52d696f0794b65416f3f08def18e2f68e050edbab600773b113d691864a87c15

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20ad69e4d38b51af97935e12947fb3b0_NeikiAnalytics.exe
Size

128KB
MD5

20ad69e4d38b51af97935e12947fb3b0
SHA1

3f1e893db6b4f42f798c55e352a15e632390fe1c
SHA256

52d696f0794b65416f3f08def18e2f68e050edbab600773b113d691864a87c15
SHA512

6a4944c72a9697d4889ce8003c0d380209a35c4a691f44201660051a841ee74b44c9d662b17fc657d9f51e284af4ba7d2ffde77e01bd82580b964046e1242180
SSDEEP

3072:v9qTflk26pHDfaDZbHZMooiUDrLXfzoeqarm9mTKpAImA:1qTfq26pHStZ5eXfxqySSKpRmA

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceoibflm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoiafcic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hfcicmqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qqfmde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldoaklml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojllan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlmllkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Immapg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Meiaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Liimncmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Likjcbkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbfkbhpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncfdie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndfqbhia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjcbbmif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hioiji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jeklag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldanqkki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbjlfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmppcbjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcfqfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfembo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpijnqkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mipcob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Megdccmb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncdgcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnlhfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odapnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dboigi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkffog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlpkba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpjcdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ldleel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Medgncoe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfpcgpae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmhhehlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lljfpnjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edkdkplj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fkffog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgkjhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fohoigfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgokmgjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhfonc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jefbfgig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhemmlhc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcpclbfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmhhehlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bopgjmhe.exe

Executes dropped EXE 64 IoCs

pid	Process
2276	Bjbndobo.exe
3652	Behbag32.exe
1204	Bhfonc32.exe
1148	Bopgjmhe.exe
1464	Baocghgi.exe
1624	Bldgdago.exe
1984	Baaplhef.exe
2632	Bhkhibmc.exe
2860	Ceoibflm.exe
3168	Chmeobkq.exe
2412	Cafigg32.exe
2328	Chpada32.exe
3672	Cojjqlpk.exe
2924	Cdfbibnb.exe
3692	Clnjjpod.exe
2724	Cajcbgml.exe
4504	Clpgpp32.exe
712	Camphf32.exe
3020	Ckedalaj.exe
4496	Daolnf32.exe
4872	Dkgqfl32.exe
3216	Dboigi32.exe
2268	Dhkapp32.exe
1444	Dbaemi32.exe
1744	Ddbbeade.exe
4972	Dohfbj32.exe
1704	Dhpjkojk.exe
5044	Dojcgi32.exe
4236	Dedkdcie.exe
2380	Ekacmjgl.exe
4300	Edihepnm.exe
4968	Ecjhcg32.exe
1192	Edkdkplj.exe
1800	Ekemhj32.exe
1000	Eapedd32.exe
2540	Eleiam32.exe
4456	Eabbjc32.exe
2488	Ehljfnpn.exe
2344	Ekjfcipa.exe
3052	Eadopc32.exe
1600	Ehnglm32.exe
4112	Fohoigfh.exe
1516	Fdegandp.exe
1996	Fkopnh32.exe
4648	Faihkbci.exe
2444	Fhcpgmjf.exe
736	Fkalchij.exe
3084	Fakdpb32.exe
1976	Fhemmlhc.exe
1244	Fkciihgg.exe
2312	Ffimfqgm.exe
3256	Fkffog32.exe
3436	Ffkjlp32.exe
3660	Gkhbdg32.exe
2056	Gdqgmmjb.exe
4524	Gofkje32.exe
2156	Gfpcgpae.exe
2608	Gkmlofol.exe
4920	Gcddpdpo.exe
3624	Gdeqhl32.exe
4532	Gcfqfc32.exe
2432	Gfembo32.exe
4940	Gcimkc32.exe
3100	Hmabdibj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Amddjegd.exe	Ajfhnjhq.exe
File created	C:\Windows\SysWOW64\Gdqgmmjb.exe	Gkhbdg32.exe
File opened for modification	C:\Windows\SysWOW64\Olhlhjpd.exe	Ojjolnaq.exe
File created	C:\Windows\SysWOW64\Jholncde.dll	Meiaib32.exe
File created	C:\Windows\SysWOW64\Accfbokl.exe	Aadifclh.exe
File opened for modification	C:\Windows\SysWOW64\Beglgani.exe	Bmpcfdmg.exe
File opened for modification	C:\Windows\SysWOW64\Cjmgfgdf.exe	Cdcoim32.exe
File created	C:\Windows\SysWOW64\Hmabdibj.exe	Gcimkc32.exe
File created	C:\Windows\SysWOW64\Kpjcdn32.exe	Kipkhdeq.exe
File created	C:\Windows\SysWOW64\Cfpnph32.exe	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Jlingkpe.dll	Njnpppkn.exe
File opened for modification	C:\Windows\SysWOW64\Bgcknmop.exe	Beeoaapl.exe
File opened for modification	C:\Windows\SysWOW64\Ipnjab32.exe	Iicbehnq.exe
File created	C:\Windows\SysWOW64\Mgkjhe32.exe	Mdmnlj32.exe
File created	C:\Windows\SysWOW64\Pmfhig32.exe	Pjhlml32.exe
File created	C:\Windows\SysWOW64\Eflgme32.dll	Bgcknmop.exe
File opened for modification	C:\Windows\SysWOW64\Pqpgdfnp.exe	Pjeoglgc.exe
File created	C:\Windows\SysWOW64\Blfiei32.dll	Pdmpje32.exe
File created	C:\Windows\SysWOW64\Fgfkkboc.dll	Eadopc32.exe
File created	C:\Windows\SysWOW64\Ogpmjb32.exe	Odapnf32.exe
File created	C:\Windows\SysWOW64\Bcfmgfde.dll	Ddbbeade.exe
File created	C:\Windows\SysWOW64\Fdegandp.exe	Fohoigfh.exe
File created	C:\Windows\SysWOW64\Dmefhako.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Ejckel32.dll	Jmknaell.exe
File created	C:\Windows\SysWOW64\Llemdo32.exe	Ligqhc32.exe
File opened for modification	C:\Windows\SysWOW64\Ojllan32.exe	Ognpebpj.exe
File created	C:\Windows\SysWOW64\Gdeahgnm.dll	Amddjegd.exe
File opened for modification	C:\Windows\SysWOW64\Dkgqfl32.exe	Daolnf32.exe
File created	C:\Windows\SysWOW64\Ibcmom32.exe	Ilidbbgl.exe
File created	C:\Windows\SysWOW64\Lbabgh32.exe	Ldoaklml.exe
File opened for modification	C:\Windows\SysWOW64\Ogkcpbam.exe	Odmgcgbi.exe
File opened for modification	C:\Windows\SysWOW64\Pfjcgn32.exe	Pdifoehl.exe
File opened for modification	C:\Windows\SysWOW64\Bfabnjjp.exe	Accfbokl.exe
File created	C:\Windows\SysWOW64\Kiidgeki.exe	Jcllonma.exe
File created	C:\Windows\SysWOW64\Bdkfmkdc.dll	Kplpjn32.exe
File opened for modification	C:\Windows\SysWOW64\Clnjjpod.exe	Cdfbibnb.exe
File created	C:\Windows\SysWOW64\Dfdjmlhn.dll	Ognpebpj.exe
File created	C:\Windows\SysWOW64\Bmkjkd32.exe	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Pkfhoiaf.dll	Ojgbfocc.exe
File created	C:\Windows\SysWOW64\Odocigqg.exe	Olhlhjpd.exe
File opened for modification	C:\Windows\SysWOW64\Mlcifmbl.exe	Miemjaci.exe
File created	C:\Windows\SysWOW64\Kmdjdl32.dll	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Ickchq32.exe	Ildkgc32.exe
File opened for modification	C:\Windows\SysWOW64\Lbjlfi32.exe	Kplpjn32.exe
File opened for modification	C:\Windows\SysWOW64\Lgmngglp.exe	Lbabgh32.exe
File opened for modification	C:\Windows\SysWOW64\Nnlhfn32.exe	Neeqea32.exe
File created	C:\Windows\SysWOW64\Nokpao32.dll	Daekdooc.exe
File created	C:\Windows\SysWOW64\Gjdlbifk.dll	Jlpkba32.exe
File opened for modification	C:\Windows\SysWOW64\Leihbeib.exe	Lbjlfi32.exe
File opened for modification	C:\Windows\SysWOW64\Faihkbci.exe	Fkopnh32.exe
File created	C:\Windows\SysWOW64\Dlgnafam.dll	Daolnf32.exe
File opened for modification	C:\Windows\SysWOW64\Edkdkplj.exe	Ecjhcg32.exe
File created	C:\Windows\SysWOW64\Cefofm32.dll	Jpgmha32.exe
File opened for modification	C:\Windows\SysWOW64\Ldanqkki.exe	Lljfpnjg.exe
File created	C:\Windows\SysWOW64\Medgncoe.exe	Mbfkbhpa.exe
File created	C:\Windows\SysWOW64\Ijnlbk32.dll	Cojjqlpk.exe
File created	C:\Windows\SysWOW64\Dkgqfl32.exe	Daolnf32.exe
File created	C:\Windows\SysWOW64\Jocbigff.dll	Pjeoglgc.exe
File opened for modification	C:\Windows\SysWOW64\Meiaib32.exe	Mckemg32.exe
File opened for modification	C:\Windows\SysWOW64\Ncfdie32.exe	Nlmllkja.exe
File created	C:\Windows\SysWOW64\Panfqmhb.dll	Pgefeajb.exe
File created	C:\Windows\SysWOW64\Ingbah32.dll	Lingibiq.exe
File created	C:\Windows\SysWOW64\Pdkcde32.exe	Pqpgdfnp.exe
File created	C:\Windows\SysWOW64\Pfaigm32.exe	Pcbmka32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8748	8652	WerFault.exe	374

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	20ad69e4d38b51af97935e12947fb3b0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmbcpkhj.dll"	Bjbndobo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fkopnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qfcfml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dekclg32.dll"	Gcddpdpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hflcbngh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehmdjdgk.dll"	Qffbbldm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekacmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcdgbkil.dll"	Liimncmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pllfhkno.dll"	20ad69e4d38b51af97935e12947fb3b0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ldanqkki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Megdccmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdfbibnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gcimkc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nnlhfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdlbjng.dll"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Baicac32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Higchddh.dll"	Dojcgi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fkalchij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jefbfgig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kpbmco32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfdjmlhn.dll"	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nconcm32.dll"	Baocghgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Baaplhef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhpjkojk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekemhj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ipnjab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jeklag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edgbbfnk.dll"	Kbhoqj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dboigi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbglkbhg.dll"	Fhcpgmjf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Immapg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jeklag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjbndobo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlajgl32.dll"	Cajcbgml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Benlnbhb.dll"	Lekehdgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ceehho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhkapp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Miemjaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihoofe32.dll"	Ickchq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mdmnlj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pqmjog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjlogcip.dll"	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfihel32.dll"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgnkd32.dll"	Nnneknob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbnamnpl.dll"	Pfjcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ekacmjgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eadopc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bilonkon.dll"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgngp32.dll"	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aogmoeik.dll"	Faihkbci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmehcnhg.dll"	Ipnjab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kiidgeki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibbmq32.dll"	Neeqea32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 2276	4876	20ad69e4d38b51af97935e12947fb3b0_NeikiAnalytics.exe	83
PID 4876 wrote to memory of 2276	4876	20ad69e4d38b51af97935e12947fb3b0_NeikiAnalytics.exe	83
PID 4876 wrote to memory of 2276	4876	20ad69e4d38b51af97935e12947fb3b0_NeikiAnalytics.exe	83
PID 2276 wrote to memory of 3652	2276	Bjbndobo.exe	84
PID 2276 wrote to memory of 3652	2276	Bjbndobo.exe	84
PID 2276 wrote to memory of 3652	2276	Bjbndobo.exe	84
PID 3652 wrote to memory of 1204	3652	Behbag32.exe	85
PID 3652 wrote to memory of 1204	3652	Behbag32.exe	85
PID 3652 wrote to memory of 1204	3652	Behbag32.exe	85
PID 1204 wrote to memory of 1148	1204	Bhfonc32.exe	86
PID 1204 wrote to memory of 1148	1204	Bhfonc32.exe	86
PID 1204 wrote to memory of 1148	1204	Bhfonc32.exe	86
PID 1148 wrote to memory of 1464	1148	Bopgjmhe.exe	87
PID 1148 wrote to memory of 1464	1148	Bopgjmhe.exe	87
PID 1148 wrote to memory of 1464	1148	Bopgjmhe.exe	87
PID 1464 wrote to memory of 1624	1464	Baocghgi.exe	88
PID 1464 wrote to memory of 1624	1464	Baocghgi.exe	88
PID 1464 wrote to memory of 1624	1464	Baocghgi.exe	88
PID 1624 wrote to memory of 1984	1624	Bldgdago.exe	89
PID 1624 wrote to memory of 1984	1624	Bldgdago.exe	89
PID 1624 wrote to memory of 1984	1624	Bldgdago.exe	89
PID 1984 wrote to memory of 2632	1984	Baaplhef.exe	90
PID 1984 wrote to memory of 2632	1984	Baaplhef.exe	90
PID 1984 wrote to memory of 2632	1984	Baaplhef.exe	90
PID 2632 wrote to memory of 2860	2632	Bhkhibmc.exe	91
PID 2632 wrote to memory of 2860	2632	Bhkhibmc.exe	91
PID 2632 wrote to memory of 2860	2632	Bhkhibmc.exe	91
PID 2860 wrote to memory of 3168	2860	Ceoibflm.exe	92
PID 2860 wrote to memory of 3168	2860	Ceoibflm.exe	92
PID 2860 wrote to memory of 3168	2860	Ceoibflm.exe	92
PID 3168 wrote to memory of 2412	3168	Chmeobkq.exe	93
PID 3168 wrote to memory of 2412	3168	Chmeobkq.exe	93
PID 3168 wrote to memory of 2412	3168	Chmeobkq.exe	93
PID 2412 wrote to memory of 2328	2412	Cafigg32.exe	94
PID 2412 wrote to memory of 2328	2412	Cafigg32.exe	94
PID 2412 wrote to memory of 2328	2412	Cafigg32.exe	94
PID 2328 wrote to memory of 3672	2328	Chpada32.exe	95
PID 2328 wrote to memory of 3672	2328	Chpada32.exe	95
PID 2328 wrote to memory of 3672	2328	Chpada32.exe	95
PID 3672 wrote to memory of 2924	3672	Cojjqlpk.exe	96
PID 3672 wrote to memory of 2924	3672	Cojjqlpk.exe	96
PID 3672 wrote to memory of 2924	3672	Cojjqlpk.exe	96
PID 2924 wrote to memory of 3692	2924	Cdfbibnb.exe	97
PID 2924 wrote to memory of 3692	2924	Cdfbibnb.exe	97
PID 2924 wrote to memory of 3692	2924	Cdfbibnb.exe	97
PID 3692 wrote to memory of 2724	3692	Clnjjpod.exe	98
PID 3692 wrote to memory of 2724	3692	Clnjjpod.exe	98
PID 3692 wrote to memory of 2724	3692	Clnjjpod.exe	98
PID 2724 wrote to memory of 4504	2724	Cajcbgml.exe	99
PID 2724 wrote to memory of 4504	2724	Cajcbgml.exe	99
PID 2724 wrote to memory of 4504	2724	Cajcbgml.exe	99
PID 4504 wrote to memory of 712	4504	Clpgpp32.exe	100
PID 4504 wrote to memory of 712	4504	Clpgpp32.exe	100
PID 4504 wrote to memory of 712	4504	Clpgpp32.exe	100
PID 712 wrote to memory of 3020	712	Camphf32.exe	101
PID 712 wrote to memory of 3020	712	Camphf32.exe	101
PID 712 wrote to memory of 3020	712	Camphf32.exe	101
PID 3020 wrote to memory of 4496	3020	Ckedalaj.exe	102
PID 3020 wrote to memory of 4496	3020	Ckedalaj.exe	102
PID 3020 wrote to memory of 4496	3020	Ckedalaj.exe	102
PID 4496 wrote to memory of 4872	4496	Daolnf32.exe	103
PID 4496 wrote to memory of 4872	4496	Daolnf32.exe	103
PID 4496 wrote to memory of 4872	4496	Daolnf32.exe	103
PID 4872 wrote to memory of 3216	4872	Dkgqfl32.exe	104

C:\Users\Admin\AppData\Local\Temp\20ad69e4d38b51af97935e12947fb3b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\20ad69e4d38b51af97935e12947fb3b0_NeikiAnalytics.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\SysWOW64\Bjbndobo.exe
  C:\Windows\system32\Bjbndobo.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\SysWOW64\Behbag32.exe
    C:\Windows\system32\Behbag32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Windows\SysWOW64\Bhfonc32.exe
      C:\Windows\system32\Bhfonc32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1204
    - - C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1148
      - C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1464
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2860
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2328
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3692
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4504
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:712
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3020
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3216
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2268
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        25⤵
        Executes dropped EXE
        
        PID:1444
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1744
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        27⤵
        Executes dropped EXE
        
        PID:4972
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1704
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5044
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        30⤵
        Executes dropped EXE
        
        PID:4236
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2380
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        32⤵
        Executes dropped EXE
        
        PID:4300
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4968
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1192
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1800
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        36⤵
        Executes dropped EXE
        
        PID:1000
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        37⤵
        Executes dropped EXE
        
        PID:2540
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        38⤵
        Executes dropped EXE
        
        PID:4456
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        39⤵
        Executes dropped EXE
        
        PID:2488
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        40⤵
        Executes dropped EXE
        
        PID:2344
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3052
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        42⤵
        Executes dropped EXE
        
        PID:1600
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4112
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        44⤵
        Executes dropped EXE
        
        PID:1516
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1996
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4648
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2444
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:736
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        49⤵
        Executes dropped EXE
        
        PID:3084
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1976
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        51⤵
        Executes dropped EXE
        
        PID:1244
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        52⤵
        Executes dropped EXE
        
        PID:2312
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3256
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        54⤵
        Executes dropped EXE
        
        PID:3436
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3660
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        56⤵
        Executes dropped EXE
        
        PID:2056
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        57⤵
        Executes dropped EXE
        
        PID:4524
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2156
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        59⤵
        Executes dropped EXE
        
        PID:2608
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4920
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        61⤵
        Executes dropped EXE
        
        PID:3624
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2432
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4940
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        65⤵
        Executes dropped EXE
        
        PID:3100
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        66⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        67⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        68⤵
        Modifies registry class
        
        PID:4984
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        69⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5108
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4560
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        72⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3152
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1236
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1224
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2296
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        77⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        78⤵
        Drops file in System32 directory
        
        PID:4528
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        79⤵
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        80⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        81⤵
        Drops file in System32 directory
        
        PID:4692
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        82⤵
        Modifies registry class
        
        PID:3908
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        83⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        84⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        85⤵
        Drops file in System32 directory
        
        PID:5224
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        86⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        87⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        88⤵
        Drops file in System32 directory
        
        PID:5372
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        89⤵
        Drops file in System32 directory
        
        PID:5416
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5460
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5504
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5548
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        93⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        94⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        95⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5728
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        97⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        98⤵
        Drops file in System32 directory
        
        PID:5816
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        99⤵
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        100⤵
        Modifies registry class
        
        PID:5908
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        101⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        102⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        103⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        104⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        105⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        106⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        107⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        108⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        109⤵
        Drops file in System32 directory
        
        PID:5368
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5388
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        111⤵
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        112⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        113⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        114⤵
        Drops file in System32 directory
        
        PID:5724
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5796
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        116⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5936
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        118⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        119⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        120⤵
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        121⤵
        Drops file in System32 directory
        
        PID:5328
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        122⤵
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5588
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        124⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        126⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5824
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        128⤵
        Drops file in System32 directory
        
        PID:5932
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        129⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5232
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5848
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        134⤵
        Drops file in System32 directory
        
        PID:6044
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        135⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5800
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5968
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5496
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        139⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        140⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        141⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6164
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        143⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        144⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        145⤵
        Drops file in System32 directory
        
        PID:6292
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6336
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        147⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6380
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        148⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        149⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        150⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        151⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        152⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        153⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6676
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6716
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        155⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        156⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        157⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        158⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        159⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        160⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7056
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        162⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7140
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6160
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        165⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6280
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        167⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6416
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        169⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        170⤵
        Modifies registry class
        
        PID:6568
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        171⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        172⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6804
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        174⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        175⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        176⤵
        Drops file in System32 directory
        
        PID:7064
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        177⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        178⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6204
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        179⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        180⤵
        Drops file in System32 directory
        
        PID:6428
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        181⤵
        Drops file in System32 directory
        
        PID:6548
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        182⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6764
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6876
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        185⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7092
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        187⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        188⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7052
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        190⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        191⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        192⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        193⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        194⤵
        Drops file in System32 directory
        
        PID:6708
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7080
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        196⤵
        Modifies registry class
        
        PID:6736
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        197⤵
        Drops file in System32 directory
        
        PID:6368
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        198⤵
        Modifies registry class
        
        PID:7040
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        199⤵
        Drops file in System32 directory
        
        PID:6156
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        200⤵
        Drops file in System32 directory
        
        PID:6952
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        201⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        202⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        203⤵
        Drops file in System32 directory
        
        PID:7216
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        204⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        205⤵
        Drops file in System32 directory
        
        PID:7296
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        206⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        207⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        208⤵
        Drops file in System32 directory
        
        PID:7420
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        209⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        210⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7552
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        212⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        213⤵
        Modifies registry class
        
        PID:7632
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        214⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        215⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        216⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        217⤵
        Modifies registry class
        
        PID:7808
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7852
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7888
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        220⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        221⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8012
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        223⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        224⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        225⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        226⤵
        Drops file in System32 directory
        
        PID:8184
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        227⤵
        Drops file in System32 directory
        
        PID:7208
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        228⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        229⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        230⤵
        Modifies registry class
        
        PID:7368
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        231⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        232⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        233⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        234⤵
        Modifies registry class
        
        PID:7644
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        235⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7788
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7840
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        238⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7920
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7996
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        240⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        241⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6972
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        243⤵
        Modifies registry class
        
        PID:7284
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        244⤵
        Drops file in System32 directory
        
        PID:7356
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        245⤵
        Drops file in System32 directory
        
        PID:7472
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        246⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7664
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        248⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        249⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        250⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        251⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        252⤵
        Modifies registry class
        
        PID:7364
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        253⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        254⤵
        Modifies registry class
        
        PID:7748
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        255⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        256⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        257⤵
        Modifies registry class
        
        PID:7416
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        258⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        259⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        260⤵
        Drops file in System32 directory
        
        PID:7404
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        261⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        262⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        263⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        264⤵
        Drops file in System32 directory
        
        PID:7700
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        265⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3664
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:932
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        268⤵
        Modifies registry class
        
        PID:408
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        269⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        270⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        271⤵
        Modifies registry class
        
        PID:8236
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        272⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        273⤵
        Modifies registry class
        
        PID:8328
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        274⤵
        Drops file in System32 directory
        
        PID:8368
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        275⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        276⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8492
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8532
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        279⤵
        Drops file in System32 directory
        
        PID:8572
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8612
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        281⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8652 -s 420
        282⤵
        Program crash
        
        PID:8748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 8652 -ip 8652
1⤵
PID:8724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Baaplhef.exe

Filesize
128KB

MD5
d1002f085bf484d00d785ba981063954

SHA1
0f1492866438e28d76b2f023551763b52891f3f5

SHA256
429e67fce65d6849ce8c1f1a42e468752533cf82e4c6693f4ee278d153fa3f64

SHA512
9c3d9d48bf0eae32f8c3359fc88af6dc3ed8f79a67db3fa6f863b557aa49758ed510d3063e384c2717a3b6e883f2e86225908748198e778bb5dd14e1281f9fe4

Download Submit
C:\Windows\SysWOW64\Baocghgi.exe

Filesize
128KB

MD5
3384572a7c4b908fda1201bd4b021284

SHA1
220784869dab1e844a1b744160b6b905279377c3

SHA256
e4e1cb03b9a5f6bb47ee2e8198d8a5c388bfc6ea7d885a2903e9043394e188b6

SHA512
af6eff4670776629ddcc8cd5230a3c2a47228706fb2208b3e147227797d3c0567c3be30fba90f5e8ca55bca575aaeea01c1683ed9d80a3739ae09ca8d9ba27db

Download Submit
C:\Windows\SysWOW64\Beeoaapl.exe

Filesize
128KB

MD5
f9699fd4fabf228627deff3178fbccd3

SHA1
a1fab820d1dd1544312ef1964be0db164d877d60

SHA256
70aa8506b1195634c0150c8da24c79184a3a69bf2ac563238a40b1f330dd3b50

SHA512
8135911e5451b589d130384d66d2317b688d4238d9ab90d51a96a125f054e03b80fe30555a9bbfce6fbc192ec02a29efeebe0a3d8243e2a9772f2a331a8466e0

Download Submit
C:\Windows\SysWOW64\Behbag32.exe

Filesize
128KB

MD5
d471bab4ed85f07727ba8204a404b8e9

SHA1
089a298039ef83d4c6b95cc104aba2f2564705ee

SHA256
57cf26eda187d0b0d42a9bd4e18da48149026be71b645f826a30b363fae31c35

SHA512
44ab589e89dd0c041fd38270b75c1ef0fbef33443b0f6d2f89945b4254e6d250ccaf8477acad44f88fcc582c713332e39d9a97a86f28d15b61232f880c3a4522

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
128KB

MD5
e19c27843276706229895408f76e15b5

SHA1
603091a4fa196ecfb8dd4aaac4d67ddc9d218e4f

SHA256
f622f2d54e422cb33bcf548b09f3d408f16d4f60dd800fac729214f0b5703dcc

SHA512
5df73264cfdf695d1529d74766b584a168788205cd964676f37511595ddaa6e2a79bb7d9ea4924b77d5f30746bd1332df13ff05709fb451b31c9a7b009e1fce8

Download Submit
C:\Windows\SysWOW64\Bhfonc32.exe

Filesize
128KB

MD5
538adb435173fa7f9b55c92b0508dc61

SHA1
eb525b0f24af50c7ef39c8463281fff049659957

SHA256
352d906bb3ee83c495637cc8089b99e25088484fdfa3a8ccb3f76b5bec80a4c6

SHA512
17eb7fc88d72a698edcee77756e2695b5bb2d96d301bff0bfb5aac5d9cdb5eb26d536c64c6d513d4ec16212f1ce1b3046b97e6203a4d5ef9f10917bd0463c420

Download Submit
C:\Windows\SysWOW64\Bhkhibmc.exe

Filesize
128KB

MD5
1b350816e395a1b61d4ba12501064130

SHA1
edf7291b8e5d453cf9a3f482f3a38271e98468e1

SHA256
22a8ba57c163838e24a5675a2d7256d0f91e3c3798cd1a75b6fc4392c394be08

SHA512
e8a8f9565393258506fd49f7069b2fe18fc72e240a9afba9ad3ccb54f6359480c3923072e2d02932c8d2c263d044a52854798610c7eb1811e86f74af6c30b3e7

Download Submit
C:\Windows\SysWOW64\Bjbndobo.exe

Filesize
128KB

MD5
82adb0c06736a2d08ed08203c759c70e

SHA1
763837be3f4723d1adf57ecfe6e7172430476372

SHA256
7941ab9ad150e74cafd009c5ba94b411d6e7edea7127e8edd4aecb0b6e7f741d

SHA512
8fb177a5835850109f218a7d2a6e3fd8dcd95c0c85c9849cbdf40154736d5390fa0773349e5de1bc45dfcbda361dbfefd29eb7f7de67b39fadde7982d75fefd9

Download Submit
C:\Windows\SysWOW64\Bldgdago.exe

Filesize
128KB

MD5
81f15f2be5f9941de5257d033e6c5730

SHA1
8e566529ed3b44a64aff5afbd63eeab419987abf

SHA256
480842eb8eaafc7ef2cd3de45018840863f3b5917347d5080e79846694295332

SHA512
19dd134dfe7ceb458be501e989a2e0aed4f1a4b2d732a6ee7d751ac2cc393bd03fbed95e25240337f9f243f79f573cbd3dc0b5c1cdf4f94c00e3c59ea1306081

Download Submit
C:\Windows\SysWOW64\Bopgjmhe.exe

Filesize
128KB

MD5
cbe82eab89e59dc36b7e3c53d350d618

SHA1
4a747c6ee042b0c9eac5765eb1de58e9eb5177f5

SHA256
db0f6d5a045c8bba290842d6447b191fe7d31fdfde96dbde738829a658a577bd

SHA512
9d80abdca44f4e899ebd8a927d5a9c6aaf947057a65d6368d449f1bb62ae946e907f66e9529e9e3399ffd065f3d8265e3c08afec87f85599598b22daa858fe74

Download Submit
C:\Windows\SysWOW64\Cafigg32.exe

Filesize
128KB

MD5
db34c8af51a43f1604e4d0f069bd36c8

SHA1
2301de46896c5c64c04762b45cc9635bac39a48e

SHA256
3641b6dca6ea4ee18431bc98340879424ec31a035367fd2efc9704357139b66f

SHA512
4fbc030e5a0c408c0434ee44e65cd7dea310a0c31780cebdea5136e1bcdafa2820029d6c8823bee0a9f389ee1fa5db363e3be4b4367a899e4a99a4ebc7c82567

Download Submit
C:\Windows\SysWOW64\Cajcbgml.exe

Filesize
128KB

MD5
1147167a58c05e2449a1599e7f53f546

SHA1
9288058fe5e4955d0e0f4a1056128a977bcda411

SHA256
96189e1e22d53285781c83832304bc653792459dc86f6c3e321623a5bfbc2f78

SHA512
56eb477d13fab1705f244f491f3675b229b11b44a92a7c0e2fb8e5dc1bee24bb0165e612f2ab3047e710a84c058c67779a2c509df44266decc99dc8e6ff8623a

Download Submit
C:\Windows\SysWOW64\Camphf32.exe

Filesize
128KB

MD5
407a38d7e5212d417d3509577277e6a6

SHA1
26f5514d28e95f874ca09bb57ce5edd3e474e08e

SHA256
f1f6a356ad0f6c8526b2fc42d96833ee04f2a7a4324156a428d6ae554837f447

SHA512
82f18aae541f1414e9dfd11b362bec5d4962267a8b39840ddea883ea082350203bc3985307444029344493127ea1699728503c5053a21d741c4cfb5c40ed98c3

Download Submit
C:\Windows\SysWOW64\Cdfbibnb.exe

Filesize
128KB

MD5
a74b7567b02b69bc1d085188317ebd12

SHA1
a8d13ccac747c16af152c99ce4e7431db3c8d184

SHA256
bbf0457d23638f0c4ac94a6872b7c801f453030318e87cfdf7ebfe23f4d69417

SHA512
d87690c2e7bf6e8dd59082e07e3c427b4c98f86e909faa6246a65ea5f750825dcbf21632d239a0a3a41b763d0879437dfa40a5bc1063f6db265fe096c0404f67

Download Submit
C:\Windows\SysWOW64\Ceoibflm.exe

Filesize
128KB

MD5
cfac49784113cca7c3ef8aa421c2fd36

SHA1
b79ef48c33ffe6b841ca6dc73a8eba115770fe85

SHA256
f4e4e4aeb36ef070052d4ffc1670a50b41927eb018ea5463225d29c07cfbde31

SHA512
6a0addd44ea3a66de0da3d33eb0081634ffefb2f5326f9fb4f435caad3a56fc325ca82dd89f14c02b16b4344b6b7e927fd69bb88c6b4080ca5421afa057ffcc8

Download Submit
C:\Windows\SysWOW64\Chagok32.exe

Filesize
128KB

MD5
01dbd1f5efcf5fa2ca96989021efed33

SHA1
4efd26f85793bed62f45c7c68a30a94f19dc729e

SHA256
14583d380ba3b8828c461cc19653a1805c786b3f78c40bb0bc46463678e89d06

SHA512
4e42d66dab866a145d8c713b7fd664e8fb656f8efb1916d7ecaccff6eb597609778ae10dfddcfff87f3aae70432caa2f3b84d0202738fda967d9e709fe8609b1

Download Submit
C:\Windows\SysWOW64\Chmeobkq.exe

Filesize
128KB

MD5
64a815499aff94b0e288307cfae4ef9e

SHA1
738acea001fbdb897ac890b6abb94bf404c1dbab

SHA256
97cb874ac7e8767968b1d2624d0909d5f23556a24b47d56a6d4668881c4f2368

SHA512
f4f285e40dbb2c3fa1a3ae05ace26dc22d6bad312079b0cb4fab9a048ff1d67afe75559b9fa898c155499b033e4c4fbd938088a290529f0fda8138d462da7b7b

Download Submit
C:\Windows\SysWOW64\Chpada32.exe

Filesize
128KB

MD5
ffc9066de068cd9cdeadeda94f85f878

SHA1
b456ad8a0b447de1faae7ce04527da6de1a63fcf

SHA256
4d1463a020d2b7b0a9e150f402b471ae7bbc49cd17ee510278242cc12da8a610

SHA512
7fd6b3d1b95f2e2ed628654a76a7116fd761f2ee96d50ff5fd756d013c19740d927a344b59683155e53d900f13864ba221987c6c95b77cb8b7f50d9d0b7c534c

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
128KB

MD5
00ca0ff3d90212fc43440e107768236d

SHA1
0ac5497136c6014ac301f349ac8fd1f820ee8b28

SHA256
db436386653fef264565ffcc539f09cba3b1722f6fc509a321155541353b3b54

SHA512
a38d37abcf8bf1cd7da8ae25aa694bbf7d9b3261b7557d4ee9ec1b21d9ae52a1312903a607a66ff3820fb3d9aaae238c2253b4c83bcb7c7f5d1c314c6eabd503

Download Submit
C:\Windows\SysWOW64\Ckedalaj.exe

Filesize
128KB

MD5
8bebc6d18d7384e38de4e7c25282afb2

SHA1
a51823025ceb694cb93b14f3c05a63a0a95b9c0e

SHA256
f8dddaae4ccbfd4ce5722a2a4ae522d81cc3104862b7bd5941c1acc112e8829a

SHA512
ae500cb31f118cf7024331716cb0195c192a5f3fa0ee3c433d298621158eb131a6be075c0945c4344416ce85dce2acb241624a49daff1a754ca4e236d45c2198

Download Submit
C:\Windows\SysWOW64\Clnjjpod.exe

Filesize
128KB

MD5
48c548e57e3034dbfbbe0665fcd65a74

SHA1
128d7565f80e9b0bdffd4dc10ea57452fe4763d1

SHA256
e8119d64606c25226b45dc969313350402c9f132325aead90cb4175c303d06ce

SHA512
4197af1f2937979d9e7c89c3818c2c344f5a0de33f5606accb07521ed27ed95eea3e03c57e307912370df2df395af95b3754667df0b292a4625b9eb17b8cb454

Download Submit
C:\Windows\SysWOW64\Clpgpp32.exe

Filesize
128KB

MD5
d2be0529d25d107e355ed683f65c56c5

SHA1
476f26c294953aa86318280193a9670cf1170f77

SHA256
bcb6a6e6c540679636157849ea338a368c7684577321be6593d7e7f351b35658

SHA512
68f3cac233522131ef8d849b2c36f61c785cfc5084bb1c789c8a43cfc671016e904c7f35be97750d5646129c18cc292db4c2e5608ebc25cb5b56a826e9f2c6a8

Download Submit
C:\Windows\SysWOW64\Cmgjgcgo.exe

Filesize
128KB

MD5
ee0245cb199aae75df4715e6de10f582

SHA1
34fbf5117637096ab83d6414643f21685c16d00b

SHA256
444cc9d5463d944a35c2561eea27c55bafb7a6c8680bfe5dde4ad224c05e618d

SHA512
d6b0b62144b6ac45c6db975ced1afe229a683c68e10a21749d6eb89a1b0ce61e3f4d9944c8acc13a4a13c9dcf4c8b7d35c78f254ee3df79eb91b3a9a6c8dfe8d

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
128KB

MD5
707270cdd1ca66a7f8951db8bd8a4b11

SHA1
22dae1b65d814e95de1a32184356d2481cd008cd

SHA256
249ff9555b1f4725dfb6efc6d32d009c33b604b397549236ecd645a92e15a8e8

SHA512
e7133a7c5e9c462c9021e0af11cbe7c7ffb3c84fb1812eaabbce015ccfd1b45b237157e6d3c7dafe3db72093c068f5d554ed5d7af5a3b8ba3b5a997f548afc2b

Download Submit
C:\Windows\SysWOW64\Cojjqlpk.exe

Filesize
128KB

MD5
d8521368362fb9a7bcb10df8314d0453

SHA1
4b50a99551cdad5ea8a204f1418219b10c8fe1bf

SHA256
ec2ecdde183b5fa63056358144eec2fad2bb93087e77a1ef75eede33cb5aaab1

SHA512
56b72cbaaa1d0b5a8c5faff23a1770c6ad4dc281bd6ec88c6aed646f7cbf4175d675c116789139dcb08d4725fab5794cd279fed1a0f22aa19252b20a5fce4543

Download Submit
C:\Windows\SysWOW64\Daolnf32.exe

Filesize
128KB

MD5
b615f4e3722fd7f8c6c4570dc259f310

SHA1
4638dbfb6489017a27f74542bab098e267fc856c

SHA256
dc5204a3180823424393072cf3703ad77b2a91bca4f070f3bf88b9c41f78425b

SHA512
c24fa3ad38748e5cbb507a2ad518473816f12234740214e010a9bbffe1c76a651fd67ccca260204c969dcb17f706930b21036caa1b9aa4ee874f32fbcccb7455

Download Submit
C:\Windows\SysWOW64\Dbaemi32.exe

Filesize
128KB

MD5
2c4c0d1aea501ce65cbe8f0442de043d

SHA1
2da9ff278ade35f179029ccad66a1624b8a437d9

SHA256
e80443c65ee83e5397a4e373e80dbf2ca90c80b0aa680eb7f2fca2ae59e25904

SHA512
f8aa41851931bdaab03151ab6bf1e15a4de4349fa826cfef1952ea1793b6499dac57a72370bd1371776de6319f1f97d446b9660855b662d6e77042a07652f891

Download Submit
C:\Windows\SysWOW64\Dboigi32.exe

Filesize
128KB

MD5
9f8fe2e59e0ec3245ac9b7ff6c963299

SHA1
030c7178cd53ce5e63417d1775076de9c3aa63e9

SHA256
2dcb2b8e8330a542ee4ad29dba5030f5125c9b9debb794d4dfe40661ce9f3829

SHA512
33525fe0473559908918898d1cec9f1f80ff157d35e61a50524a115224850708064c1871da65fed3710867ba52d6d9e8e9b1e538f2900f364fb2a997d0cd4c9e

Download Submit
C:\Windows\SysWOW64\Ddbbeade.exe

Filesize
128KB

MD5
da4981b6095a3ba7faefa541a4048121

SHA1
f6f11a2b36400ee9d386e134c81a371e0ab05cb6

SHA256
ad65cf9e6f7bc9a979ef064a8a444458c50a6319867b48a9ad4258fce03ac799

SHA512
a3e5c93d8c0affc605c6216fa09c8b0ac7abd7443f77780e18b658765e781a786e990d99eedd649e99b9e045adc2e98a341d63b1a21ba79618375ac72af33dab

Download Submit
C:\Windows\SysWOW64\Dedkdcie.exe

Filesize
128KB

MD5
b860c1b53c1055b02a6ce2c9ff780c83

SHA1
51980f78dd85e601ee99677ddf0c9297cfd47b2e

SHA256
8218010276a330623873d2718c409efd5df36e8fb2427cef6606b80580ceae37

SHA512
55b7771c9a447a9d3f7a0ba0ff6ff55625243bb99b8d2146927d14511e4d1229b7d086fbc6f57ccf9031cff451f370668f6fd1be3bb66e29207b5cd14c909337

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
128KB

MD5
52e70b0c603454a6820c8a48b7c22a0a

SHA1
b5a773572992104eb33ebff64f3825245b569ae0

SHA256
0d85e2ff5ebf6881fe23bda2858e1a66d2d1bae28043685b4592b2a2b874caee

SHA512
246b7768efb9972873a4d59ab69e938de4b32db65b5564a3f2991d0c86290bd75498e5fdc1aab7a87ca97ab6498dbfd633b01b762e32c06dcc3aa8b6c6b5b307

Download Submit
C:\Windows\SysWOW64\Dhkapp32.exe

Filesize
128KB

MD5
7685ae8f66a974805278cb189a410434

SHA1
e6e5347f7a17711456102ce3674ee89f0c791333

SHA256
10dbe259365c786db75c35ecc332c2c355e44aca1ccdbe548cec8c2e551a17b7

SHA512
4040d0b7782bcad250f7620f3e66da9ed3fe7f4e9d1e6c415c4c3042c5086da4f4324d645946dfb43d102ad0026fcaf60dc54549464e7da85f92ffdc18696be7

Download Submit
C:\Windows\SysWOW64\Dhpjkojk.exe

Filesize
128KB

MD5
82e3215212c940f1f18951d78e4b21dc

SHA1
724f4713b8a10303d5284cfc982f0dba490e9697

SHA256
1675581ce9505ce2fbe7ac516c42c66deacca7eef447d98f45a54c073c20a62e

SHA512
6a2db7a4e07174887b125c82681758500c416cc2804f9c19e636235d4bc501efd047c5dfcaf575efb3d695d848a7f1ee09c7552d1be54cff57d2c9ec4e735353

Download Submit
C:\Windows\SysWOW64\Dkgqfl32.exe

Filesize
128KB

MD5
f64ecde3010ea38f87b158dda356cf56

SHA1
109cc651e5323644875c2006a4b5dc6e1b78c527

SHA256
7a9f456bb7fad799e9bfb5722639ce6dbdde716f2e397914fbb88c2435e08f13

SHA512
eb26d89e301fc4da1333f6bc035d75e232e8fdb6c7a1dcaae189a98058168c3f91e9b8efee8194a5e9d938cdcd68c75d911ec14758c65475f827dc3c33f62d0e

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
128KB

MD5
7f6a0cda4bef45acf7142d81b8310e92

SHA1
e239dc2c3750b71701dc8b145792596a77de4017

SHA256
c354a80e2e0551955be11ab6fa90f1a03a0c400a6fc644036d3b3edb49d098e1

SHA512
236331ca290afc25744d93cee6632c1d3bd9f7398f38a1c1a6188358d1959e11354fcbc408bb2d30b907770ab2312754d829c112af0c4a3da982da1fa3c20a81

Download Submit
C:\Windows\SysWOW64\Dohfbj32.exe

Filesize
128KB

MD5
51390c8f1e7a814dedad7ff5297e7312

SHA1
74452dace0137b1b1c5e2891cd6ea66fdc3b41e1

SHA256
cd9f1300692b455cc5e8cdfced40b6b6338bb97f470a5677593eb89b330b7a0d

SHA512
d713dbf4fe358d7d6815e4904a47e1ec9299cdafef7712d360c03a2bc228f788d9ca081d1b7d28e1e402bc7c97a52af76fe8cdd60c6c2c2571a2079d547ebf6a

Download Submit
C:\Windows\SysWOW64\Dojcgi32.exe

Filesize
128KB

MD5
39291aa2b42e25f0dad5d1813841c22d

SHA1
23477d0c7d1f11b36dc73473c806519e5d7d701d

SHA256
066447953a574ceba5ad0f35bf29d66f62938899904e3cae38c0f33b34450568

SHA512
4e4399e47768b3aa7b221f1c1b7dd976d84e5b9e5ea22f94f50381d133e42e28adbee23f0735907b453e6615509a2abf4e7afcb07328d76873f238c06d395d24

Download Submit
C:\Windows\SysWOW64\Eapedd32.exe

Filesize
128KB

MD5
f40b2ca490b591d0c18d548782d8e888

SHA1
4353758bc5f8ee6901a2e0a924aec6ce478fef22

SHA256
6481e5d01d976fdf9d51e3cae9fed3bec4607e6b39bd974eb1ace3682daa2137

SHA512
33291b0419c3b1c2dcf1975a22d114f1d38435303e83ffc7e6848b6fc39300cfe7e7673e97ff1072f047f86a08f6c000e6b0eda337df0285d3dcfcf7ea448517

Download Submit
C:\Windows\SysWOW64\Ecjhcg32.exe

Filesize
128KB

MD5
cd9aae3a4f21fe104707c82f6396249e

SHA1
e1b6ad95231f544d2cf72640309df967f9275b8c

SHA256
b047ec64ad82bf8d9f7418da740069be1ec86bb6b3c2f671517dfe405ba6ab56

SHA512
e50b75d3951c9c6ac32954f997e6382369956976aaf1d503b7c7637394e3f680a9c2e899d4cdfd1ad8dd6963ce54d10228191269e4f742c315dec337d0d1fdc5

Download Submit
C:\Windows\SysWOW64\Edihepnm.exe

Filesize
128KB

MD5
19bd161234c9e695b66f6bc2c78ab305

SHA1
11781d642d23381569db471c345cbb12c57bd8b2

SHA256
0f420f2e5b732e928dc4d7520745201f330418d3948a33dcea666e9c72137974

SHA512
bb298faa617e319b8d39bc9c42e72d8b5fe45cd9834da0a99df4ec29001d469143787f8b0a7f31de037daf651a2b9390598bce4d485e1e5b4bd4213de7eafe95

Download Submit
C:\Windows\SysWOW64\Ekacmjgl.exe

Filesize
128KB

MD5
710ceef5c5b0478d7b910ae79ccdeddc

SHA1
8f45d3bb41c1d6da86b9ac463fb9f0b006477636

SHA256
13c9e06b8a22d28e42ed10bac542da7ff1a5b1f10dab8fae2effd004e55c4ffc

SHA512
38ae78bccb4aaf18a7084526f225015dce8c201caa0cf616db110dbc011af29bbae5ceda2b11a4c23613cb5df16ce3f06a5f7dff79de9ee9b6c24655177e8e4a

Download Submit
C:\Windows\SysWOW64\Facagg32.dll

Filesize
7KB

MD5
0e466e685ca21e67446eeba068809417

SHA1
20ed37907f37eafa422e1410aae2541c907aa40c

SHA256
af47ea72c2e24e781da6bd9762a99856d75b9542aee48b7b715ad49ebc4a9c76

SHA512
9b042e29363e9afad22720b0dd274c486dfb7cd75ab17cf5c7ed58305748c47a350d6ec428449de6048fbe180f3c46f942aa6ff0de903341aa40aec4faca881e

Download Submit
C:\Windows\SysWOW64\Hkfoeega.exe

Filesize
128KB

MD5
78e64e8e9a8fb1796bac9861309bdc3e

SHA1
5df3fcb30170988e76bf2e3c3b2a9b7c3567ef36

SHA256
0fddbbf9aebc0525e1721cb1c2d3971645f1ba493347708abd5e36d21094342d

SHA512
9ef7441ba92050770ff2acbfab99ea69f8dd0bbd4db3d02b50f1064bb26fb91176f1ee3f00c3e21c5c515ce49fe8f6eb20f7174adf337d10a5fc0d545dcdae75

Download Submit
C:\Windows\SysWOW64\Jcioiood.exe

Filesize
128KB

MD5
a363e38abccc223d476acd4e3f802967

SHA1
bb9f25845ddc009105aeb83aca299b447a664917

SHA256
c6a27e8a0764960b25c78ccd227ffff5519fa5257e52ff33cb775ff9c43102e4

SHA512
95bd7b0bf6ffa03163c1e0154fb045a2789190816766dfbf194f14fede77935a244a933cbb611f787bb68a5c2673fe4d899c23c82d4a03d43ff2fd1e77e7615a

Download Submit
C:\Windows\SysWOW64\Jfeopj32.exe

Filesize
128KB

MD5
6cd22b2894856e53ccb5ef26caf7c9fb

SHA1
079becc294e95af300c458a812d09cb0b59e2b82

SHA256
0b1bdb06b1da1c758913cb6913663108ab60a6d0b21165fbacdcf534396d72ce

SHA512
8c668b734088131d8bcfd5e061b5a91213c4de0d214cc6e8519fe5ffeb71e5d3dc23fe2a51a269a8ae1594522cd53774307dfd569085a92a0c1a16cd9b4c8d77

Download Submit
C:\Windows\SysWOW64\Kfoafi32.exe

Filesize
128KB

MD5
ce5bc74ea9768e2cd17841d9a92f72df

SHA1
7d7b80c0bdf0d4f9e917d0555f12e78eb4c51805

SHA256
4f92e90e498e65737a49fd27b7f0914ae27410d109e9319efc134405bbe8dcc7

SHA512
a7a71706beb18285b2e6034fd0d3b536bf53f5ccdf86dc4a3bc44770040494b6a1615a033f512b3fa20dcfe5a1ff68b45184d1fb03920b70355684bb9d642bcb

Download Submit
C:\Windows\SysWOW64\Kipkhdeq.exe

Filesize
128KB

MD5
87e763a9ad6cb65ef73224857c812764

SHA1
b5b2ccddb61ca6ce6ccc55ddeea30c1e19886964

SHA256
197f6e6af973986b8908e32371fbeea549c42c05253303a439ad7250b2204542

SHA512
c5517fe56060421534cb4aac8b71ef71b3792cbff2cfcd80ee82a700400e69c3e4f1673027a80ba6cf7eee0bf03301c39b0b92092580ddd75f2c3b7d8cf5a9b1

Download Submit
C:\Windows\SysWOW64\Lboeaifi.exe

Filesize
128KB

MD5
4e2d08c889ee5d731ae8b871b57f278c

SHA1
da597035be06d56f243f311f22d6bef2c5f76cdd

SHA256
d691d495cbd3bb816bd36e12c3b79f5176bc3660ad92f1f0eee4f16638c5620a

SHA512
3f2ee1221f534b87c5e0f91a96f7e712a0cfd01bc0fd7a7f5dd1ab0a901ff2a6bf74d29639651ed390dab09d235824da16770fdcec23f3689c22451ed6c6775a

Download Submit
C:\Windows\SysWOW64\Npfkgjdn.exe

Filesize
128KB

MD5
ef4e5ee157c84084792565affb023188

SHA1
57b5eb5ee0071ce2200a23858a4af1200bfba0fa

SHA256
ad6720372c968b7e609d1184b3d57f9f37e7dad963651464d2d64dea7119a072

SHA512
c921fdeb0a1f92e16febd52dcb5ae6e046ce6b4a97ec118882280b9e95ce4a6d974f78e11b2a0c5d2a5a2d27d9eda5185bb51c6a041b2f3dca9ec7baa53fba8c

Download Submit
C:\Windows\SysWOW64\Npmagine.exe

Filesize
128KB

MD5
73d3e0c9885a9bd1c88a6a96ba189450

SHA1
b0636aa3104ec54f040b0dba2ad2967286a02afd

SHA256
f2aeeb58ad3bb0cac28b6bf5d09cea8f98d45874e51522a214e61d6e1266e99d

SHA512
097bf26ecccce7035959474673af230b7a694fa1a91dade9381ecffd1a53856c2082f37f69bfa0fa5a92785544326d52c24a2d3b304e510fcec4f3e74d7499c0

Download Submit
C:\Windows\SysWOW64\Ofeilobp.exe

Filesize
128KB

MD5
dfadaf0e49b15be88d401cf252529d70

SHA1
5b2ee457556f778ae0a5c4eb92b3d282e5599e20

SHA256
a5e1b9b87f58da80bcfc83ec63844a33d90985a6e9421e0df88ba75e71c872d2

SHA512
d33b1097bf47b249027d72a4957f241fcf100c777da0ab56204e840d74b1fe1dffab26c63ebb63d8d7ab1c6bd51cca2e0e07f73b14427a74ee7a3d9616575ca7

Download Submit
C:\Windows\SysWOW64\Onjegled.exe

Filesize
128KB

MD5
e062ecae8130d2f3fbb0b44d5fcae4c9

SHA1
15fdfbde5bf4186d16ea1c8b532881e2960c668c

SHA256
d78278dfa561873fd215475acc9abb69665f07957bbb4e291d5071640509bae3

SHA512
79255b67c7fc34d52d257838e24f77a73947406170190e013de28d5c03413d077a3f29d271f5a471633835030321b7c42568823412b5f898dc022f584c7c9a0e

Download Submit
C:\Windows\SysWOW64\Pdfjifjo.exe

Filesize
128KB

MD5
c10e13b17496a9b9583f9a3ed25ae444

SHA1
2aba0ec238dff20a4d37e58f146d72530ac91dd9

SHA256
be90ac5c3a7dca4a3364f9d65ab8993dd5a45435e044baca00f3ceffd32a28d7

SHA512
37ac4d68ed698a392379dbe474bcaa37b76272019235f7eee376a14b402ff4864410e2cc6dcd4ed28290000eefb288ec375f1bf54795d0327197903ad55d27c0

Download Submit
memory/712-143-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/736-346-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1000-274-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1148-571-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1148-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1192-266-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1204-28-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1224-512-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1236-506-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1244-364-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1444-196-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1464-582-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1464-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1516-322-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1520-490-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1600-310-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1624-585-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1624-47-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1656-524-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1704-216-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1744-199-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1800-268-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1976-362-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1984-592-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1984-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1996-328-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2056-394-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2156-406-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2268-184-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2276-551-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2276-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2296-518-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2312-370-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2328-96-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2344-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2380-240-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2412-88-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2432-436-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2444-340-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2488-292-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2540-280-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2608-412-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2632-64-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2632-599-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2724-127-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2860-72-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2924-112-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3020-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3052-304-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3084-352-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3100-448-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3152-501-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3168-79-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3216-176-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3256-376-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3416-472-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3436-382-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3624-424-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3652-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3652-558-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3660-388-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3672-104-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3680-538-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3692-119-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3908-552-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4112-316-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4236-231-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4300-248-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4372-460-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4456-286-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4496-159-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4504-135-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4524-404-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4528-526-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4532-430-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4552-454-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4560-484-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4648-334-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4692-549-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4824-537-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4872-172-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4876-548-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4876-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4920-418-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4940-442-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4968-256-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4972-208-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4984-466-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5044-224-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5108-478-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5132-563-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5180-565-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5224-572-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5268-584-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5308-586-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5372-593-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads