124
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        357⤵
        Modifies registry class
        
        PID:10168
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        358⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        359⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        360⤵
        Modifies registry class
        
        PID:9296
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        361⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9488
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9556
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        364⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        365⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9760
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        367⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9860 -s 396
        368⤵
        Program crash
        
        PID:10004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 9860 -ip 9860
1⤵
PID:9956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
57KB

MD5
e74aca2c11f54a4cab915c8893144422

SHA1
ca77c1e4425ac4e1f201a95ebdfe6db25a5bf0e2

SHA256
73afeda3956946ca487af8bbf0bd6d93dc7b655160bc1df4de52d5fac965bcf1

SHA512
f02499ae84b0cfd05dad87f374141a23b077f556e57d70e955a2d63095c78f5d4ba2857e4d8c7384b7d5e210272f045639beb1e8e4a9d4f9b566d65393d000b3

Download Submit
C:\Windows\SysWOW64\Aegikj32.exe

Filesize
57KB

MD5
4565c3bfb3241adbb409f6a82c8885a6

SHA1
0e388cb2c7ca6a58acd9c20221cddf9c46744fb5

SHA256
74b40c571f2b52cbe2ed9428e9bb355b32c771be2cdbe276e7efcbe1661ebfe5

SHA512
98e271d8af5a4ce2f8db74e157dbb3713da83afa03ad81f69db1689794fd774f5b44340237813ac4d49145a9b6d67b99456fe68ae7dfa844faf369154a54a8ae

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
57KB

MD5
4dc4e1fa3a7223760cdaaebf77b1ba5a

SHA1
b1e7ee491de230aaa445715a29438f22f0e621ea

SHA256
2fd8f923a08e7e855962dee8d9eb9f5120c87b6d40641567cc8359b06e32c380

SHA512
a2200964477f905c75afcd61d2cc445bfc93dbd630b568187cfec7fb62cf5cce7e202a4d336530f464178cb585a253f5a1cf363e35e53f7fd06d5a9f53f37216

Download Submit
C:\Windows\SysWOW64\Ajdbcano.exe

Filesize
57KB

MD5
6b0ebd133983c2f8a867db23681bebde

SHA1
46120f4374569f5a223b8bcf96f50d989b54dc7c

SHA256
167a3825ad92d46eacbdb5747953b47472a08c2a8c45477a7386916ce30abaf6

SHA512
b5f1b6b0581adce8496df86f85b9cf5e9327387c7f7bf6500a61584828e7e8c44e91b8a20af71afc955cdaafe897af46252744384c5102209cf69684868f189b

Download Submit
C:\Windows\SysWOW64\Ajkaii32.exe

Filesize
57KB

MD5
2f119ef208bd8ddf246f883089032060

SHA1
b4095da8d46c9d4fa51b1ce145cca70459c48e7b

SHA256
e1ef8778f1ab51e364498b07c6d5ce3b65b7c955fe95a53aa522d1b923877081

SHA512
dd47019c9c453b0ca48c851ac63d2157d32349fdbaf8ea349aa6dee4ed4a6e25e2e64d95f34aab334af9e25770ed7ee5530821bb0bd60c121cb4719671d8edd6

Download Submit
C:\Windows\SysWOW64\Alfkbc32.exe

Filesize
57KB

MD5
dc45d04c37c3801c7b511bcad517e4e9

SHA1
4dad9d2256409d9c5b43a8d2107de5eadef8a5a8

SHA256
b2611c7e3d9afca30547a4608b97e81e98fe6e0d7e5658ebdcf0591ee235c4ca

SHA512
cb5aaa7729ac486f11e5ba6dc3a2a5296f52f424414f4164b331bd8b55bad02467970009ab7e1a19874988220d54f5a070dab138bc2f958e13fba4d0567b1370

Download Submit
C:\Windows\SysWOW64\Amgapeea.exe

Filesize
57KB

MD5
d616fb602db97fe1b05c96d969bb71a5

SHA1
f8423f410ca1d49d048eeff5bd8b6368e86813db

SHA256
287907fce3942aefba60f1494cdfbfd768ea615d7534bead7771333fe0274ac0

SHA512
01850a8ec4a255a7a3a8efd7080163370a064127d3fb97268f89d8e3973d671e59ad5a360656006f58659819786de97dd350c53c8963a0a44ff6187c62dc963b

Download Submit
C:\Windows\SysWOW64\Beeoaapl.exe

Filesize
57KB

MD5
0ba84db871fa998c1bd5f93edad802cd

SHA1
0a93cbe3c50eb42454b9824667f259e95e2225d3

SHA256
515fe9d17a510808b37679afbcf6ddef01ffe079dd2d48d3faadfcf5e48e3bce

SHA512
4c948138a7026c25ae580435730e840fed1b2eb2ac2e70e9ce2ea028757e1d3ef873b0ca751a65f8ec185ec96a9faba9e280f04edcd02729e8b0a6a945597b0a

Download Submit
C:\Windows\SysWOW64\Bganhm32.exe

Filesize
57KB

MD5
8201b4b8c035c39b139f07774436948f

SHA1
44dd0f9acef5d8e26f8ae14681cc44909eb44e6a

SHA256
b533b30fb31edcb76789799bbf2364f60b0b2d8e4d225de534f49b69119e7777

SHA512
22bec12732469040a3731f60ec8dd604be4229e081c0f5f29c0b93c706b510c75bc01a247dc756b4f4ee95bbe00545aa958ee15ab3bd86cba09d8cae4b0a141c

Download Submit
C:\Windows\SysWOW64\Bgehcmmm.exe

Filesize
57KB

MD5
5687923083f65197df833bd1299fe28a

SHA1
0bb4a897e3cf07d9732cd6ef4a5ef0407346ad23

SHA256
4b47498cf423e531e9989c66138dc348d91b09365eac50bc22ce80ec6c838943

SHA512
2cb92e26a39f238b32bb9c2cc28c408f649007c654708cbf73269110874beb6af37b917f0e10038aa4030b02ee3158b71353804fe4dba26146f066fdcd64351e

Download Submit
C:\Windows\SysWOW64\Bhdbhcck.exe

Filesize
57KB

MD5
ec1f64d7f8ec93f9ddb99a99da910e76

SHA1
2ada4b4c7c68c77d1c56886791438abae83123dc

SHA256
1ad138b1864693f17a47f31856a8216c930a85f005644b0424dac4201e075c30

SHA512
e99db3d6693abefa7f9d20e46fe20133add091f1cfa1b540fd422feed1aa6ec548b574a71e3d91b6661ab6b2cac9a8d67d0ead472f73acaac1101b6d33674635

Download Submit
C:\Windows\SysWOW64\Bmbplc32.exe

Filesize
57KB

MD5
53d5eb099c347d39144084346f06efba

SHA1
69dd07cf52de071fe08ae793a38db81df00e5245

SHA256
b0f70b248c2af64c6876c17a7c1fc5e502bd4933718d9dadcc94b2cc3c71b639

SHA512
390d447890766f0357f46738672fd555d71081965f01bfaf1450eb438b98b014d6a3d980afd2ff4efdf698c3ae340174b62a801724094b85a7bd41ef66baf8a9

Download Submit
C:\Windows\SysWOW64\Bmemac32.exe

Filesize
57KB

MD5
39964f70d0bd51c154d3a1098ce2faac

SHA1
b641cc60cbaa33940d58d0d71a20d8cfc008f4d0

SHA256
2d1200c371490f4cee9d299332db8f9cf2e3f34b32e5822ec65628ee900fb1f7

SHA512
b0b3879574ac05e3f6a0940b7a197438c45595d322369f8d2b3457783f4ac56d6e81e724492eb1d0116c24e2ed925b354d1aa086bd22c1ec7c1e652d91b830c7

Download Submit
C:\Windows\SysWOW64\Bmkjkd32.exe

Filesize
57KB

MD5
faf25c8db530334e877036e703171b4f

SHA1
2d8a123c2ddb043514f10020ae28ee93453168ca

SHA256
81ac5223aeae7ee18020828b7989f424c7fcdf1d9078616eb245f2869561f1c0

SHA512
94919f36c9ea0b66437e6f2b5ac2d627c28118068a3ef3d3028a5d326ddbad9b4ee86ee5a0151e6426f4506d6e5d182128b9972b5565c647b6e4b3e2c4a9beac

Download Submit
C:\Windows\SysWOW64\Ckcgkldl.exe

Filesize
57KB

MD5
be9a382dacbda0d0a29e7f1c1c63f053

SHA1
cc72dafaeaa005c19ba8d4b4d4be2b35355c41af

SHA256
ee6ba30d75591250013cca5dd443af03a83e75b9a9581441ccd347e45a7ca352

SHA512
b7a2de8e568e4cf74f45e07bca70d01ab55088e2b7ee42cf32b5690667f27c2d71357c4f1fd99c5d1e22369dff4efc20d6a2f4e371dd9988fe92c3719c19f2e3

Download Submit
C:\Windows\SysWOW64\Cnnlaehj.exe

Filesize
57KB

MD5
bdd4ed2f37a913c28eb3ec7bfcc4bab0

SHA1
63e0b67e231265b922ab03daf28acd30fbe0b4bb

SHA256
74e37718efbc9198bb57037c1c2bf2070e038dee0afe243b022ca589f8efc560

SHA512
1fd787c7e4e1efb57ae44d7a0e41b8b5b80a4b808c1b0a53f1849780791f389671bfa66af724514d036ab055d5da11a1049b410d21d042bd179aaced2402db5f

Download Submit
C:\Windows\SysWOW64\Colffknh.exe

Filesize
57KB

MD5
4e7b04ac23aaadb276c346ec05f82225

SHA1
091037ce82232fb6ed2848137693bed8fff33897

SHA256
2b518e31c0f81ec63973694fde866c8aaaead45634de98eed34e483b2a34444d

SHA512
6cd03d140c5c65654a8144fcbde2e53e7d9e14e2fe162e0c14128b0ca843987c8f3d3d1f4d534e60a11d1b227581796fdda20cdba8b9b9eea4df2f85af8afea9

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
57KB

MD5
b4c0934d7c381a9fa627825f4f8892df

SHA1
3b5916f8e1d39409b227e385f13e6e637d2fb5b4

SHA256
6db421648d549d3b27eda238fa7034a15484c890ddb8c1ada54073341092fa98

SHA512
af5ec8719be5bdcbbac35835b57f8472b9acb10abab1a62c3bdeac9e12185f1f7e3378e98f41575539a17d9d71dfb9aafc170cedb147cedfdc264e763370d229

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
57KB

MD5
063d9fa42075528e87c968caced54a59

SHA1
225d566f20a2177da5d96b4d2d39271a979ffc5d

SHA256
976e6f42762ab5e21ddc51f6177381739bfd2679a1286238ea88f1d6aa0dfe41

SHA512
afa460d4277158f92a9dc06c3810fe57978c36b2330b844808ca29fb1bdebe0b64945116ff7eab826e07c267f2ba1c7c1d441e6628e0f07395092e52151f42fa

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
57KB

MD5
f3be88d90bcb00463b954670727e9d4e

SHA1
1bf6cc4156fa1f94f8d85ee051dabf291a864536

SHA256
f641f225a37ed45a4b9154cb94b7223e5ae862ab0da5f422780e11cb73d955a2

SHA512
a2cf9c7f01820e8040af48c53fca51be6463791606368081e634823c043d2a0961003402c35dd6711a0771c883916d361da9173fe039f7d0932902be8cad5848

Download Submit
C:\Windows\SysWOW64\Eadopc32.exe

Filesize
57KB

MD5
faa4521c20964bb852cc7541ae5165e4

SHA1
ab2f09e97c74aa44432538a1aef896de1d54b3bc

SHA256
f86b5971f56ca8d9d4ce3793a86a18182bceacae7619c328979a3a5a0722ac01

SHA512
80b3234e2223dad06fc9d6d9bb2041af0caab39658c71b37a27b3a0a7a1cc5e78d7839dbf6c4f32a68a9cf3313e0c4f99aaa9b7c6efdb642aa514e9ce8612a58

Download Submit
C:\Windows\SysWOW64\Fdnjgmle.exe

Filesize
57KB

MD5
0888d96641d2f5faca22fd3eecd9581e

SHA1
dc82919b5ea7247ab753cb815852c8bdbce9efa9

SHA256
5797ae123fb9c804adae99c72cff6ee94506520ddd2099a6917ca162695e19f6

SHA512
5cdc084058b12e00e2a1fa98865205cd0c024ecd8b570352ac184755e6c68a4cb1e6d72fe6bf509f2cb18f5341ac7629c893571450fc294e0f808ebf0c7fc065

Download Submit
C:\Windows\SysWOW64\Ffgqqaip.exe

Filesize
57KB

MD5
98c0e61b9040dcdf3edcf7053a5f2c84

SHA1
43d5570d599b6e963cde1e563bade0ecad347d36

SHA256
203b12a5eb89c98a61fe0ccfdb70bac5dd1a4b7b0a98919fe89d1cdedc5d4618

SHA512
739be228c4c7101331e10364589c717b42c16a6d751dc64d8f001bab7d9bb4d4132e00ee2ad12cd43972aa7dd0cf49eca45b4ceaba22f59f5cdd7b79676b8705

Download Submit
C:\Windows\SysWOW64\Fljcmlfd.exe

Filesize
57KB

MD5
b1c297f83f71f435bb003148eaca356b

SHA1
6a925df4e7bc94f293c0af316b800cbde2358562

SHA256
1eae80460a1168cd83e7e57baf0b0007867010deb46dc3560537db0f095b2e0d

SHA512
e7bb42b0eafade1b6edce6ca86646114b5b5726d03a569c804399819d6441902052693b1ac6d46fe3f50aed3e408f9a1ad9cb04ea604e73db2c42e0bf25b1c60

Download Submit
C:\Windows\SysWOW64\Gblngpbd.exe

Filesize
57KB

MD5
7eb7ff40fff50655b2bec856dade38a8

SHA1
9a9062bb8a4a5e287e32ea83aa328289d70faee8

SHA256
7b3f8911e32e6ab276d0e32280aa366ad0d545fd365d7f10636aa217bcd38377

SHA512
88428eb5247e64e24d4e23c847fa3de239ec76aa46c7b7d7e5e94ffce41e0cbcfb23a12b5a216ae0dfcaed28d12cb93135ebd08bd37756ecf77ddc90ff07dd60

Download Submit
C:\Windows\SysWOW64\Hcmgfbhd.exe

Filesize
57KB

MD5
f86dd672a4e79727cfb20bf7eda282ca

SHA1
219340cbaa8234fe0e65e135288a18ddd3ea480c

SHA256
6d37eeea523948ccb834920f9243c3f13b3f044244e167779af3c5c0791d37d3

SHA512
9eb32f33c1576bae34a0a6dad79e0ab76847f8320bd9dd56adaf4508002fbd76c87ccb7a63d4e18b343c53431d346a1ec6eb33c8261acad6342494cfad3bd805

Download Submit
C:\Windows\SysWOW64\Jmmjgejj.exe

Filesize
57KB

MD5
176f2c2f82c49b4093184645818aadfb

SHA1
832a7c653f72ac8a755e7b3cdf77c793fcb3044a

SHA256
acfbc189bb4918630cc41f819b95725b0509874161744ec74742500345fbe224

SHA512
8ba776a0b29c12d7597299696490f2aa1251ccce79e224b699ac846167cd648f22b0d4b41bee95d10925acae4ff8724b60cf5135d27b0a994a4797535d1221f4

Download Submit
C:\Windows\SysWOW64\Kdcbom32.exe

Filesize
57KB

MD5
a4098f5e6887ea15dfa285f75ea56b9a

SHA1
e2adc434fbfe8afd7f131199d44366c56c7baace

SHA256
4e53462d8c5ead00c7ac57e957dafd2ff4ef9e2dc9789f8fe2e3df0b97c418c8

SHA512
1f121e168245858e8353462269027c43da9cc2d69866bfe905ebb0656e09ed8a6030f554d3b4214bfbc6910ef5f36d4abdaa68dac5e25103e4613240ba8ab6f9

Download Submit
C:\Windows\SysWOW64\Klgqcqkl.exe

Filesize
57KB

MD5
df08a9f00908ebe7fd55b81f2bfe2b3e

SHA1
d5b8fa1d15d063867a7e17acc60a3a523682128b

SHA256
2c3f770dd1df603a065e4565b448f68e59a62f82ba227fd781f9c209c27bb516

SHA512
f4e0444307c6e69bb7c54a3dd46abd21644c85d7a19e028af36ff73b8d88cc253acd838acbdb746fb0a509ffab1b8f795488d0c10ddcf3daf099312e252e9b93

Download Submit
C:\Windows\SysWOW64\Leihbeib.exe

Filesize
57KB

MD5
f3bad8dfc4ae72f21b1d606d51c3c02d

SHA1
ffe6c2bb6ee8f67a9dd7964b391b8eee5e093c52

SHA256
70e59c541ae778a6fc0c366e4b47a7b3e94847448895c010c7b8949c83110580

SHA512
d40fe4902ab70feedf9850cf6c757b9354800efbfcc9ab9560d0abbd8beb9d59f57daee7977161ce2adf26e740792d2a6c3ed23bba54c30a588324dd24015a15

Download Submit
C:\Windows\SysWOW64\Lmbmibhb.exe

Filesize
57KB

MD5
3d279c876f348bfe40d590ef563c3c18

SHA1
6557457561d1efae1d83b2621e6d837c3ba48fa2

SHA256
cd3f80445ef8aabc599a90b9f7d215070a9eefe3d5955d9bb6f0c19cbbbb8526

SHA512
b535b2fd144ebcb95a9e5b28b3b31855ef21bd4d6d8eca36de3a146a3a4e5d94d1f44f93990edd273d5c55a522b7fffe0791fa86e1e1c5523ae11c2482929712

Download Submit
C:\Windows\SysWOW64\Mdmnlj32.exe

Filesize
57KB

MD5
da9e7b7c39bb6d5d3e1faccdbe864bde

SHA1
f5dfd438136f97bbb856bf64b06344918349ada8

SHA256
d9d94ce152028e3a1a2da4f401afe3f6b819dcc68eda220fb3bee9959e2f6cca

SHA512
e1fd14874233f255944cf66bc1da261aa19d06c6b40522ce737f4702504795aced3b59aa531e153f36e9ac8efc1125771f557ea3d7666a0ec96343aeeef2aa94

Download Submit
C:\Windows\SysWOW64\Mgddhf32.exe

Filesize
57KB

MD5
a6b5e8e50ae87285b1fd7ac526b7a02d

SHA1
d7c9bd5c16c7b0dd8608546b0e312e2fcdf2c0d2

SHA256
bbeef633bae4acf5b9e26b7240dc22884ee69ce0479158581142e005c508ebca

SHA512
1dafd41a2cec0766a21ea43e46e0eb5664cd59aec373863fd06309f3eac52cc2656e7ca5aa111679250d365e17708aa266b24ce98c4d51becfb598fd04ec5689

Download Submit
C:\Windows\SysWOW64\Ngpccdlj.exe

Filesize
57KB

MD5
6406b860f3a2050d7c8f5f7539475b9e

SHA1
b32c011e689bedf59d1d931b0b02c2efe03b3436

SHA256
ec852809f9a7dd16c01f00ba54bd02e80a1a05b4c42ece6bc9fa433f6d50ce11

SHA512
2db6a1721582682ac11d58839e550d858b58c3ec8f1040e5650d1555ddbd3eb5d471560597823c284f962938dddf7c6dee6257a820abeadb163acbf8bf895340

Download Submit
C:\Windows\SysWOW64\Njqmepik.exe

Filesize
57KB

MD5
0f11ffc05744a5880fea15fb9b324ecc

SHA1
c800600c90f0f36dd6a6040c75d9796b3039d5b7

SHA256
fad7b21eaf687ffac6f31f86033095d054afb524b9e8620c6d82fc8bd2054465

SHA512
35886abd82f24c3a96300271fb5fcb11a5fcb3328d456547c4dbed1e98024a5b895404f6d189225f0c26d891cfc6e95a33ccd5a3e034ccfeb138215454629460

Download Submit
C:\Windows\SysWOW64\Nnneknob.exe

Filesize
57KB

MD5
0906b7fe87f79d3c170f44c95b818363

SHA1
47917a50f8f3c299f0fb7d5d03fa29be631a354d

SHA256
3b9a6d969e88e0b33d8f86bb520576d8586911e2c9b2fd3352c10906d7a21001

SHA512
4629904a170d9d3cbab18d6ad42f0259f2e808f12cbbafa4f11d004cfa2ed851785fe76e13c219d274947991e99fe6d2793729332d82ab9840cc8dee3a1615dc

Download Submit
C:\Windows\SysWOW64\Nnqbanmo.exe

Filesize
57KB

MD5
766003036fe42a5e4d4fd8825a578554

SHA1
0fe8aa09b45b3f4196b5b84ee1db0b97d6eef97f

SHA256
b697443bc5cf010419b413bfc26f3e8d4cce0e4d2ddc1bdc488f11a78c7ed68d

SHA512
c52560071cf927cc4f20799b13b62ea4a7ca67ca2aaa8153a3ad17363e53214e60a04f0df268c988104995ae7aa757df14c3d85fb95938d0d05ece358b83d38f

Download Submit
C:\Windows\SysWOW64\Ocbddc32.exe

Filesize
57KB

MD5
88e55739de1e7ac90888997399a3b659

SHA1
cde4ef6d8cc9120ecbb1aa59a1d47badc7c1d4b2

SHA256
8912939e33b3cc75ab4adefbd268f3463862b0b07701513cf04c77b90b3a9c0c

SHA512
2b7f1a510ea53e8158f5fb7e9565b615e12e7fcc2dfe2944139441814ab9a35297e5e4af01d8063b184be13c726c9d3d0dec465132fdf558a6c80a28fbdaa3ba

Download Submit
C:\Windows\SysWOW64\Odednmpm.exe

Filesize
57KB

MD5
95772dc6ffef081f11fcf58edc81d413

SHA1
90c73c3c966a492b81e6092a5f62b3b23e529dce

SHA256
c3c1761f6c493972f8e3e27f8a9c5bfcf665f83e4288c4d302d5c14bc9633941

SHA512
c36d8602f88d66666bb889abcc8a4ece83236a7921d965062eaa4865c63fc23bb593b2ea3d9e35f0c0882614ef34e32e782084446ce16cf7e80ba4badfc70e66

Download Submit
C:\Windows\SysWOW64\Ogcpjhoq.exe

Filesize
57KB

MD5
a778c257a51a75ed4144e97de37d4346

SHA1
df6ef4d0b3b9264d978d58deb0a686321de705b2

SHA256
6011a905f49fca2c78ef9a10b1e74198884a8053f649464616e084c7154662c6

SHA512
9c2418f769fc39365d0f7044e117844bb9bba0cfa09227ea765d1e0e4cfa1938b4f6da5052309b5e0ad25f102bfbc80c8d148c5fa3b7c65683cd47b8c212aa38

Download Submit
C:\Windows\SysWOW64\Ojalgcnd.exe

Filesize
57KB

MD5
73f0d2297512f91b3a395a9c4f738afd

SHA1
3383a8f3b978825c809877e02071cb0e6dac5a87

SHA256
b7a9ad868ca36a6bef14ddfb7479ce521871582231a145e1efa95800b7b86aaa

SHA512
1dde7ff856f4b921648b4487474ce748b6b3d449b5c222897d0506be3c7ae65c5aa13f1853deab3f347b9a7df13a3aaee000eaf501668bad440dfd996df3c415

Download Submit
C:\Windows\SysWOW64\Onhhamgg.exe

Filesize
57KB

MD5
ae0cea1c2104febd36f7b177017da846

SHA1
d3c06eb215cd54e8d3b235ac005c258ae481b344

SHA256
9ac654091c995565015c1f748ea11d7b7a5d953c2c329b28335071190f05484d

SHA512
438c884d99f363678626902f5d6a9b6759fcd98577ffe6e0e21d521ea1225c372826a4658b8cc10aa03b8c4b7e8ce2796485c62d5410e370c90fd6bbb6e102c3

Download Submit
C:\Windows\SysWOW64\Onjegled.exe

Filesize
57KB

MD5
5418db16c4115f0b1954d7397ac01e84

SHA1
ae8dcffe7e0e1736e77b7c56a1d45a084752074a

SHA256
abdb005378865ccf5d27be7323e48db35016c94a3d39b5de7cdead458f17549c

SHA512
e2cd8eac0239218a62eae9e9eac01ea89478ce7e1f0ee853af1c7c7d32723a44f90aa953ca79fc10f1897c383194d7a7253a0ae82263d0bfad0b741dcc54f94e

Download Submit
C:\Windows\SysWOW64\Onmhgb32.exe

Filesize
57KB

MD5
604f5b0581dbb11ddef492bc04ffb38f

SHA1
5beeb94aca093d062f9655a94ce75a11c7b79639

SHA256
7a16dc8bd272e675c7894d674bf1eb6279239a8c8a66d30feb9ed29aff33c6bf

SHA512
d86586841a8ea516bf650cc67d9d464efe334896660b7c0d7333b0bf49fc69025e58d03cc4fca5e3b54ed310eb89265d8331a6ba9a56a0b68d63385c526bac29

Download Submit
C:\Windows\SysWOW64\Oqkdcn32.exe

Filesize
57KB

MD5
82e3c7354db3b33e30cc3928b27fdcbc

SHA1
cc9278264f90db40fcdde0f464f6201c1da06e41

SHA256
56f13e494468912524ad52b51a506056ffa07e8c4d909cfe947dea500a4101db

SHA512
e76c470f4e51a713508b99a55321f2953f4917ad3fe37325578513817c234f8fe783f9dfa0a8f3581a90fec5c1bf52da96fae57a14ca4bba33c59a046d3df288

Download Submit
C:\Windows\SysWOW64\Pagdol32.exe

Filesize
57KB

MD5
5d72581ac5fc082a4e5c9dbb46dc85d8

SHA1
decb5d6cd45ae13c8ba62bf221c2c8889e38350b

SHA256
bbb305f5559b11e338eefa5327844ea9e1fb40ecf590721449dc89abdbac671d

SHA512
38c8b3af023e90de7889b792a6356cf1a8ab8c67ecc48c2e60a04444dcfb145eef7bbca3e0a69924866380d7d6d9bb9739d65aa84613d8b41e6b7860dbbe28f3

Download Submit
C:\Windows\SysWOW64\Pbbgnpgl.exe

Filesize
57KB

MD5
befaef70d24f638180e601c8046149df

SHA1
8531c1cd4522d37e9148ef1954af43815d82e15f

SHA256
3031d71282c0c8b2a2e689d2e9ed8a64d4a33a7483d2fde96dc084d96df7dc47

SHA512
5241e36021f356aa9d9c8a63349e2d12c43bc8aa9838d3936c5444002366f9b8997e75a55d1c337f3b01ecdee9388a5ad2c0ae20e0e1804dd9d8378de2978e6b

Download Submit
C:\Windows\SysWOW64\Pbkamqmd.exe

Filesize
57KB

MD5
13e3c5e398cdc0379b40ce9d7cd90ac8

SHA1
0f27e3d5ab8bf5868a7ac36359cae4043350d4be

SHA256
10c5646f1c93e304a992d3c97ed79e9444ef97c373042d560fadf678794a023f

SHA512
348765f55aad58ecf8c51463e9bd283b8389957f97f57e093c3882e4b62b427f9967d4b0a3fd18daae1d777cd62af2ec2369816652406c59d8263229acb50f67

Download Submit
C:\Windows\SysWOW64\Pbpjhp32.exe

Filesize
57KB

MD5
b37162eeb49c0dcf462eb41e326667a8

SHA1
2b5fcd7e30966010409fb20e9ae98daea97dca91

SHA256
5113b5e1b16cfc891eb73d4894305d1473da6bc6294d035cd8407d87bd3c39af

SHA512
1c30ef2493e3d4515e47f58bf817eb0a99bec004d3aaf006c349ac0747dac9f686662af2ecff09d4cd253d2174b811fc68704f79f143bfb8650bf8f594ac26fb

Download Submit
C:\Windows\SysWOW64\Pcjapi32.exe

Filesize
57KB

MD5
4b59741a6a45eb657f4d2aa8a9c87e80

SHA1
49f0d4508f75cbb99391c0c23058e127fd06c6c9

SHA256
0cfe36615c2ddfa13f1e92ee82a0de303b451daac86435c59ffbf94be107e7c4

SHA512
a058a8f5bb5d1b0ddca0c17c3e88adcc108fbd0b4344c4d4b7ad51e57ebd2b25bec2c024e6034007b75b672a188ee6ae4656161b62d318b382e3273d84d5e66c

Download Submit
C:\Windows\SysWOW64\Pcncpbmd.exe

Filesize
57KB

MD5
f790502000c8222670ec9e51ef67e438

SHA1
1c4601a0e75cfc9382458aa238c8fc80a15b448b

SHA256
e229773df162c50c31f3001814597557045e4bfb6633641fd5ee0701d70f0346

SHA512
a54e710428a500393dd5d6ea8b632e77fcadea1e85f0f671e255d111377b600fb62510aa9f1d591a29f513404f0b441d59aaa4702045e75fe5fad6cea82f486b

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
57KB

MD5
fb0f16af84de2e325584d59cc457f0e1

SHA1
d7766a1b8a378e43f3fd03e0513a453fb5899e9c

SHA256
5c07286d04287a67d42e9ef4fb6614ab5d49b186f4c638b952e5f9a669e8e69c

SHA512
a71852da9e0a775bee56bd5e677046987af1610accd970141b2a3f9c2fe42e9df9cc3030fed1afe5827fb20310b2279c4e2102503b98321d20bd3ba3e468ce35

Download Submit
C:\Windows\SysWOW64\Peimil32.exe

Filesize
57KB

MD5
f223e7421322ba3871ab5acb16edc5a3

SHA1
a3b13bd1fe30e21c57c142b00397db107c7a6021

SHA256
81fdabfff8b8a6c1a64487f5342657a7ce651563c78feeccce7eaa201b0fea8f

SHA512
c46fda0fb3549e37d4372177ae9e36c1b2582d7a0c6c45e04600a763ae662408ac11cbe9bc019c5de56178d0123feecd4c361733f826cd06bbab3fcc4d2b6e98

Download Submit
C:\Windows\SysWOW64\Pengdk32.exe

Filesize
57KB

MD5
adef3276196497b6e6bbc6eadc2bb80e

SHA1
d04edef037039563dfc6304758531a53b1707021

SHA256
0675e0dd7451c9e1c6d2f33a3e1f84b338e7b6eff9beb6f3dd91fbfd69099ce2

SHA512
7343a79bfdd44e59baf30c9f2416382292557319ba51d1f675c1af0366064685c86bfeecdae1f4e7847bf664cc53b975e6f533272ea256fa24c914d19770a6ab

Download Submit
C:\Windows\SysWOW64\Peqcjkfp.exe

Filesize
57KB

MD5
0f840b354d94122febf2a624364388dc

SHA1
2bcea15ce6241752fdc5a55abf128d0caaeabe1c

SHA256
3bf98d7d18c53a9cb873a61f81b641f4ccb3eb545e8edde71e58e3874cdf8eda

SHA512
328959e2db329d707f7460c2d428fe89d020a8767684c4a429ea0afd4b032f083bf8850fb0c7d9019128142482f38e9a4c45eadb53778f18cffff3942e70df54

Download Submit
C:\Windows\SysWOW64\Pfjcgn32.exe

Filesize
57KB

MD5
3fb344f4d63fe2a838e6d21c83fc6841

SHA1
d6cc98d7f3f9cb08ee4109e98911e0efafa86da8

SHA256
e68433d0e687383e93c32124dc01cdcb853c1c6d5d514f7fae3c1d5fd37f769f

SHA512
0e5bf95d41bfb99720963d9d2859a7ef03963d18ec5a907fcc257b03f1086436812d7ea18ba5fb6ff97140c9a50c967bcb06f20dfd573b285818a9221f25d9a0

Download Submit
C:\Windows\SysWOW64\Pghieg32.exe

Filesize
57KB

MD5
daac201aa134ca17b5c6ab1f9cc27a0b

SHA1
b66532b78129492e5042e37f38130aa8247236b1

SHA256
8146820eb4713f697295e1af9258233793af1f66286cbec4dd3f9592ba4a5821

SHA512
97dd96272c3f13923f8bbc395547281ef35074d854b0d90ebf43f2a81f64831e45d016f424d18fc2bc4ff14191790926d670b8e5f10aa3d0f8f7d535c7eae5c4

Download Submit
C:\Windows\SysWOW64\Pgjfkg32.exe

Filesize
57KB

MD5
85e7fd3291cd69e09afeb32544ea6791

SHA1
686d348320c3e9eddc4ae5e0aa842122ee0336f3

SHA256
6c0f158ddf225fc195ff0e1432ffcbad6417ecbdd4f6b0d9b6ea5f56adcb7760

SHA512
aabeddbb0f4015ede04189f830565d0a0aa0bea314466be870d3b074a80c00a23cd9d633e29dd741ce03c3608f797d2efd975390836074a359bfd2ef7ed3b1d1

Download Submit
C:\Windows\SysWOW64\Pgmcqggf.exe

Filesize
57KB

MD5
72f6e07f502b50c9c9fe1060a26e9e36

SHA1
cc0db57bc645ac89eaa1a9a8c3c2adadad1ea507

SHA256
635580adc3f6f23f5ed3a3b34d50c2c43316a3cab8ccc0d8b9ed49ff77286326

SHA512
cc43ba67a2e9d92c199f7d9040510345922bd46bd168d77febb00004b7573dbf4d3c548b66b14dfbf65d672c2025243e1278ccca1c409c19df1698bde3ebf9b4

Download Submit
C:\Windows\SysWOW64\Pgopffec.exe

Filesize
57KB

MD5
82c066e2ac43a4759dd751671de16c0e

SHA1
bad05b0106903dc674821e52ef6689662595881d

SHA256
b45f8c3364b1a78e228a2ae5e191225a378df0e37b54bd00172d51ac3c9ec20e

SHA512
429901add6d4b63713fe1312f4f6ff2bc642d0cdb682c3a3b379102d3190c32e14bf09b2b73652ca294a4b8510dedea7e7e4f790ce4b70a31981f4c95e8699cf

Download Submit
C:\Windows\SysWOW64\Pjcbbmif.exe

Filesize
57KB

MD5
21570d483a39d666e4cb85eb58a6399a

SHA1
6bef96b8c7b730abdf51e7bd9183fe8367d661d4

SHA256
6f14a6cfb93d36397ae855857dc682d385a63d829a430f69fa9e8b2faac1c17d

SHA512
a0cf68e73ca66f4c41b0a529741b35553ef4149eb7682e801e7b55f25572e2d12fba31519d6e118376ebf939054b91fbb55dbc44ead1f30f4b8cf9b4b72ad7e3

Download Submit
C:\Windows\SysWOW64\Pjkombfj.exe

Filesize
57KB

MD5
50772c3323c65eb9dd227592084659ce

SHA1
42b4caa4832b404c6c7f005d0e20e3028deac3b9

SHA256
22d1742f6ae4cf0ae3ac7214921ad6fdce24dd1a8c3a96ecb16af788f8721b72

SHA512
127dd519a8427e2fa8c1abfc8a1c276fd1df3eb97fc57b6a67a0cb771274a69c5a9e8ea751ae0dd65b397b28bde50e310a6c735914583d57036bb9405d7ebead

Download Submit
C:\Windows\SysWOW64\Pkaiqf32.exe

Filesize
57KB

MD5
a99336cf8a3389d5b565cdd6e40b47aa

SHA1
56aa3aa8a90ceb50bc3bb9965ba12e6c02434cf7

SHA256
d7ca734170b7ff6b3f72896908b8d581c92e80a27d688055160dc1bc36854ebe

SHA512
9c66950ec58a73125cdefed168f5ee8c7e340128311957f6686074e19029c4a1c186231056e367bb72cc001f887f30fccbe34efe1a17cf2aa288e5125abc6e43

Download Submit
C:\Windows\SysWOW64\Pkfblfab.exe

Filesize
57KB

MD5
9dcc8cf4e59dd956d7a6e0fbc82102a3

SHA1
3b174f4b298cd12782685f05b4eb571de8d103d9

SHA256
77d302aa6e86e6dd84490de4e921b3b29da538c539bc06b58156507272717c09

SHA512
563bf4a32714324dbe2733bde14a35809c7e5d20646b27e188576d14e21df1f60f9d0504532b3ba4e72729db300e32c45296bfaa79abad0ea82fd357d34f7060

Download Submit
C:\Windows\SysWOW64\Pkjlge32.exe

Filesize
57KB

MD5
6d58a77fe8f07fd9d2071893816c49c0

SHA1
b518fd67f684de42e00a59041ca84bb8b151b84f

SHA256
e3f88935212597285d140d3535815a31257d5face24e506508fe67f1e4bc840d

SHA512
a45dd8cb4a6233ebaf7c6d20503800a0e4513aa47038a4164e346a9e5634f9bc784d2329ab6dbdaa0a246966ceb47a1a3a7e23479b86c6a93bed7de00daeb6ca

Download Submit
C:\Windows\SysWOW64\Pnbbbabh.exe

Filesize
57KB

MD5
a89314ca5b096f734ec6cefde8380929

SHA1
a9c24e7948f598462aced798a23516e3b824ee08

SHA256
479a26f6cc3001976b42218546793a8e1c54dd51506c7ee1ee286d1edd2f3b6c

SHA512
8f62be9fbe212bb261280c808312c3c10fdb882b517e2f24a2fa0e29474c92f78b5e1b740224d43c485efa9bfe9edc9866577cbde14c24b7bc4b9190d8a0f188

Download Submit
C:\Windows\SysWOW64\Pnihcq32.exe

Filesize
57KB

MD5
c5df7c3ddf2c09ceb985143b4197a42b

SHA1
7ab1aa2cac3f2824c37aca4228a15477ed897ae7

SHA256
013f2e4b078f87880012a3c1f508f8cebc4e524c12fd121de0cbf2c008d8883f

SHA512
b905f41171e6938c4dbbaeb2f00a4a939022d44d24332e475d038106d2348e2d2dfb4dc73e45d20d4e07f55437d831160c57f459a800f2490c2fd9328d3989b1

Download Submit
C:\Windows\SysWOW64\Pqpnombl.exe

Filesize
57KB

MD5
bcf346b5b6fad40b491bdfeb25fc6c18

SHA1
65d3731f5fa4e6c39b074272671ecb505071babf

SHA256
59cb13550f575694624fc308f3cb6b3ccfb190fdacaf9daad93aa5968f68e66e

SHA512
52a68d32ff5f1a6441b4c4b56ae2bea3d4989dc3bd63afc4ee8d825a07c338f53a8d2beb42cc3f9a072ce56a4291f790786a95c0012411c9956334a4ad86a13e

Download Submit
C:\Windows\SysWOW64\Qceiaa32.exe

Filesize
57KB

MD5
9596bdc4903e62b4a2116c9a8f1db18c

SHA1
f02dd4d8a0b4b6f2105b0391bf037b4693bf44df

SHA256
90e37ca828e6150f758da9f1a3a29aa26fa935ac4efcef28c2d395777f8b7237

SHA512
5d3d104f577733793281f391290c89cff1895d06177a02bcc4e7483a4e7c33bf40169e043ac776317d96df786f6cd3ae9ad104fd15b4d8c1263454cb1d4ff62c

Download Submit
C:\Windows\SysWOW64\Qcepkg32.exe

Filesize
57KB

MD5
125f04bcc8ea6a98f97cfd2aed59a3c1

SHA1
c3eeca4d4aa5cc6bf8623df50873f3488b968d56

SHA256
02b8d1e3a729aaa943bd657568c75bcd25447af2cbfff05b2459e02ab07dc0de

SHA512
bfbd03cdc5c5be0c9055f0be4b8c6ea7359ecf6c8d2acefefd0ec4a3660dec1ec05f5918160158c3d641ae822e798eaef0b56e9e2757446f419edbb4e4bce76f

Download Submit
C:\Windows\SysWOW64\Qeemej32.exe

Filesize
57KB

MD5
d4d2e18368de8e5d78e2fefac1ddf7f5

SHA1
35b29eb29e4efc9d8b304407b3d38c12407146c7

SHA256
a66a2806f6bff26a1d554fad15f8dedf395d5bd85b88a5c5cf93b54d0b9bfbf0

SHA512
a7adf470d5b96908cac0789bc6b04227d0856edd7d4686fbc74768b72c0209ccfa546527fcd2541ad7fc0f180bbefca2e9d175c1329ea134deb9b5aa64737263

Download Submit
C:\Windows\SysWOW64\Qgciaf32.exe

Filesize
57KB

MD5
bfb427d695c80159506bcd86cc3a0859

SHA1
4011b51968d640dd3382cec8b48e5394f0cc2c1b

SHA256
b3a8e5d5c4a75cef1e4a478144775e6acdb5c1e94a85d220efa867996b6bac4f

SHA512
743b97f31f92059fb080f67b4673923835644b4198bf5abc2d2068d8b2ef677bc2119b39d6da548f636f053b3e504131985b6de1adc0f189e2db2d2b60586cba

Download Submit
C:\Windows\SysWOW64\Qjbena32.exe

Filesize
57KB

MD5
d167a2c700663fd2c1cd1d862490c579

SHA1
d41eec36f19463d039ebb4213e3a63b93d940a57

SHA256
555d221db3471b4266bc0905893c094a0942335e457f698504928e21518bffae

SHA512
0862885f400d1a4345549c743eaec3043c0edcd1f43b728ee53667ea6d28b7fa5328e7a2c8880670d0947182f73723a33246e7b53aeb7e2515b151d4e86f7f8c

Download Submit
C:\Windows\SysWOW64\Qkmhlekj.exe

Filesize
57KB

MD5
791dad6b566bce3bfc7391d4ed67a50c

SHA1
2c8ded036f8e9bbe909b75114aab4480df94bf85

SHA256
4eb11a2dd598a63d6fef5ce3b38c69f41ee87ceae4b249376f359ffee5e78021

SHA512
263545b82bf42ebeced798fba4eaef68a64f3c111c46cadd0373ecb39945d9aaaa92874f2a8f8d16f0f0ca9fb477d6d0f5950bf59ebcc97a5ad81328151193c9

Download Submit
C:\Windows\SysWOW64\Qnhahj32.exe

Filesize
57KB

MD5
97fa9fe89e262c027b9e7366255e42e2

SHA1
999605e61b741091c9c07c6f6bbf256be07246cd

SHA256
a0cd9a14fe9d98bc422373fdbdebd98c7b2ac15590fbe41c74c6c1f4b0ce6297

SHA512
fab0c6ca21d0bc93e794c1be3c95e28ee096eed91ca43ef38020c25c5e44d509283dc1a9a5d7da2c842214fdd9137b980a304fb0abc8a62b203a820b4ba85135

Download Submit
C:\Windows\SysWOW64\Qnkdhpjn.exe

Filesize
57KB

MD5
b62a0cf76f8429636285de78fcd20e50

SHA1
33670d51c73874f4217e859f10ad8a8bc5abd65c

SHA256
050d3918c7e628836789d182b6cd2ddcb1936f117b5039936b4939111255b9e5

SHA512
0c5176b42db7386bc8beff8d3e538822030798b0dd0899baabe98a425be441b8e5f8742ecf9d2af00a70b916e87e568df3ced78abbaae92cd3cde0cbd5b3f958

Download Submit
memory/32-281-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/224-411-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/388-173-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/816-377-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/876-105-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/968-347-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/988-502-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1120-419-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1328-353-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1336-209-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1404-323-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1420-593-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1540-335-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1548-592-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1548-48-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1556-558-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1556-13-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1664-233-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1696-489-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1744-478-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1796-429-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1824-246-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1888-449-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1924-279-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2028-515-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2056-293-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2060-467-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2160-152-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2180-417-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2200-405-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2264-73-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2268-455-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2336-521-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2360-465-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2428-566-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2472-559-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2544-229-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2716-287-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2816-393-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2844-364-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2856-160-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2896-101-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2900-268-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2956-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/2956-551-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2956-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3048-332-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3104-441-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3208-503-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3240-572-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3240-25-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3288-573-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3316-580-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3452-447-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3548-317-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3572-311-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3588-184-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3604-81-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3664-365-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3676-435-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3680-494-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3740-181-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3764-399-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3772-65-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3800-383-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3928-57-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3928-599-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3948-539-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3988-527-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4160-112-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4168-299-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4172-371-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4232-483-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4236-305-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4264-88-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4320-17-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4320-565-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4348-345-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4472-586-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4492-257-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4512-253-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4592-269-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4612-579-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4612-32-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4640-193-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4664-201-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4672-141-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4712-145-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4728-133-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4872-552-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4936-120-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4952-217-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4960-533-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4972-45-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4988-545-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5052-509-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads