12c45da288a51285945a54eca96f8313a7a50b5446a1e96fcbb5a5e1260085d8

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12c45da288a51285945a54eca96f8313a7a50b5446a1e96fcbb5a5e1260085d8_NeikiAnalytics.exe
Size

322KB
MD5

d62111b0da25aa5c95c540e6be0669e0
SHA1

d97fe10bb42b54392ddd3cae4cb397746dc24266
SHA256

12c45da288a51285945a54eca96f8313a7a50b5446a1e96fcbb5a5e1260085d8
SHA512

29a13d56e7cbd73e907742a8e003e6ced610a03fa2b3de123efbcce4a193749bd3086f9574929b61d8a708d5021726eb2782743921cdcc9e7fec81a60137301f
SSDEEP

1536:J/5RPd3FsXXIUXBarWeHgNxzRQ4ETmDhdF+PhJFTq1dlCsTx4LB:J/5RP5FsHFKWeHue3SVGZ3Odl

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hmabdibj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pdifoehl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahmfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Edpnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oqihnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alkdnboj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beeflhdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdckfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qffbbldm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ibqpimpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocegdjij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odgqdlnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkaiqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elppfmoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eleiam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Glebhjlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdjjckag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfoafi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mdmnlj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	12c45da288a51285945a54eca96f8313a7a50b5446a1e96fcbb5a5e1260085d8_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgikfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbmncp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipbdmaah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ncnadk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pabkdmpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jlnnmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpjlklok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Npjebj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgneampk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onmhgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekemhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flceckoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Foabofnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nlmllkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oboaabga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aealah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Edihepnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gbiaapdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ieolehop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbaipkbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnlnon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Demecd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eeidoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fdnjgmle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdmnlj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkceffcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipknlb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfaedkdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kplpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mmbfpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ngpccdlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Echknh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eoaihhlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gofkje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gokdeeec.exe

Executes dropped EXE 64 IoCs

pid	Process
3708	Kckbqpnj.exe
4380	Liekmj32.exe
636	Lalcng32.exe
624	Lcmofolg.exe
3540	Lgikfn32.exe
3572	Liggbi32.exe
1940	Lgneampk.exe
4664	Lnhmng32.exe
2472	Ljnnch32.exe
2592	Lphfpbdi.exe
1972	Mahbje32.exe
3748	Mkpgck32.exe
2984	Mpmokb32.exe
5032	Mamleegg.exe
4576	Mcnhmm32.exe
2948	Mkepnjng.exe
376	Mdmegp32.exe
4064	Mcpebmkb.exe
1768	Maaepd32.exe
216	Nkjjij32.exe
2252	Ndbnboqb.exe
4892	Ngpjnkpf.exe
4364	Nafokcol.exe
2276	Nnmopdep.exe
4548	Nbkhfc32.exe
2548	Nggqoj32.exe
3800	Ncnadk32.exe
3388	Oboaabga.exe
4320	Ojjffddl.exe
2304	Oqdoboli.exe
2372	Obdkma32.exe
4292	Ocegdjij.exe
2476	Oqihnn32.exe
756	Ocgdji32.exe
4820	Onmhgb32.exe
1536	Odgqdlnj.exe
3440	Pkaiqf32.exe
2328	Pbkamqmd.exe
1220	Pclneicb.exe
2972	Pkceffcd.exe
3008	Pbmncp32.exe
2420	Pjhbgb32.exe
3180	Pabkdmpi.exe
5028	Pgmcqggf.exe
4872	Pnfkma32.exe
3952	Pcccfh32.exe
3132	Pbddcoei.exe
1796	Qgallfcq.exe
4588	Qjpiha32.exe
1832	Qeemej32.exe
1408	Qgciaf32.exe
2188	Qjbena32.exe
3312	Aegikj32.exe
2220	Agffge32.exe
4288	Abkjdnoa.exe
2884	Acmflf32.exe
2588	Anbkio32.exe
4276	Aelcfilb.exe
2796	Alfkbc32.exe
992	Aacckjaf.exe
1140	Ahmlgd32.exe
4444	Ajkhdp32.exe
2524	Aealah32.exe
2508	Alkdnboj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dopigd32.exe	Dhfajjoj.exe
File opened for modification	C:\Windows\SysWOW64\Ncianepl.exe	Npjebj32.exe
File opened for modification	C:\Windows\SysWOW64\Alkdnboj.exe	Aealah32.exe
File created	C:\Windows\SysWOW64\Dojcgi32.exe	Dllfkn32.exe
File created	C:\Windows\SysWOW64\Pclneicb.exe	Pbkamqmd.exe
File created	C:\Windows\SysWOW64\Nhmkghpm.dll	Pbddcoei.exe
File created	C:\Windows\SysWOW64\Eepjpb32.exe	Eadopc32.exe
File created	C:\Windows\SysWOW64\Flnlhk32.exe	Faihkbci.exe
File opened for modification	C:\Windows\SysWOW64\Jplfcpin.exe	Jmmjgejj.exe
File opened for modification	C:\Windows\SysWOW64\Kfjhkjle.exe	Jcllonma.exe
File created	C:\Windows\SysWOW64\Pegplgln.dll	Oqihnn32.exe
File opened for modification	C:\Windows\SysWOW64\Ngpjnkpf.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Dahode32.exe	Dojcgi32.exe
File created	C:\Windows\SysWOW64\Eeanii32.dll	Jpgmha32.exe
File created	C:\Windows\SysWOW64\Qgppolie.dll	Ofeilobp.exe
File created	C:\Windows\SysWOW64\Hhapkbgi.dll	Mdmegp32.exe
File created	C:\Windows\SysWOW64\Qeemej32.exe	Qjpiha32.exe
File opened for modification	C:\Windows\SysWOW64\Mmnldp32.exe	Mgddhf32.exe
File opened for modification	C:\Windows\SysWOW64\Liekmj32.exe	Kckbqpnj.exe
File opened for modification	C:\Windows\SysWOW64\Bhhdil32.exe	Beihma32.exe
File created	C:\Windows\SysWOW64\Jlednamo.exe	Jmbdbd32.exe
File created	C:\Windows\SysWOW64\Keoakjca.dll	Cddecc32.exe
File created	C:\Windows\SysWOW64\Ohfjnoma.dll	Ippggbck.exe
File opened for modification	C:\Windows\SysWOW64\Cddecc32.exe	Cogmkl32.exe
File created	C:\Windows\SysWOW64\Ajkhdp32.exe	Ahmlgd32.exe
File opened for modification	C:\Windows\SysWOW64\Ajckij32.exe	Ageolo32.exe
File created	C:\Windows\SysWOW64\Cgfgaq32.dll	Nafokcol.exe
File opened for modification	C:\Windows\SysWOW64\Pclneicb.exe	Pbkamqmd.exe
File created	C:\Windows\SysWOW64\Iphkfg32.dll	Blmacb32.exe
File created	C:\Windows\SysWOW64\Eicplccq.dll	Bemlmgnp.exe
File opened for modification	C:\Windows\SysWOW64\Chghdqbf.exe	Conclk32.exe
File created	C:\Windows\SysWOW64\Fckajehi.exe	Fkciihgg.exe
File created	C:\Windows\SysWOW64\Ghkmacoj.dll	Jehokgge.exe
File created	C:\Windows\SysWOW64\Bchdhnom.dll	Mdmnlj32.exe
File created	C:\Windows\SysWOW64\Hipnbb32.dll	Nggqoj32.exe
File opened for modification	C:\Windows\SysWOW64\Dhidjpqc.exe	Ckedalaj.exe
File created	C:\Windows\SysWOW64\Djhgpa32.dll	Eapedd32.exe
File created	C:\Windows\SysWOW64\Gqffpbnb.dll	Obdkma32.exe
File created	C:\Windows\SysWOW64\Kpbmco32.exe	Kmdqgd32.exe
File opened for modification	C:\Windows\SysWOW64\Qceiaa32.exe	Qnhahj32.exe
File created	C:\Windows\SysWOW64\Pnfeqknj.dll	Ghaliknf.exe
File created	C:\Windows\SysWOW64\Fmijnn32.dll	Melnob32.exe
File created	C:\Windows\SysWOW64\Oqfdnhfk.exe	Ofqpqo32.exe
File created	C:\Windows\SysWOW64\Lipdae32.dll	Pnfdcjkg.exe
File opened for modification	C:\Windows\SysWOW64\Ippggbck.exe	Iifokh32.exe
File created	C:\Windows\SysWOW64\Ehmdjdgk.dll	Qffbbldm.exe
File created	C:\Windows\SysWOW64\Kofpij32.dll	Balpgb32.exe
File opened for modification	C:\Windows\SysWOW64\Oqihnn32.exe	Ocegdjij.exe
File opened for modification	C:\Windows\SysWOW64\Bhikcb32.exe	Bejogg32.exe
File created	C:\Windows\SysWOW64\Hfgefhai.dll	Hobkfd32.exe
File created	C:\Windows\SysWOW64\Nekfmb32.dll	Heocnk32.exe
File created	C:\Windows\SysWOW64\Glccbn32.dll	Ifefimom.exe
File created	C:\Windows\SysWOW64\Jmhale32.exe	Jeaikh32.exe
File created	C:\Windows\SysWOW64\Ebooppnl.dll	Oqdoboli.exe
File created	C:\Windows\SysWOW64\Bejogg32.exe	Bjdkjo32.exe
File created	C:\Windows\SysWOW64\Canidb32.dll	Kedoge32.exe
File created	C:\Windows\SysWOW64\Menjdbgj.exe	Mdmnlj32.exe
File created	C:\Windows\SysWOW64\Bnhjohkb.exe	Agoabn32.exe
File opened for modification	C:\Windows\SysWOW64\Nafokcol.exe	Ngpjnkpf.exe
File created	C:\Windows\SysWOW64\Docjlc32.dll	Iiaephpc.exe
File created	C:\Windows\SysWOW64\Ieolehop.exe	Ibqpimpl.exe
File opened for modification	C:\Windows\SysWOW64\Qgallfcq.exe	Pbddcoei.exe
File opened for modification	C:\Windows\SysWOW64\Doeiljfn.exe	Dlgmpogj.exe
File created	C:\Windows\SysWOW64\Glhonj32.exe	Gfngap32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9288	8424	WerFault.exe	429

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aacckjaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iphkfg32.dll"	Blmacb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Beeflhdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dllfkn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdjdl32.dll"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Doeiljfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhpili32.dll"	Eofbch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kldggoeb.dll"	Fojlngce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jcefno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Delnin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Imoneg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dkgqfl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Faihkbci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhdlom32.dll"	Fdnjgmle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnaijinl.dll"	Gofkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bebblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lommhphi.dll"	Agoabn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Beihma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Anbkio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fkciihgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nnlhfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfddbh32.dll"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Heocnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eokchkmi.dll"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmdkpdef.dll"	Ogpmjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfjhbihm.dll"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gogiek32.dll"	Ehgqln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kbfbkj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ngbpidjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bnmcjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ncnadk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Foabofnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jpnchp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Andqdh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ckedalaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fckajehi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kmkfhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mlhbal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcjkaiib.dll"	Alfkbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ghopckpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ipbdmaah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kfoafi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hbeqmoji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Menjdbgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ekacmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Namdcd32.dll"	Kibgmdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpmdoo32.dll"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Linjpeof.dll"	Echknh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bebboiqi.dll"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qgallfcq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnkhmbin.dll"	Miemjaci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eabbjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nknjccol.dll"	Edpnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpmmhi32.dll"	Dojcgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Coffpf32.dll"	Nlmllkja.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 3708	3076	12c45da288a51285945a54eca96f8313a7a50b5446a1e96fcbb5a5e1260085d8_NeikiAnalytics.exe	82
PID 3076 wrote to memory of 3708	3076	12c45da288a51285945a54eca96f8313a7a50b5446a1e96fcbb5a5e1260085d8_NeikiAnalytics.exe	82
PID 3076 wrote to memory of 3708	3076	12c45da288a51285945a54eca96f8313a7a50b5446a1e96fcbb5a5e1260085d8_NeikiAnalytics.exe	82
PID 3708 wrote to memory of 4380	3708	Kckbqpnj.exe	83
PID 3708 wrote to memory of 4380	3708	Kckbqpnj.exe	83
PID 3708 wrote to memory of 4380	3708	Kckbqpnj.exe	83
PID 4380 wrote to memory of 636	4380	Liekmj32.exe	84
PID 4380 wrote to memory of 636	4380	Liekmj32.exe	84
PID 4380 wrote to memory of 636	4380	Liekmj32.exe	84
PID 636 wrote to memory of 624	636	Lalcng32.exe	85
PID 636 wrote to memory of 624	636	Lalcng32.exe	85
PID 636 wrote to memory of 624	636	Lalcng32.exe	85
PID 624 wrote to memory of 3540	624	Lcmofolg.exe	86
PID 624 wrote to memory of 3540	624	Lcmofolg.exe	86
PID 624 wrote to memory of 3540	624	Lcmofolg.exe	86
PID 3540 wrote to memory of 3572	3540	Lgikfn32.exe	87
PID 3540 wrote to memory of 3572	3540	Lgikfn32.exe	87
PID 3540 wrote to memory of 3572	3540	Lgikfn32.exe	87
PID 3572 wrote to memory of 1940	3572	Liggbi32.exe	88
PID 3572 wrote to memory of 1940	3572	Liggbi32.exe	88
PID 3572 wrote to memory of 1940	3572	Liggbi32.exe	88
PID 1940 wrote to memory of 4664	1940	Lgneampk.exe	89
PID 1940 wrote to memory of 4664	1940	Lgneampk.exe	89
PID 1940 wrote to memory of 4664	1940	Lgneampk.exe	89
PID 4664 wrote to memory of 2472	4664	Lnhmng32.exe	90
PID 4664 wrote to memory of 2472	4664	Lnhmng32.exe	90
PID 4664 wrote to memory of 2472	4664	Lnhmng32.exe	90
PID 2472 wrote to memory of 2592	2472	Ljnnch32.exe	91
PID 2472 wrote to memory of 2592	2472	Ljnnch32.exe	91
PID 2472 wrote to memory of 2592	2472	Ljnnch32.exe	91
PID 2592 wrote to memory of 1972	2592	Lphfpbdi.exe	92
PID 2592 wrote to memory of 1972	2592	Lphfpbdi.exe	92
PID 2592 wrote to memory of 1972	2592	Lphfpbdi.exe	92
PID 1972 wrote to memory of 3748	1972	Mahbje32.exe	93
PID 1972 wrote to memory of 3748	1972	Mahbje32.exe	93
PID 1972 wrote to memory of 3748	1972	Mahbje32.exe	93
PID 3748 wrote to memory of 2984	3748	Mkpgck32.exe	94
PID 3748 wrote to memory of 2984	3748	Mkpgck32.exe	94
PID 3748 wrote to memory of 2984	3748	Mkpgck32.exe	94
PID 2984 wrote to memory of 5032	2984	Mpmokb32.exe	95
PID 2984 wrote to memory of 5032	2984	Mpmokb32.exe	95
PID 2984 wrote to memory of 5032	2984	Mpmokb32.exe	95
PID 5032 wrote to memory of 4576	5032	Mamleegg.exe	96
PID 5032 wrote to memory of 4576	5032	Mamleegg.exe	96
PID 5032 wrote to memory of 4576	5032	Mamleegg.exe	96
PID 4576 wrote to memory of 2948	4576	Mcnhmm32.exe	97
PID 4576 wrote to memory of 2948	4576	Mcnhmm32.exe	97
PID 4576 wrote to memory of 2948	4576	Mcnhmm32.exe	97
PID 2948 wrote to memory of 376	2948	Mkepnjng.exe	98
PID 2948 wrote to memory of 376	2948	Mkepnjng.exe	98
PID 2948 wrote to memory of 376	2948	Mkepnjng.exe	98
PID 376 wrote to memory of 4064	376	Mdmegp32.exe	99
PID 376 wrote to memory of 4064	376	Mdmegp32.exe	99
PID 376 wrote to memory of 4064	376	Mdmegp32.exe	99
PID 4064 wrote to memory of 1768	4064	Mcpebmkb.exe	100
PID 4064 wrote to memory of 1768	4064	Mcpebmkb.exe	100
PID 4064 wrote to memory of 1768	4064	Mcpebmkb.exe	100
PID 1768 wrote to memory of 216	1768	Maaepd32.exe	101
PID 1768 wrote to memory of 216	1768	Maaepd32.exe	101
PID 1768 wrote to memory of 216	1768	Maaepd32.exe	101
PID 216 wrote to memory of 2252	216	Nkjjij32.exe	102
PID 216 wrote to memory of 2252	216	Nkjjij32.exe	102
PID 216 wrote to memory of 2252	216	Nkjjij32.exe	102
PID 2252 wrote to memory of 4892	2252	Ndbnboqb.exe	103

C:\Users\Admin\AppData\Local\Temp\12c45da288a51285945a54eca96f8313a7a50b5446a1e96fcbb5a5e1260085d8_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\12c45da288a51285945a54eca96f8313a7a50b5446a1e96fcbb5a5e1260085d8_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\SysWOW64\Kckbqpnj.exe
  C:\Windows\system32\Kckbqpnj.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\SysWOW64\Liekmj32.exe
    C:\Windows\system32\Liekmj32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Windows\SysWOW64\Lalcng32.exe
      C:\Windows\system32\Lalcng32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:636
    - - C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:624
      - C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3540
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3572
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2472
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1972
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3748
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2984
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5032
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:376
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:216
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2252
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4892
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4364
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        25⤵
        Executes dropped EXE
        
        PID:2276
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        26⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2548
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3800
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3388
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        30⤵
        Executes dropped EXE
        
        PID:4320
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2304
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2372
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4292
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2476
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        35⤵
        Executes dropped EXE
        
        PID:756
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1536
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3440
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2328
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        40⤵
        Executes dropped EXE
        
        PID:1220
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2972
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3008
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        43⤵
        Executes dropped EXE
        
        PID:2420
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3180
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        45⤵
        Executes dropped EXE
        
        PID:5028
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        46⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        47⤵
        Executes dropped EXE
        
        PID:3952
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3132
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1796
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4588
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        51⤵
        Executes dropped EXE
        
        PID:1832
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        52⤵
        Executes dropped EXE
        
        PID:1408
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        53⤵
        Executes dropped EXE
        
        PID:2188
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        54⤵
        Executes dropped EXE
        
        PID:3312
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        55⤵
        Executes dropped EXE
        
        PID:2220
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        56⤵
        Executes dropped EXE
        
        PID:4288
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        57⤵
        Executes dropped EXE
        
        PID:2884
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2588
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        59⤵
        Executes dropped EXE
        
        PID:4276
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2796
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:992
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1140
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        63⤵
        Executes dropped EXE
        
        PID:4444
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2524
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2508
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5024
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        67⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3220
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4720
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3192
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        70⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        71⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        72⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        73⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        74⤵
        Drops file in System32 directory
        
        PID:3052
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        75⤵
        Drops file in System32 directory
        
        PID:2940
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        76⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        77⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        78⤵
        Drops file in System32 directory
        
        PID:3688
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        79⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        80⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        81⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        82⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        83⤵
        Drops file in System32 directory
        
        PID:2260
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        84⤵
        Drops file in System32 directory
        
        PID:2848
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        85⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        86⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        87⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        88⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        89⤵
        Drops file in System32 directory
        
        PID:5228
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        90⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        91⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5324
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        92⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        93⤵
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5468
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        95⤵
        Drops file in System32 directory
        
        PID:5512
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        96⤵
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        97⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        98⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        99⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        100⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        101⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        102⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        103⤵
        Modifies registry class
        
        PID:5852
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5940
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5996
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        107⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        108⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5132
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        110⤵
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5180
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5352
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        113⤵
        Drops file in System32 directory
        
        PID:5448
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        114⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5604
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        116⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        117⤵
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5832
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        119⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        120⤵
        Modifies registry class
        
        PID:5924
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        121⤵
        Drops file in System32 directory
        
        PID:6028
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        122⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        123⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        124⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        125⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        126⤵
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        127⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5676
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        128⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        129⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        130⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        131⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        132⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5376
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        133⤵
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        134⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6020
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5280
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        137⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5752
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6104
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        140⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        141⤵
        Drops file in System32 directory
        
        PID:6076
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        142⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        144⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        145⤵
        Modifies registry class
        
        PID:6220
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        146⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        147⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        148⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        149⤵
        Drops file in System32 directory
        
        PID:6416
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6456
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6496
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        152⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        153⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        154⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6664
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6704
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        157⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        158⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        159⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        160⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        161⤵
        Drops file in System32 directory
        
        PID:6924
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        162⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        163⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7012
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        164⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        165⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        166⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        167⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        168⤵
        Modifies registry class
        
        PID:6260
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        169⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        170⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        171⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        172⤵
        Drops file in System32 directory
        
        PID:6560
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6628
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        174⤵
        Drops file in System32 directory
        
        PID:6688
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        175⤵
        Modifies registry class
        
        PID:6760
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        176⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        177⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        178⤵
        Drops file in System32 directory
        
        PID:7004
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        179⤵
        Drops file in System32 directory
        
        PID:7064
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        180⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        181⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        182⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6412
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6528
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6660
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        186⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        187⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        188⤵
        Drops file in System32 directory
        
        PID:6996
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        189⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        190⤵
        Drops file in System32 directory
        
        PID:7108
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        191⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6392
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6572
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        194⤵
        Modifies registry class
        
        PID:6740
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        195⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        196⤵
        Drops file in System32 directory
        
        PID:7132
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        197⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        198⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        199⤵
        Drops file in System32 directory
        
        PID:6756
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        200⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        201⤵
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        202⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        203⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        204⤵
        Drops file in System32 directory
        
        PID:7032
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        205⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        206⤵
        Drops file in System32 directory
        
        PID:6948
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        207⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        208⤵
        Drops file in System32 directory
        
        PID:7212
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        209⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7304
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        211⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        212⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        213⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7480
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        215⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        216⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        217⤵
        Modifies registry class
        
        PID:7604
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        218⤵
        Drops file in System32 directory
        
        PID:7648
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        219⤵
        Modifies registry class
        
        PID:7692
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        220⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        221⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        222⤵
        Modifies registry class
        
        PID:7824
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7872
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        224⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        225⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        226⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        227⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        228⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        229⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        230⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        231⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        232⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        233⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        234⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        235⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7684
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        237⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        238⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        239⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7968
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        241⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        242⤵
        Drops file in System32 directory
        
        PID:8120
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        243⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        244⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        245⤵
        Modifies registry class
        
        PID:7524
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        246⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        247⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        248⤵
        Drops file in System32 directory
        
        PID:7792
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7868
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8060
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        251⤵
        Modifies registry class
        
        PID:8156
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        252⤵
        Modifies registry class
        
        PID:8132
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        253⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        254⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7808
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4732
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        257⤵
        Modifies registry class
        
        PID:4660
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        258⤵
        Modifies registry class
        
        PID:8004
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8112
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        260⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        261⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        262⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        263⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        264⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        265⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        266⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        267⤵
        Drops file in System32 directory
        
        PID:1380
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        268⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        269⤵
        Modifies registry class
        
        PID:7932
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        270⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        271⤵
        Drops file in System32 directory
        
        PID:4036
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        272⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        273⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8216
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        275⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        276⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8348
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        278⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        279⤵
        Drops file in System32 directory
        
        PID:8436
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        280⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8524
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        282⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        283⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8660
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        285⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8748
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        287⤵
        Drops file in System32 directory
        
        PID:8788
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        288⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        289⤵
        Modifies registry class
        
        PID:8884
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        290⤵
        Modifies registry class
        
        PID:8952
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9000
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        292⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        293⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9148
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        295⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        296⤵
        Modifies registry class
        
        PID:8240
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        297⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        298⤵
        Modifies registry class
        
        PID:8384
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        299⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        300⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8512
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        301⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        302⤵
        Modifies registry class
        
        PID:8652
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        303⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        304⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        305⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        306⤵
        Modifies registry class
        
        PID:8940
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        307⤵
        Drops file in System32 directory
        
        PID:9044
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        308⤵
        Modifies registry class
        
        PID:9104
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        309⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        310⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8212
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        311⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        312⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        313⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        314⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        315⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        316⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        317⤵
        Modifies registry class
        
        PID:9076
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        318⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        319⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        320⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        321⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        322⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8824
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        324⤵
        Modifies registry class
        
        PID:9016
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        325⤵
        Drops file in System32 directory
        
        PID:8316
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        326⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        327⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        328⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        329⤵
        Modifies registry class
        
        PID:9144
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        330⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        331⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        332⤵
        Modifies registry class
        
        PID:8372
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        333⤵
        Modifies registry class
        
        PID:8780
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        334⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        335⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        336⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8424 -s 228
        337⤵
        Program crash
        
        PID:9288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 8424 -ip 8424
1⤵
PID:9264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabmqd32.exe

Filesize
322KB

MD5
30cb3c9ef7f1756822ca5605fc95ebd9

SHA1
497ff0b222c0a7ab44077944e0abe7ed39d27bc2

SHA256
f997b3c2075fc41dfc542973240923e008146930dcb6c4eb42ca40ab4abce2dd

SHA512
c06862422f6f12306f71dd0530e781b4ad25aa522b4f69d0afab428569e322eceb0e2429d4f53dde997460072499063ce161f01f56cd244b3b1313d840297afb

Download Submit
C:\Windows\SysWOW64\Agoabn32.exe

Filesize
322KB

MD5
b42e8e357d2db62fec2379043961aa91

SHA1
e3a36cbfc1a9158997aa7d7862dd2c302767dfa5

SHA256
fde02c5986980ef827731f677f98376d4021928aba8dbdbff67384123b98e042

SHA512
883c6945bc2cc726ec4415f329fcc89bd5087932da3db85a67ec939c92129909b8518888f56aac5127bbd35ec05125cbbcfbaac1d8b142620eaa5f4f42af67c0

Download Submit
C:\Windows\SysWOW64\Bchomn32.exe

Filesize
322KB

MD5
b840c7e30b963b469754583cee2299fa

SHA1
dba235f451e93ca9ae7e25c131ce81d56e0fcb56

SHA256
0c0b70cef542fe389ca355767e712d4fecd36582692559689d80702004ef3836

SHA512
f50691ebdafa671e03b94147c42f1e2a3301d028117eef99b4d7253f78c6d15220ee79755147b7f85a09d431d4d74992f6701ab79e3cb5c708f69ef57c00fc33

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
322KB

MD5
d61fcecb625a391e10828829d985421c

SHA1
91e3810ca0d40da7bf7401558764c32a458f4b5c

SHA256
3ced21ff0eb09de660ad9f8c1b5e2d6fda603b1cc6586b0cbd835049f9f504c2

SHA512
b4f3f328f53f1f4a88c5752c74211af6e4595e56b0f52fecda61b1307a2e92b0949babcd0f56ed78002b3ed3b2efd2d377e3832547f66f567753ecac72ec90d4

Download Submit
C:\Windows\SysWOW64\Ckedalaj.exe

Filesize
322KB

MD5
ec2412f78373042d578d3376c65c782f

SHA1
047d0a3e9cd7456c502bc8ffbf20fea5b355785c

SHA256
c392a5785541f11ae9ca95850c8261e48fcdfe9bae6135d2fb01870e83771b52

SHA512
dee3c8e7ee6956c3de4e1662b199d0e958eef699d6f4b16ee635f34bbe579f9a654f346490d1d0cfc1e8dbd43f3ab6faf538af8e59280581d1d80534f6078246

Download Submit
C:\Windows\SysWOW64\Ckpjfm32.exe

Filesize
322KB

MD5
0115ed1722c9b55ab1f5759172f6b8ce

SHA1
3219931c0ab739f51213a681e3f9b387c354b8b7

SHA256
9d1dbc79d3ddf21b8d5f92a73f306fb1413e0d154cc90809eb920a2161a078b2

SHA512
055d06ce88fba469eb732d8125a31cc4efef9ea3e0482c3621daf0f553b348213c2ef6554d08aa315b6ca764bff194a5d70e483df2b75c0c999c943c104c8e25

Download Submit
C:\Windows\SysWOW64\Dahode32.exe

Filesize
322KB

MD5
84dfa29d89e859985ebb1887823583ca

SHA1
9ad16255c91d0d777a26d32666144bcb3b5fb883

SHA256
35296f91fa5ebec13e2870845a840a16ecf279041e4ea4aba3c42066605eb7d1

SHA512
2f85670a443a6f032a8ad9c9b7143e0a86e17f8707e977793ccb01ffdd1066a688f7d8acd0e25e34c741e869d098966b83862066293c38889d7bee03922fe010

Download Submit
C:\Windows\SysWOW64\Deanodkh.exe

Filesize
322KB

MD5
f36fc0199c22c525ff00bdcf5d8b0e66

SHA1
d6507b2acf8d0e2dbf16ede272eecf945b3cc412

SHA256
3ba15ce052190d7cfcdd8db8ae32284a70cae0f4238cd2ddf1a85e54f356ca04

SHA512
c0b9af94a5258cd9428a9efbdee78c1646c2e6f98973b0bfbff69e2d7deffd8c239c0fc0126b8a7ee1e6a7bbbcb6a685e7f3839abb96b5ce8b89753364066a0d

Download Submit
C:\Windows\SysWOW64\Dhkjej32.exe

Filesize
322KB

MD5
5f93b6432c1aefc79027c022d5c45601

SHA1
f51b12fef21dbfd6c931fe7fcace7f621baf9f72

SHA256
73844b22d2496750e04953d018d92acb6d7ba8f1f2f5e652f429f13fbb8001e2

SHA512
5d029868c4379c23939cf5fa498ae0fce565d362c88f4873bb252b3775448bba6ee9d8c494b3d013d0c397c17a0d91c13ee739cef957dcdb9b341de902d1e6ea

Download Submit
C:\Windows\SysWOW64\Dkljak32.exe

Filesize
322KB

MD5
950ebcda547f53c47b9fd8ad5ce4ccab

SHA1
6e22c2abab149ec3fff4decba6993f75288153a1

SHA256
94aedef7c767a45ba35a55120047269e265e212ec2426f893ad9e36d08cffd05

SHA512
50cffa98f07d038e6d1109f89212bfd5db0523d245d202ce5e9434cb05835a48430c09e0a4785248ff031e872071149ce6b40b818388a7a3e8f057227a24d046

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
322KB

MD5
a565e444560b53b3919b2bac90710b75

SHA1
c5303622bf4d6412b44ad209c64b8ebfc123feee

SHA256
dd25ac3e1560e47125ac1cb050fd8055478d9d1928fd1977f38f115ec5eeab0c

SHA512
bd808e0264987cc1d7881622c71c238d47b1dc2de02fb444554ba0a507776af5cee2dda1d7042a86962568a0fd6627d5e54b24183b9776b870edabc1b1f26d48

Download Submit
C:\Windows\SysWOW64\Dnkdikig.dll

Filesize
7KB

MD5
88e5d84f9e7928fd60a4bc098c29c508

SHA1
4c03a7ee97bb4d2ceced7d4f231c2a7a60513ea8

SHA256
f36409d3eabc018ffc7c6810d1231ec1c69f4a32a97dff046adfeadb9a15131c

SHA512
bd82a644fbf7e0f8ee5bb3a7155e5b9dd299fea958737d24f90971f3de16f290baae24dc6b41680304672c69b9135540d002e78682f7c7036c7f29edbad64e7a

Download Submit
C:\Windows\SysWOW64\Edihepnm.exe

Filesize
322KB

MD5
8c11e4abc9fefe66fbf007065d52b56a

SHA1
533595a71038e89926a59e55841775feaf6877c5

SHA256
f0bdfd3d82f4e7e4682ac1d4be571a709c0ea887db396b2cb2b2d42c8fe5856f

SHA512
450d1c5f563a58da3589f3975022c1636b91ef8ceb6f7f30e251f537b925963e77a3930fbc820dba4983b7f49a5fb03e84e782a902cf34e27287aaecba5bfb47

Download Submit
C:\Windows\SysWOW64\Fdegandp.exe

Filesize
322KB

MD5
a29c63a6e98ebfb698a0621a5dbdf734

SHA1
8f40159d154153e035d67dff62c77d97985368b7

SHA256
9b7522b77142c3cc3241c1ea9bd4024c95a40c6cd9644a8430705b6090bd7dcc

SHA512
006ad3650c57c325e984fac64c8537879c8a7a8a15f76951641193e8eeacea75663d7f9461acff28ea619ff6c6e4af1acac29395c30a41e5b2cf494efce6993a

Download Submit
C:\Windows\SysWOW64\Gbiaapdf.exe

Filesize
322KB

MD5
d833ee79e0368f642d2144c22bc2f7ee

SHA1
c2e0e7b1de8009f3c95cb4ccb3c8dad92330e801

SHA256
21d4884d2731be2fc72c08579cdeb0c7efea8f5aa9aed0df416b8365935ec0f7

SHA512
874e3264ad4422198b7ae9c87f86c3bf110aae7f33d19a41bcb2fcffc1b5dfa5eefbed3c4df0f3668aad37b91cb1579dab35d182a20f1b22cef3d8bd0f02c6de

Download Submit
C:\Windows\SysWOW64\Glebhjlg.exe

Filesize
322KB

MD5
c28a0c9faf734e6c6c363e2038ba452c

SHA1
19649229928721f02eef1b10040ffd49782745a4

SHA256
48adeb66142825618437ad393c761b6f312f7d87058638dcd95274e4d02ea4e3

SHA512
6170d081abc3adf396096e4d260c351e20931c8730e4412f8e0297d21d870d9b1965956a438d47c565e970c536ff47fe08352208c84925598faf4ec214c735ea

Download Submit
C:\Windows\SysWOW64\Iblfnn32.exe

Filesize
322KB

MD5
df86caed4fbf8a9efca0c88ccad5a1e4

SHA1
325455b2c011c121f14e32e4861b9c58577b59a4

SHA256
41ce42b7775f9c05cd298150dd8fdbe7cb06d286d3eafe38da7027ff91878dc1

SHA512
17f685f9194934059c143926d9da6ed3bff244432c7e79db9e897555eada9afddd658cb542de46a64a2bce7164a5a7943d5cabc6b56dbf60a14e9b6ab89c10d2

Download Submit
C:\Windows\SysWOW64\Icplcpgo.exe

Filesize
322KB

MD5
127c513141e6c77e4b9e04f0d99b8976

SHA1
7d935c8da9aca0d240df6faa143e352320ab1b50

SHA256
f03a2060b22ccb2fc023956ebd946acca4ed6674a3fdc243d004e2e1ece9ba3a

SHA512
7ff75d86773a2da6c3ec08248412215e47d8066544d19efd94fc2ec805057fb75177f1a4e96464faf93e169830bfedc77c95f062b715c9e8ba6d68d2fc52510c

Download Submit
C:\Windows\SysWOW64\Ieolehop.exe

Filesize
322KB

MD5
461b38776af175bb6273a70fa95c6dd9

SHA1
192e92c36991fd71829d33f60161f1f45a0f8004

SHA256
dab4203786a845d80ad9830dd0118fa654cfc2737122abb4b1de28ab3f7d6962

SHA512
6c1956ef12e2ff694a37c9127708f55e4cc4e150b08aa83467b9ca52aad30aeb684c5930fe0aa3ef9f3748ec5751c6aa98f8f4959830584d5b045452bd454858

Download Submit
C:\Windows\SysWOW64\Iifokh32.exe

Filesize
322KB

MD5
0a39bea59967182842cdab8a6c4e18d8

SHA1
11297321f8b76a38f26449843b3ad7c48110bd4e

SHA256
303a57d942a4ce8198e18f8a7495cebaea79174d92b203fcd282d6649c6c93d6

SHA512
cd03b8c9b56e3069c61e697332c4619644bcb96493186512ff8364bc20e961f39fe3790798171a0b062fc61140c85e242a6354d9bda3ac89e858bc4f89a0ac15

Download Submit
C:\Windows\SysWOW64\Jeklag32.exe

Filesize
322KB

MD5
2c88469e1409088dc569d49c49f693e4

SHA1
6ddc01da2f6186e5e17c600212170094203403e3

SHA256
26f539377fd12dd6a039c73f9a65506895a3073c193c6614b0baee2c5cb7f790

SHA512
514ec10c0931212bd121b709b2dabd9c01324fad4d391df8d5a22486807083af563e9ab1e815ffe4467a7e91547b3afade0d397c49117c14635181f25bd7326d

Download Submit
C:\Windows\SysWOW64\Jfaedkdp.exe

Filesize
322KB

MD5
767ff0b46d491e4a4c5c5870710f5850

SHA1
9279333ec03e3962938e90f405e9a9af0131188c

SHA256
46ffc4151c448891565ac70540901a10f580e4509fd27609ec3dd147a39637fb

SHA512
1a0401cfdc455a0c29e1385e07cd87f10d28823d30c49b8fcc45d4a9a7081ec02a6ee54a711725db8f199ac5037246469f008859ed731f54d9c8acb58a76fd8b

Download Submit
C:\Windows\SysWOW64\Jmpgldhg.exe

Filesize
322KB

MD5
8ab0ab7694fb7ee8187ae7256e2f7b3e

SHA1
b21c56e0ffd211969015c0b9ebbe608d9a49251f

SHA256
47aeb5d35d8f1d7bfb1aa1b1d27ed2cb7f399a2988d911c06457eed83c325f13

SHA512
f5cef96fe7f58a56a1e5787fb2bc9df5d92d969b090373cce0bb639f964a74da38c408a832e68ad22f94c05269cc881d7b37bee1bb8f63e34a1a50148a33f2d7

Download Submit
C:\Windows\SysWOW64\Kckbqpnj.exe

Filesize
322KB

MD5
2909438d8f5f9c25cccdef4fa9e316d2

SHA1
774823a924f38ca5b91699f8344e7962a190ffb6

SHA256
f50708b9c1e4850a885e793f4e6d2e0641a889a8a16cd72392b948e267a4e486

SHA512
08e5d545b0a7b596ae888dcafa3fb33bc591a9e4900cb4cc9dbc7080a3565eb115bffef71b8f06ea5131f3bb2e43325f5b21a5b5626685946956f6e072ca80d0

Download Submit
C:\Windows\SysWOW64\Kmkfhc32.exe

Filesize
322KB

MD5
2e4b45a1783f644b6ea77e34e4eb9bcb

SHA1
79f3e269e957aca90a5c121f98366c97b651490c

SHA256
86e153a463582c42dc9812bbb7c3bd6d202f9af110cd97ecdce806c4a233168f

SHA512
ac1e9d0d118c8759167d3584f3d6cc1f3882b143ec0d85763ad7f8bd3f2a67ff1f800c74b0f4b8e84eea9cf921de0123a6edaed77ddfa19ad1aab4e7b98793d1

Download Submit
C:\Windows\SysWOW64\Lalcng32.exe

Filesize
322KB

MD5
5d78240e3a24754d63c3eb4baac3f966

SHA1
24bc40ce7833b20e23d107f01331a41340bdc400

SHA256
95c2ea42f1861d23624020a7f6bd0baec59ae854c4f119ca457dde3fc697bc00

SHA512
2a5afe56de037405f05bdda3228980620263255fc3cd41c3ccf87bac6e37c6614d8db9728d27eff8f52d7f3e5aa99cd9ea06a0c854b458f036e4b535c71591b6

Download Submit
C:\Windows\SysWOW64\Lcmofolg.exe

Filesize
322KB

MD5
b53b73005e8f040dd3f7a16d6eb4c450

SHA1
bfc825ac3ca991b605f542ed248f59b9d7082616

SHA256
e97269a17f7049d02c8de080bcfc65b1bc0b765ac591608f8505a442ee270a29

SHA512
dee2054d5157ba604d04fda7ea8cfeaa5c395dbeed94f2def6c6f0f707a455184a164c364734a06c3577731710b845657b0d7a4e42b6f59eb944d8d9a9984624

Download Submit
C:\Windows\SysWOW64\Lgikfn32.exe

Filesize
322KB

MD5
225006eacebf05411c41246f5a471c50

SHA1
b4a33970609a62509fe4da2ad3be0c0fa4b89c37

SHA256
622886a1e5aff3bdcaa80b7ed3065de1b47f7ff591001394ff6ed9c9df47937d

SHA512
5b5fe1d0e0bc8a1c8cf80fa3430b47c2a2e939819eb6d96f1e7edc4fca576a11704b5ef968f4dd89c36841424eb1a74406c55b700c55676fdef27ab61d18a378

Download Submit
C:\Windows\SysWOW64\Lgmngglp.exe

Filesize
322KB

MD5
bf7d8158a874dec604e0d202de6f37b8

SHA1
f41196fd95a6436dd3f8e81de2a9fcde13502df1

SHA256
c4553ec471303edb2598a4c18a23d3797a67cad1d71f7e65409b384cff6e28c1

SHA512
6eef1d34c9aaf95218bf589af6934776bd40892f6153e0ef7d6be183a70b51326ba2f885fef060a45361454d6a1aa660297f80ce803d943969d99ea989021d10

Download Submit
C:\Windows\SysWOW64\Lgneampk.exe

Filesize
322KB

MD5
5bc10b110ad9aed0eb38c0c3ddeef043

SHA1
e847e1fe3306a924f3f5730e18963090811cdc41

SHA256
18ba186989cde2a356a381fdaffa1e907216abc2b1430bfb3a169fe83fc1bc96

SHA512
93e989aae94eed47049427b6298783dec56ab0ab69f46b8f1667ac24157e466b782c513cf819911359cd4a7d4459acf48880d98599b3e6abdd99504defeab8ec

Download Submit
C:\Windows\SysWOW64\Liekmj32.exe

Filesize
322KB

MD5
682e34bffdc32ff7cb3577deb2b516fe

SHA1
2479b2e4fe8947807e7b264603e616ca891f1de0

SHA256
11c44fa90b8c3637a365d0658a4d3d77e67ac6b9bc1cbae0b7f6b83a71b70ef4

SHA512
16f389209ad2e96e9c00e58c13bd678607636fa8f7a6f3ee63fc18ff28fcc27f9de0cd73bb7ed5c7da234c6edbed7fffaa3cfb36fa2f4248bc318b6710e6f374

Download Submit
C:\Windows\SysWOW64\Liggbi32.exe

Filesize
322KB

MD5
0b3cea4c05676b4ef73aca0cfc112f9c

SHA1
5a055d9f500d2a5038e2838eea377851386cfa8c

SHA256
fa7e0e6f862af28deeb7aa00bf83d8de9bc5e19b95cd2cf81970d6a266d1ff4c

SHA512
bbef04fb8671ad24211e6ae8298b50de0b5842be0a379e0b241e63db17bdc997652732388d168bfd3238c1f5d31f1f20b9de70e33de66b93f25694cd4863c4a8

Download Submit
C:\Windows\SysWOW64\Ljnnch32.exe

Filesize
322KB

MD5
67cacf948e1512671dc01dbf78d89c15

SHA1
13dc218027e7dfd38f2ffb3875b85faafc1b154d

SHA256
26ac5df54e6088bb33292ad3f1a138aefc69e3fd9c1db1643783cbc1392e3999

SHA512
e61417b266161b2e8c21feca1b8ca6f6cfcda12391370503eb3da4517ef1e9d2fa5e51694ec271bfb185c9b2788c2cc2f2f8296a8807c4ae3afd646d4424e466

Download Submit
C:\Windows\SysWOW64\Lnhmng32.exe

Filesize
322KB

MD5
04a742c6bc38913fe1048248e6a35981

SHA1
1047e5388b5deedc899bed31de4658e64a6213f1

SHA256
afeca29712a4c99390599813bec07e4c6ec80a7d60a4426746f6bb4f361d3a5e

SHA512
9df447c0fa48315d2ee7e4c4400b58049905f82bf2c99d81ebae29fa3eebf78b8c78e791e492df70593305322b4ea66bceb5330c99f107a894e45693b2d813ff

Download Submit
C:\Windows\SysWOW64\Lphfpbdi.exe

Filesize
322KB

MD5
52c856555a8f60653692bad8682c358a

SHA1
d5d4fa892e692c7ed00e97512af8776a86c3ca43

SHA256
494124b8595cf4c5b563525012a1f7a33aeee5d4849197b1206625358cc284d8

SHA512
20a050b2a40be7bc7fd3e93c0cac3edb8f8596115cfa16cae463e145c7d552f2f32466ec0f25b34ddf37dba998b243e565284692b382eaa3eb7d218926904935

Download Submit
C:\Windows\SysWOW64\Maaepd32.exe

Filesize
322KB

MD5
01c4cff96beaab23a91f6f666247616a

SHA1
49e431c93c61deda3d00ada853c3b50563e0aa1c

SHA256
03bd87ea48bbc8f3fd01901a1a1d8f2d6c58b05b7da475fb7170b5c439a15d30

SHA512
275cc28933657cb8d32c51e631c250ed2d905bc4a6c6a85d5e9ea1e860a3d3edabf217475cc7e8cafc743712858b959afc3b02d16d3538e377b69e568ed76358

Download Submit
C:\Windows\SysWOW64\Mahbje32.exe

Filesize
322KB

MD5
acf4a6d49e4d554b56fb9e271a5cf84d

SHA1
9ff0fe42a3690b51b8531d886755753f38583fdd

SHA256
c307462e257c27dcddfc571de9ccc7487a3bf202a6c8c3217ae9d491ad884555

SHA512
c29018d1d1274f9ec787d19071aed03ef7e95aed6a3ac1d87bd02dc91fdd1a46c5067f59daae013350aae5311d8cf20b4ccd2504f2f4b323c67816f5d79df442

Download Submit
C:\Windows\SysWOW64\Mamleegg.exe

Filesize
322KB

MD5
6b71b05e270ec14cac25d37b301c2ab7

SHA1
595a926896392d67dd54a3182633a2fe5481c039

SHA256
5f9925759992a7f2f7ae84e603a4bdbc1d5c9e8ee082d0f08323f02d37f9774d

SHA512
423aa9cb9215f4b0198aedcc3b42ff968dac366693813990b63a6032976cd49732649096f02c44b7718b48c10719d01407a30e596cfac695b1bfa03fac1840cb

Download Submit
C:\Windows\SysWOW64\Mcnhmm32.exe

Filesize
322KB

MD5
75351b1c32d545729e903c4f4f218fdf

SHA1
2e0a2b5c89ebe4952fa11bfb7812390dadcf971d

SHA256
f686d31fd9d0682d3af69577ed8f654d22065d98b96007fc5f9e4a647036eb98

SHA512
8592f5f76f94c64b1a37efe1480f1d96fe8a88373e41317257e2d5102ad107d7d325497da9efb9692e4b6ef82381d9fc70e2bf9374b138ee90f158dcb9cb5557

Download Submit
C:\Windows\SysWOW64\Mcpebmkb.exe

Filesize
322KB

MD5
6d38c49fce30f56e650959aec5f528a6

SHA1
c3cc1083c4ede6f7f1321e945e9a3e7b208fff78

SHA256
c5aecf33e8ca8ffe1a2a451d495230ec9aa1158a4ec49c725b8ff0516d9e0173

SHA512
8b4fbc86a477b61ec75f089ab126cd48d8f573ab5e848836fb92c6633b679cf26c65fc8a720c4df7aed8147dacb9e72b069571aa789e98f5154be6e17f5600dc

Download Submit
C:\Windows\SysWOW64\Mdmegp32.exe

Filesize
322KB

MD5
e0861567585ef82992f60a8a4417cc8a

SHA1
5e2a522f1f129c038718906f3fad0fa16dc0a29f

SHA256
cd36a0b045290cebce2ce83e59233697130217bec33b641a41ff899b1d34c740

SHA512
3fb8929aa2784fd53602f96865a30c745d8819a827c345d11502cd81f16607bd7d120824b0ffae9368a7ce4a7cca78a3f2ccedf82997d56b086524cffa7a1ea5

Download Submit
C:\Windows\SysWOW64\Mkepnjng.exe

Filesize
322KB

MD5
a1e0e83a4294678126d16d651ae37232

SHA1
b22eb7436c7166615521064321f61dbd574028d0

SHA256
a3c13d93d52962cccf9c32a39ead407e84e96762f38d26c3aff05b61cdc5ec6f

SHA512
c83d48ebe68d3f2c22d3a2194288b625410d84ca4ef1d389edab1c933618bcda10c9e220cee19f99a519addc7bfad21ba8815e027784be43f9824c0269008eb6

Download Submit
C:\Windows\SysWOW64\Mkpgck32.exe

Filesize
322KB

MD5
6f365347f9ce2f9ba25feee7977ca924

SHA1
5ded8a15aff27ac219c9d0547b29a04ad5125608

SHA256
40599c2bcc1fc8430a15a3c32e9a447dbde23597f0376fea6648a56d4ca46344

SHA512
4cbc02a42f75c54c1c779a8fc2cbd60982a68c53d5a552438d5d5b39a179747123e977b0d42fe8db03c4e2f6e49c63b38f4191825011ad886b82e997a9eeea01

Download Submit
C:\Windows\SysWOW64\Mlcifmbl.exe

Filesize
322KB

MD5
4af021c9f693da6339d5961863617d49

SHA1
502deb857852c7100e8d32017324fbb59a1feac2

SHA256
bb840bf656c956bbe602037a8e85a08e2ff2fcb0a0fb95e57cb97cf843eb5f8b

SHA512
fe9afaadc5958073a988fc1263c394c0fca08874c32aecaea28eb9458ed74bdcacb94666775b9adb6ab0afcfb446d4ae09e177b296d996c67462cd15628e8e17

Download Submit
C:\Windows\SysWOW64\Mlhbal32.exe

Filesize
322KB

MD5
d7a18dfb7777cc46cfd960ea4866d560

SHA1
1d3d4816fff5e968c0d843e977a8530abdfd8b45

SHA256
6c007cda65330027e1e16c82fa9e57467c72bf6e81f8b591fc001516e75a456a

SHA512
b251e876c9ea7216ffde7201417af46f4b8ca1eb137b520266d84d60b0e19a5b2417546bbdd732df5055ef650b3d1fd8fd5604b32eb7809f6f7c51e23bdd708b

Download Submit
C:\Windows\SysWOW64\Mmnldp32.exe

Filesize
322KB

MD5
a5eb78db52dc36a8a9c44d0ee2442a30

SHA1
91957fb4cbc7b704a1e109ef0332b0869f7bf6c4

SHA256
c07a02d1a95f0bb480ed1af571c6c3dcb8c28c91ed25f61f935a185fc19d7489

SHA512
e14b14c39168c9ee18894d2e4f065e8da38827e72ebb734b5042e06b852a9ed5eb0d0a5da0163354783d50af2c6649ddd30e50f53e8fb5cfdf30c6ed15c54bf7

Download Submit
C:\Windows\SysWOW64\Mpmokb32.exe

Filesize
322KB

MD5
e6ab9df079e2ab9a6a36ed142f7d0b5b

SHA1
504a4a39a1a0fe6b25f59a12821f39516cb14fa2

SHA256
fd575343b2a43f9b693ed7dd193a2164330fbaa0d7c170bf4ccde2c3fa09387b

SHA512
68313ebe4337b85fad2a8bd4260a7088d730fb5cb2dde3ad08749a4e9d4269a29e84fdfef2da5b8bf4d31bff290f098d5503cb267ac02404863ed820e1a1a602

Download Submit
C:\Windows\SysWOW64\Mpmokb32.exe

Filesize
256KB

MD5
4986f8fa9f69ae0973bf9868622d5be7

SHA1
d0144639e6277d6119d2c2525dee552ca948eb5d

SHA256
df9971bb19da10b14432780a7995a25fa4a5d63f7b6b72f5fd7c6246da46ea5f

SHA512
c4fa3dd0a1f6dfc649eeffca8e06c76fd9c9399f6d16695c92d5b617695edade2db80e13952ea588d170b0a7801ea10fdb0072caa3e9f289e0ebab0e7afb1767

Download Submit
C:\Windows\SysWOW64\Nafokcol.exe

Filesize
322KB

MD5
7dbbd2c5cbfecb3ba938b4112ed85e0b

SHA1
463dd6be7feb4d3f44b8fb18804f9a8b5d17cc6f

SHA256
28b568779a7ad9cdf72de2c6039c0fbe0b360a698377709791d9eef8cd956b8a

SHA512
7a451f296d1383217b1caa4c0051ef6dcf8701b9406f08790345aaa0ce3a0613e7dadf13eb85e7dbf7eb1f8bbd8332380d280e30b505d715f0c1e8e49df4b516

Download Submit
C:\Windows\SysWOW64\Nbkhfc32.exe

Filesize
322KB

MD5
1d8c41adaaeb9709e6865072637030dc

SHA1
189adc307a304ec54cedf2906b8fa8a876b2ea75

SHA256
c5df7febf6ade976f5317af0e6def28872f0a6ee1bc913b029435846113b9540

SHA512
87bde5aae2db38f4da2d127333a589e90fadc953990c570bbe6daeb8804c81e8ded109160b32845e6a0c0b81cb45be3e7950b14df84c5e2303c7100692ac8922

Download Submit
C:\Windows\SysWOW64\Ncianepl.exe

Filesize
322KB

MD5
5634b6e199a61d64ecdd9d9286db1fef

SHA1
b9f29719118f85c98cc1c59b0c301a9864341229

SHA256
80d11b961b7115fd1311a5da435310248adf668536cd311ad60d2c386b044784

SHA512
021e94ae435000b1fe511a79ae68ae8a045fc2327b74d0afebd99100e0a01d8c91fb8f53cf741c54f9a535cf2d0eaab0867bfed7fb744b86dde38e2f2210b2ce

Download Submit
C:\Windows\SysWOW64\Ncnadk32.exe

Filesize
322KB

MD5
b12bbe6d36eaa8ecb01ba21cb138e0a4

SHA1
b75dcd87db7d72541cda327a8a5af3e827a9f52c

SHA256
0c075175ccbcb078151dc263cb7c29230a4bc5a86e858e918da26e7db8dc9e97

SHA512
204c13b0fcec3512d89fbee35eba3930bd051801ea039a7d0a8f6c13f7bf275fca1e7170f487b761e17b84990ea1b7cebf924d58598871ab5187e358ceecc5a4

Download Submit
C:\Windows\SysWOW64\Ndbnboqb.exe

Filesize
322KB

MD5
945b6d26d45e0bcbe3731a8d29d824e1

SHA1
2401ddb3ed2444657948d913f91c38110a89ceac

SHA256
c458f70ca3154851039908a0e2b03ba5a9cdb626a4fd891e81212f8b32c743f9

SHA512
5d4e12c882aee73307e845553a0ed8f336aa6be794bb825ca58fe08225488e858ab2411f035f9cc3f2d25510eab32ab8ba3243bcba3b6f21f88781f7fce4a20e

Download Submit
C:\Windows\SysWOW64\Nggqoj32.exe

Filesize
322KB

MD5
7c1978c687163463059d24c5d5524e7d

SHA1
09ee08227a23ee9516a8cc3551c6ebfb2351d1ef

SHA256
dcb58caff3e54f2b7521ab5a5664cdc17871f248cb3164cc5c3c47b0acbe8265

SHA512
fc5fb554e0f4943b944fccfd5000adcc0d7ec4da7a04f796eda1f22b5078c9f1971166228e37233a4846e264b62c5e7aed83469ad1698bd8dbaf668cc79ca5fe

Download Submit
C:\Windows\SysWOW64\Ngpjnkpf.exe

Filesize
322KB

MD5
f9e81087876128e5d05617d0de8bd4c6

SHA1
beba0bc2ebfa45ba11a45cd8b5f0e092434a6368

SHA256
016dddcd7172a27af4694ac9e751a6dd4434b71979fe21f2c52912a39e250d79

SHA512
587ffb32da32035fa957a4745eb92623d26491c0bbf55d63a8c0fc4dec5a7d21cff6d02a4c2d9b6a25196d50bed54020003f2f32b89ed638e896f47b099f38b8

Download Submit
C:\Windows\SysWOW64\Nilcjp32.exe

Filesize
322KB

MD5
3a72ed9f651cc4fb7cc59c799da04af7

SHA1
6b6ee7659eb85f97eb32214bf7a72a825acb4fc8

SHA256
5d4e835b94f44f8a415948b48351c8b8b61061c3589012b1be372fe703a3b26d

SHA512
5272eabb00799de031e0a992890dcb53b1141a912626d01eaaff40f78297196380e0f20916480cc72aee6d9f9fa08e872664ce9b2f0a48dbbb34133090a74d65

Download Submit
C:\Windows\SysWOW64\Nkjjij32.exe

Filesize
322KB

MD5
b134613c5d9c615f81d0e0af205168bc

SHA1
5db8661559c1f526bb58c6dfba5d3c71c5a4438b

SHA256
7683e0fb31f28b3dba3dc670c9649590ab358ced2d418dc8837a0da1d2c0e694

SHA512
84f8f17732f1c63440667b779802575da4e255b6e36079138ebc420891667b1eebfeb65839a98fa991c7d7062c66dbf1d2e0b50de83dae9da2f08997f0639a54

Download Submit
C:\Windows\SysWOW64\Nnmopdep.exe

Filesize
322KB

MD5
ecd8828cd717033a13a6dc7b121cde45

SHA1
42f5da345d28631117861be385f8172789860a83

SHA256
cefa0d168ffa4e2e4e7d814717a4865c6d87663a79571ff13f41562f8105c8cf

SHA512
e29f3d4c43c3e7765367a3febb1caec5a7ca160ff686c09a21af382aa17a99b10d32fda67f83d0966a1f1c4a91f189cbced39322cb8f1055a0a1d04cbe521b35

Download Submit
C:\Windows\SysWOW64\Obdkma32.exe

Filesize
322KB

MD5
976f4ca28929267a037a80d830cad450

SHA1
7265af4d4119d8f0cec0fdfa009d725ecd3bd3ae

SHA256
eb908bfdb298b3b9a29eeeeecc7099ad70a2dd9e21cdf0655145fe6873d090e6

SHA512
957c93707db1071a9c1234a3b6cffcbc9a463b8a5dadbf2f39e3fbbb8535dc95850478187a201d7e40f49a7a0a19ebfe3e6f51d5de4f95953612b0cba34213a3

Download Submit
C:\Windows\SysWOW64\Oboaabga.exe

Filesize
322KB

MD5
8bcbadca23aa625c78fb618efcd4f736

SHA1
8deb03003fddc67393e36827f3cf7d59c1f4d060

SHA256
8860dfb69c6141285ca4161bd6bb9c2fc96cee364a4a4d038807245f670efe09

SHA512
435b6bc0ca00546d4c2f78a1923590d5d57033421d226409e55def789c47cb3178d0b6c0558c5e7a25637ecc8c712e6427383c02f5598eb404bd51fea56495c8

Download Submit
C:\Windows\SysWOW64\Ocegdjij.exe

Filesize
322KB

MD5
7a816eae9690c5c22d55688b5353624f

SHA1
27db582bfc4bb2fc35275d6101cd404f394b5a4e

SHA256
54a108e4f1a957282b8ac2f51cb9605800bcdad2cc9566241acce7ab916eb4f7

SHA512
bdc531996fa11fb010dcec522c027e27e71f8d805bcde15e9ba7090652e09b4255c774e5505adc506e26ee406a43db309a3e642ded794d43d15468ff620da6aa

Download Submit
C:\Windows\SysWOW64\Ocgdji32.exe

Filesize
322KB

MD5
e4acf79b5aea59c44a63b56615e63f05

SHA1
2c3bdba5a3d0b249f52445d8ecc8861e379d33c4

SHA256
1a619d25459f084c411be49cb7bda2cf1961b526465fc3e4715e5da273236c4b

SHA512
d1bac77c83d2a1b736184b6575fa9fd8c50baa6cd1f2c7cf634c5a765e11db624862717c7c14962bcf214cd9ceb986e07745c08e3888df499beaf6bff0821746

Download Submit
C:\Windows\SysWOW64\Ocnjidkf.exe

Filesize
322KB

MD5
d74ce46b0c387d1f27d4d6c2b580f506

SHA1
549c678ab91073c7db84f3561c45b87e336b0234

SHA256
658d5aa148400d67e4cf28dba0975784a05ff45c574cd38eba05ed3f72d58409

SHA512
fd1d8a6fb9a4c71ff5ff5d697a57e9a868342c72abdda0305e28e7a805084fe1680e511610a67f5233873b910fc93d1711e14b2cbeb69b063a38f4d6d224f676

Download Submit
C:\Windows\SysWOW64\Ojjffddl.exe

Filesize
322KB

MD5
a78c2b7f8f1bf2a22e5178ae360c4250

SHA1
cab8f057eeaf5f6b0b46742ce44cd4c6253a1389

SHA256
cd90890e5aa838588ca01764f3c5fd7f520f29869e4c33f87efc29bbc192b27c

SHA512
74fff95f9717adb36271d2e94e7820012a7267a5f7a2e4dada95bece36de43f1ae0989a3c5f6eadef9a52c39c2618f3c431391a55b78d571bb05095ac63d31bc

Download Submit
C:\Windows\SysWOW64\Oqdoboli.exe

Filesize
322KB

MD5
cb728ae9cbcf2724d3b5bcee18c5da55

SHA1
cef816372fbb4e6a2958e8b13f31d75b3cd0d5ff

SHA256
d45b719b24c44bcad2b2ea07443c3a34f3838105f36917ee8270545d6c225eb1

SHA512
0d7a1f06d2728cec0c34f72727777960dbab11047c77953ba9a1e9f4393a59effec57a466eed442ecd61fde33a40c4b77b3fbceab8af282b1b3d180d28ec863d

Download Submit
C:\Windows\SysWOW64\Oqfdnhfk.exe

Filesize
322KB

MD5
5e6431341bb067a1560e3acd6b4f9506

SHA1
aa3f06a03122276ed2acd2c7e72d6f58f6daad14

SHA256
1bb5e5e7dfd5981f2cd0427c9ead4a3e8f8621f65c993ba01d8e10cd79e39eaa

SHA512
a96ce98622be46afd79edfe94e4f4f2053583f31949760de6288ad4040026ea4da8db625e23cfa3b5c2f14d587d20f015d83f3b018354ebf6f8627db3d9ce397

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
322KB

MD5
fec2d4b1b61e8f8a0e8a36eaf046503b

SHA1
00bb8a8b6e6de6a1db6b1e47d1d1cc8518e07573

SHA256
71493a1dac0a5697fcc0fcaa2630a15e01e76662c8255e3eeedaac4ef9bf5587

SHA512
e40198e85c3a9895d4dead547ce1c3072f6d0c6a6c42db5aeb56bbacb2d99ab53f676879fedf9c5f3fb2ff8010db7e37ebe4d87f7c5a308bb86b34b6e9c228c3

Download Submit
C:\Windows\SysWOW64\Pdkcde32.exe

Filesize
322KB

MD5
0f36c0c74e81dab35a4a8b6b4c7991fd

SHA1
f6000c3b8dcaf56002c2546f0ebee902f0d31660

SHA256
b39d05976ef2ddeb07658dc3f32f412d60c98402883ec8b21eb7aba4194d3509

SHA512
54cd8f7bbf84ec4914be61d601beebc2e6fd03e4643364703a63b7fa4a101a2e96fbbe2027182c96ec00c4fad988596735d70aa4033ead85c28a45fb78464a19

Download Submit
C:\Windows\SysWOW64\Pfhfan32.exe

Filesize
322KB

MD5
d93b3adfd12a97f47b790a052eca0f98

SHA1
ef344c306afc1d63415a152d54182695fa3a1511

SHA256
50df77a9bc29952b39eaa55821dcf14a5cab865247d16904c4534796d68274eb

SHA512
37df7af91a63df75e935a18bf6a7857e1e8e07c047deacbb4614541a3cfe06e6afa52439f262a5662d5bdcf95750ff09547544263ac2a2dd05fc64b5d2d998c1

Download Submit
C:\Windows\SysWOW64\Pjhbgb32.exe

Filesize
64KB

MD5
3b805fb17f13669b9b36128bde0ed52f

SHA1
873bfb6fb53b4647b8e72f077894ae197dd652cc

SHA256
f555d3872cd19cb8cbdb005a70fc83dd0a04b585752d1c081541a9fc9a38882e

SHA512
4f3a4649d0ad3894b5d25d317ef0e2599e8e135e06fb65252b6a48151c7f9a35d678df6348b307dc488117283fe0e883e659140c234ee2a712e13827ab400af4

Download Submit
C:\Windows\SysWOW64\Pkaiqf32.exe

Filesize
64KB

MD5
e247453a24e697ae1ab072921d13f9bf

SHA1
2121a4a4775e2da2e390efc04e8dacd16ced7553

SHA256
e49e15451c8cbb69b635fa58cd5f2936e0ae2d08cca726ac88c501a1d0a02699

SHA512
e11b34d5c8b62807c8f6b63832ec6cb52abfc46c5e7445d788657e95864b420779f2319e05ec77757ee663d89247235e10c3fae887baf3698c5857041384328c

Download Submit
C:\Windows\SysWOW64\Pnfkma32.exe

Filesize
322KB

MD5
cbf827ab39db2eca4cbc9fc329c3e87b

SHA1
51b0222c6852a1fe4ac76f48e7ccecdfe7abef30

SHA256
6dbbfba7b186e879b4d8983e02a1bb05c666e46b9231e6908401dd26ff88be50

SHA512
b94eba64325b0fe965c611ca2d12fdf73e3d5fa6a0c235db1d0be9b6ab6c906404b6f0623dcaaf4704a26b8ef65e8559733ebefbc931550aa2c497b4ee1ff9d0

Download Submit
C:\Windows\SysWOW64\Qceiaa32.exe

Filesize
322KB

MD5
81ebb34458dfb8329d43cc0d7c15a498

SHA1
0171601817ca770d6551a8ea3fbba34fae520f40

SHA256
aafc967c5102ba946b86d5092934a8e8ff8a5454ebd402b7941fa3fb609782ae

SHA512
059816aa01906e771081095716b5dd1ba0ea84b3d83aeb54c201c3237fc25b38858dc631f72d47a2536cacecad91af3da2bf816776b12c6ba05a84f793d081d8

Download Submit
C:\Windows\SysWOW64\Qeemej32.exe

Filesize
322KB

MD5
ebae4281809a2c1b668a5c41abd9e87c

SHA1
0a719fa137609167a972e7d5b0e546c503546b5f

SHA256
78dd3eb8109fa0e77de341780ac3ed5955222e9570db1492548a3776e1a6f295

SHA512
b14cc6cb0ee3a683f9dbea850cd4deb476c99a0e5a1ad236735675dffa109b50e192773f13f099897fcbeeb42dcf860a39e15b4fc75a789c5f6c392705cfe183

Download Submit
memory/64-509-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/216-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/376-140-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/624-36-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/636-23-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/636-560-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/756-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/992-428-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1140-430-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1156-533-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1220-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1252-567-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1408-370-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1536-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1768-157-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1796-352-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1832-364-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1940-586-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1940-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1972-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2020-520-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-376-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2220-388-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2252-167-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2260-554-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2276-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2304-239-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2328-292-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2372-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2420-316-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2472-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2476-262-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2508-448-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2524-442-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2548-207-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2588-406-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2592-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2792-551-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2796-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2848-561-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2884-400-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2940-503-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2948-127-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2972-304-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2984-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3008-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3052-497-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3076-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3076-543-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3132-346-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3180-322-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3192-472-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3212-496-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3220-461-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3272-545-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3312-382-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3388-223-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3440-286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3540-44-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3572-47-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3572-579-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3688-521-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3708-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3708-546-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3736-488-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3748-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3756-482-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3800-216-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3952-340-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4056-574-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4060-531-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4064-148-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4276-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4288-394-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4292-255-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4312-494-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4320-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4364-188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4380-553-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4380-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4444-436-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4548-199-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4576-125-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4588-358-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4664-593-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4664-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4720-466-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4820-274-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4872-334-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4892-179-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5024-454-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5028-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5032-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5136-580-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5184-587-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5228-594-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/8672-2342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads