5b7fa3d16d0cbbd8fa78c130beb1de699bb46e98d79b06e714aae7104d41392a

Analysis

max time kernel
137s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 22:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ad44c1f94884efdf7b72de6434e1f20_NeikiAnalytics.exe
Size

64KB
MD5

9ad44c1f94884efdf7b72de6434e1f20
SHA1

a2b1d524895b864c5e435931dcd823c28efaecb9
SHA256

5b7fa3d16d0cbbd8fa78c130beb1de699bb46e98d79b06e714aae7104d41392a
SHA512

2f93d9b5951ee928f1d51ac6e3960508cd252241f634c7e0d20b9ddabc7a25831be5bd7707cfd65ba1d24505aedabfe65a7e7d0c15b5551cbcdd75826b3f9d6a
SSDEEP

1536:n6HcBhe8pawJdjHdclTjafnV0x2LnrDWBi:6H+bVzHkinV5n2Bi

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Occkojkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iemppiab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncldnkae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkepnjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcncpbmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjmlbbdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aegikj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deagdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjhbgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjbndobo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cefoce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imoneg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klljnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddbbeade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkoiefmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjffbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbcilkjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekcpbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edkdkplj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Baicac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onfbfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dllfkn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofnckp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aclpap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbifelba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgkjhe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgdji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdolhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eaklidoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjdkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdeoemeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojgbfocc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imihfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onholckc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogaceh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olkhmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njfmke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Docmgjhp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecjhcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcebhoii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mamleegg.exe

Executes dropped EXE 64 IoCs

pid	Process
388	Imihfl32.exe
4484	Jdcpcf32.exe
4516	Jjmhppqd.exe
2764	Jpjqhgol.exe
2232	Jfdida32.exe
3316	Jibeql32.exe
2036	Jaimbj32.exe
4372	Jbkjjblm.exe
2172	Jfffjqdf.exe
4788	Jmpngk32.exe
4596	Jpojcf32.exe
3304	Jdjfcecp.exe
3968	Jigollag.exe
1416	Jangmibi.exe
4400	Jbocea32.exe
2572	Kaqcbi32.exe
212	Kdopod32.exe
1540	Kkihknfg.exe
2492	Kpepcedo.exe
1844	Kgphpo32.exe
3992	Kinemkko.exe
2588	Kaemnhla.exe
1728	Kbfiep32.exe
1632	Kipabjil.exe
4640	Kpjjod32.exe
4100	Kcifkp32.exe
5068	Kkpnlm32.exe
4432	Kmnjhioc.exe
5064	Kajfig32.exe
4360	Kgfoan32.exe
5052	Lmqgnhmp.exe
2224	Ldkojb32.exe
4436	Lgikfn32.exe
1832	Liggbi32.exe
1272	Lmccchkn.exe
3208	Ldmlpbbj.exe
3940	Lgkhlnbn.exe
4020	Lkgdml32.exe
2932	Lijdhiaa.exe
3716	Lnepih32.exe
4572	Lpcmec32.exe
2412	Ldohebqh.exe
116	Lcbiao32.exe
624	Lkiqbl32.exe
2528	Lnhmng32.exe
4256	Ldaeka32.exe
4672	Lcdegnep.exe
4936	Lgpagm32.exe
3852	Lnjjdgee.exe
3392	Lphfpbdi.exe
4512	Lcgblncm.exe
2676	Lgbnmm32.exe
876	Mjqjih32.exe
1292	Mahbje32.exe
4280	Mpkbebbf.exe
3320	Mciobn32.exe
1860	Mkpgck32.exe
1000	Mnocof32.exe
4536	Mpmokb32.exe
2824	Mdiklqhm.exe
4472	Mgghhlhq.exe
1056	Mjeddggd.exe
4688	Mamleegg.exe
2652	Mdkhapfj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Lmccchkn.exe	Liggbi32.exe
File opened for modification	C:\Windows\SysWOW64\Lijdhiaa.exe	Lkgdml32.exe
File created	C:\Windows\SysWOW64\Lnepih32.exe	Lijdhiaa.exe
File opened for modification	C:\Windows\SysWOW64\Nbkhfc32.exe	Nkqpjidj.exe
File opened for modification	C:\Windows\SysWOW64\Ahhblemi.exe	Acmflf32.exe
File opened for modification	C:\Windows\SysWOW64\Mgddhf32.exe	Mdehlk32.exe
File opened for modification	C:\Windows\SysWOW64\Ognpebpj.exe	Odocigqg.exe
File created	C:\Windows\SysWOW64\Gcdmai32.dll	Ocdqjceo.exe
File created	C:\Windows\SysWOW64\Kinemkko.exe	Kgphpo32.exe
File created	C:\Windows\SysWOW64\Lnhmng32.exe	Lkiqbl32.exe
File created	C:\Windows\SysWOW64\Mkepnjng.exe	Mgidml32.exe
File created	C:\Windows\SysWOW64\Lcoppd32.dll	Onfbfc32.exe
File created	C:\Windows\SysWOW64\Edpnfo32.exe	Eabbjc32.exe
File created	C:\Windows\SysWOW64\Ingapb32.dll	Jpnchp32.exe
File opened for modification	C:\Windows\SysWOW64\Mgghhlhq.exe	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Cliaoq32.exe	Chmeobkq.exe
File opened for modification	C:\Windows\SysWOW64\Jmpgldhg.exe	Jehokgge.exe
File created	C:\Windows\SysWOW64\Jjlogcip.dll	Banllbdn.exe
File opened for modification	C:\Windows\SysWOW64\Lkgdml32.exe	Lgkhlnbn.exe
File created	C:\Windows\SysWOW64\Lijdhiaa.exe	Lkgdml32.exe
File opened for modification	C:\Windows\SysWOW64\Mdiklqhm.exe	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Gkniapgh.dll	Njfmke32.exe
File created	C:\Windows\SysWOW64\Qoqbfpfe.dll	Acjclpcf.exe
File created	C:\Windows\SysWOW64\Dhkjej32.exe	Delnin32.exe
File opened for modification	C:\Windows\SysWOW64\Edihepnm.exe	Eaklidoi.exe
File opened for modification	C:\Windows\SysWOW64\Edpnfo32.exe	Eabbjc32.exe
File created	C:\Windows\SysWOW64\Gfembo32.exe	Gkoiefmj.exe
File created	C:\Windows\SysWOW64\Oqhacgdh.exe	Olmeci32.exe
File created	C:\Windows\SysWOW64\Jifkeoll.dll	Lmqgnhmp.exe
File opened for modification	C:\Windows\SysWOW64\Qecppkdm.exe	Pbddcoei.exe
File created	C:\Windows\SysWOW64\Iclnemml.dll	Aegikj32.exe
File created	C:\Windows\SysWOW64\Jlajgl32.dll	Cdiooblp.exe
File created	C:\Windows\SysWOW64\Gjihje32.dll	Dhbgqohi.exe
File created	C:\Windows\SysWOW64\Oolpjdob.dll	Ldleel32.exe
File opened for modification	C:\Windows\SysWOW64\Onklabip.exe	Ojopad32.exe
File opened for modification	C:\Windows\SysWOW64\Paegjl32.exe	Pbbgnpgl.exe
File opened for modification	C:\Windows\SysWOW64\Cliaoq32.exe	Chmeobkq.exe
File opened for modification	C:\Windows\SysWOW64\Cefoce32.exe	Cbgbgj32.exe
File opened for modification	C:\Windows\SysWOW64\Ojgbfocc.exe	Olcbmj32.exe
File opened for modification	C:\Windows\SysWOW64\Pcncpbmd.exe	Pjeoglgc.exe
File opened for modification	C:\Windows\SysWOW64\Jdjfcecp.exe	Jpojcf32.exe
File created	C:\Windows\SysWOW64\Ndbnboqb.exe	Nacbfdao.exe
File created	C:\Windows\SysWOW64\Pcagphom.exe	Pabkdmpi.exe
File opened for modification	C:\Windows\SysWOW64\Lmbmibhb.exe	Lbmhlihl.exe
File created	C:\Windows\SysWOW64\Mgfqmfde.exe	Mlampmdo.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Dopigd32.exe
File opened for modification	C:\Windows\SysWOW64\Ddbbeade.exe	Dbaemi32.exe
File opened for modification	C:\Windows\SysWOW64\Glhonj32.exe	Gdqgmmjb.exe
File created	C:\Windows\SysWOW64\Hioiji32.exe	Himldi32.exe
File created	C:\Windows\SysWOW64\Jcbdhp32.dll	Dhmgki32.exe
File created	C:\Windows\SysWOW64\Fmijnn32.dll	Mgimcebb.exe
File created	C:\Windows\SysWOW64\Kjpgii32.dll	Ocgmpccl.exe
File created	C:\Windows\SysWOW64\Occkojkm.exe	Oqdoboli.exe
File created	C:\Windows\SysWOW64\Peljol32.exe	Pjffbc32.exe
File created	C:\Windows\SysWOW64\Manffk32.dll	Ckcgkldl.exe
File opened for modification	C:\Windows\SysWOW64\Eaklidoi.exe	Echknh32.exe
File created	C:\Windows\SysWOW64\Fcmnpe32.exe	Foabofnn.exe
File created	C:\Windows\SysWOW64\Allebf32.dll	Lbmhlihl.exe
File created	C:\Windows\SysWOW64\Jekpanpa.dll	Cjpckf32.exe
File opened for modification	C:\Windows\SysWOW64\Jpjqhgol.exe	Jjmhppqd.exe
File created	C:\Windows\SysWOW64\Lmccchkn.exe	Liggbi32.exe
File opened for modification	C:\Windows\SysWOW64\Dhidjpqc.exe	Dekhneap.exe
File created	C:\Windows\SysWOW64\Flqimk32.exe	Fhemmlhc.exe
File opened for modification	C:\Windows\SysWOW64\Hkdbpe32.exe	Gdjjckag.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12156	12064	WerFault.exe	569

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekemhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmknaell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfkfpo32.dll"	Klqcioba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aclpap32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbqlfkmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Clnjjpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eckgieoo.dll"	Dkoggkjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlingkpe.dll"	Ngpccdlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdfibe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilabfj32.dll"	Bkidenlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okokppbk.dll"	Kefkme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkihknfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlddhggk.dll"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olcbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jilkmnni.dll"	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flgehc32.dll"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljfemn32.dll"	Nbhkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imoneg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knkkfojb.dll"	Npcoakfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enlqgg32.dll"	Hioiji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkajcp32.dll"	Pjhbgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekemhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiojlkkj.dll"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anmklllo.dll"	Jfffjqdf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkoggkjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpmmhi32.dll"	Dceohhja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfmepi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phiifkjp.dll"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qnkdhpjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chmeobkq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klqmnp32.dll"	Pgopffec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pldhcm32.dll"	Hoiafcic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfdhkhjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odbgim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jglkll32.dll"	Ocgdji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iemkcl32.dll"	Pkaiqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdainc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcimkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbnmibj.dll"	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbcfgejn.dll"	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onklabip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnigkegh.dll"	Clkndpag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ingapb32.dll"	Jpnchp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgimcebb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odocigqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olmeci32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbocea32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 388	4784	9ad44c1f94884efdf7b72de6434e1f20_NeikiAnalytics.exe	83
PID 4784 wrote to memory of 388	4784	9ad44c1f94884efdf7b72de6434e1f20_NeikiAnalytics.exe	83
PID 4784 wrote to memory of 388	4784	9ad44c1f94884efdf7b72de6434e1f20_NeikiAnalytics.exe	83
PID 388 wrote to memory of 4484	388	Imihfl32.exe	84
PID 388 wrote to memory of 4484	388	Imihfl32.exe	84
PID 388 wrote to memory of 4484	388	Imihfl32.exe	84
PID 4484 wrote to memory of 4516	4484	Jdcpcf32.exe	85
PID 4484 wrote to memory of 4516	4484	Jdcpcf32.exe	85
PID 4484 wrote to memory of 4516	4484	Jdcpcf32.exe	85
PID 4516 wrote to memory of 2764	4516	Jjmhppqd.exe	86
PID 4516 wrote to memory of 2764	4516	Jjmhppqd.exe	86
PID 4516 wrote to memory of 2764	4516	Jjmhppqd.exe	86
PID 2764 wrote to memory of 2232	2764	Jpjqhgol.exe	87
PID 2764 wrote to memory of 2232	2764	Jpjqhgol.exe	87
PID 2764 wrote to memory of 2232	2764	Jpjqhgol.exe	87
PID 2232 wrote to memory of 3316	2232	Jfdida32.exe	88
PID 2232 wrote to memory of 3316	2232	Jfdida32.exe	88
PID 2232 wrote to memory of 3316	2232	Jfdida32.exe	88
PID 3316 wrote to memory of 2036	3316	Jibeql32.exe	89
PID 3316 wrote to memory of 2036	3316	Jibeql32.exe	89
PID 3316 wrote to memory of 2036	3316	Jibeql32.exe	89
PID 2036 wrote to memory of 4372	2036	Jaimbj32.exe	90
PID 2036 wrote to memory of 4372	2036	Jaimbj32.exe	90
PID 2036 wrote to memory of 4372	2036	Jaimbj32.exe	90
PID 4372 wrote to memory of 2172	4372	Jbkjjblm.exe	91
PID 4372 wrote to memory of 2172	4372	Jbkjjblm.exe	91
PID 4372 wrote to memory of 2172	4372	Jbkjjblm.exe	91
PID 2172 wrote to memory of 4788	2172	Jfffjqdf.exe	92
PID 2172 wrote to memory of 4788	2172	Jfffjqdf.exe	92
PID 2172 wrote to memory of 4788	2172	Jfffjqdf.exe	92
PID 4788 wrote to memory of 4596	4788	Jmpngk32.exe	93
PID 4788 wrote to memory of 4596	4788	Jmpngk32.exe	93
PID 4788 wrote to memory of 4596	4788	Jmpngk32.exe	93
PID 4596 wrote to memory of 3304	4596	Jpojcf32.exe	94
PID 4596 wrote to memory of 3304	4596	Jpojcf32.exe	94
PID 4596 wrote to memory of 3304	4596	Jpojcf32.exe	94
PID 3304 wrote to memory of 3968	3304	Jdjfcecp.exe	95
PID 3304 wrote to memory of 3968	3304	Jdjfcecp.exe	95
PID 3304 wrote to memory of 3968	3304	Jdjfcecp.exe	95
PID 3968 wrote to memory of 1416	3968	Jigollag.exe	96
PID 3968 wrote to memory of 1416	3968	Jigollag.exe	96
PID 3968 wrote to memory of 1416	3968	Jigollag.exe	96
PID 1416 wrote to memory of 4400	1416	Jangmibi.exe	97
PID 1416 wrote to memory of 4400	1416	Jangmibi.exe	97
PID 1416 wrote to memory of 4400	1416	Jangmibi.exe	97
PID 4400 wrote to memory of 2572	4400	Jbocea32.exe	98
PID 4400 wrote to memory of 2572	4400	Jbocea32.exe	98
PID 4400 wrote to memory of 2572	4400	Jbocea32.exe	98
PID 2572 wrote to memory of 212	2572	Kaqcbi32.exe	100
PID 2572 wrote to memory of 212	2572	Kaqcbi32.exe	100
PID 2572 wrote to memory of 212	2572	Kaqcbi32.exe	100
PID 212 wrote to memory of 1540	212	Kdopod32.exe	101
PID 212 wrote to memory of 1540	212	Kdopod32.exe	101
PID 212 wrote to memory of 1540	212	Kdopod32.exe	101
PID 1540 wrote to memory of 2492	1540	Kkihknfg.exe	103
PID 1540 wrote to memory of 2492	1540	Kkihknfg.exe	103
PID 1540 wrote to memory of 2492	1540	Kkihknfg.exe	103
PID 2492 wrote to memory of 1844	2492	Kpepcedo.exe	104
PID 2492 wrote to memory of 1844	2492	Kpepcedo.exe	104
PID 2492 wrote to memory of 1844	2492	Kpepcedo.exe	104
PID 1844 wrote to memory of 3992	1844	Kgphpo32.exe	105
PID 1844 wrote to memory of 3992	1844	Kgphpo32.exe	105
PID 1844 wrote to memory of 3992	1844	Kgphpo32.exe	105
PID 3992 wrote to memory of 2588	3992	Kinemkko.exe	106

C:\Users\Admin\AppData\Local\Temp\9ad44c1f94884efdf7b72de6434e1f20_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9ad44c1f94884efdf7b72de6434e1f20_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Windows\SysWOW64\Imihfl32.exe
  C:\Windows\system32\Imihfl32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Windows\SysWOW64\Jdcpcf32.exe
    C:\Windows\system32\Jdcpcf32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Windows\SysWOW64\Jjmhppqd.exe
      C:\Windows\system32\Jjmhppqd.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4516
    - - C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2764
      - C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2232
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3316
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3304
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1416
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4400
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2492
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1844
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3992
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        23⤵
        Executes dropped EXE
        
        PID:2588
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        24⤵
        Executes dropped EXE
        
        PID:1728
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        25⤵
        Executes dropped EXE
        
        PID:1632
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        26⤵
        Executes dropped EXE
        
        PID:4640
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        27⤵
        Executes dropped EXE
        
        PID:4100
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        28⤵
        Executes dropped EXE
        
        PID:5068
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        29⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        30⤵
        Executes dropped EXE
        
        PID:5064
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        31⤵
        Executes dropped EXE
        
        PID:4360
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5052
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        33⤵
        Executes dropped EXE
        
        PID:2224
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        34⤵
        Executes dropped EXE
        
        PID:4436
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1832
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1272
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        37⤵
        Executes dropped EXE
        
        PID:3208
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3940
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4020
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2932
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        41⤵
        Executes dropped EXE
        
        PID:3716
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        42⤵
        Executes dropped EXE
        
        PID:4572
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        43⤵
        Executes dropped EXE
        
        PID:2412
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        44⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:624
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        46⤵
        Executes dropped EXE
        
        PID:2528
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        47⤵
        Executes dropped EXE
        
        PID:4256
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        48⤵
        Executes dropped EXE
        
        PID:4672
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        49⤵
        Executes dropped EXE
        
        PID:4936
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        50⤵
        Executes dropped EXE
        
        PID:3852
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        51⤵
        Executes dropped EXE
        
        PID:3392
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        52⤵
        Executes dropped EXE
        
        PID:4512
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        53⤵
        Executes dropped EXE
        
        PID:2676
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        54⤵
        Executes dropped EXE
        
        PID:876
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        55⤵
        Executes dropped EXE
        
        PID:1292
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        56⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        57⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        58⤵
        Executes dropped EXE
        
        PID:1860
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1000
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4536
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2824
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        62⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        63⤵
        Executes dropped EXE
        
        PID:1056
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4688
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        65⤵
        Executes dropped EXE
        
        PID:2652
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        66⤵
        Drops file in System32 directory
        
        PID:3216
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1912
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3776
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        69⤵
        Modifies registry class
        
        PID:4620
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        70⤵
        
        PID:856
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        71⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1868
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        73⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        74⤵
        Modifies registry class
        
        PID:3252
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        75⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        76⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        77⤵
        Modifies registry class
        
        PID:5008
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        78⤵
        Drops file in System32 directory
        
        PID:2092
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        79⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        80⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1796
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        82⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        83⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3832
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        85⤵
        Modifies registry class
        
        PID:4240
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4548
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        87⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        88⤵
        Modifies registry class
        
        PID:4352
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        89⤵
        Drops file in System32 directory
        
        PID:2448
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1360
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2704
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        92⤵
        
        PID:760
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5128
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        94⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        95⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        96⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        97⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        98⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        99⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        100⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        101⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5560
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        103⤵
        Drops file in System32 directory
        
        PID:5604
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5648
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        105⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        106⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        108⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        109⤵
        Modifies registry class
        
        PID:5872
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5916
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        111⤵
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        112⤵
        Modifies registry class
        
        PID:6016
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        113⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        114⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        116⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        117⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        118⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        119⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        120⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        121⤵
        Modifies registry class
        
        PID:5544
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        122⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        123⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5816
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        125⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        126⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        127⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6084
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        129⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        130⤵
        Drops file in System32 directory
        
        PID:5188
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        131⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        132⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        133⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        134⤵
        Drops file in System32 directory
        
        PID:5724
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        135⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        136⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        137⤵
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5428
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        139⤵
        Drops file in System32 directory
        
        PID:5700
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        140⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        141⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        142⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        143⤵
        Modifies registry class
        
        PID:6120
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        144⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        145⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        146⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        147⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        148⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6384
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        150⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        151⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        152⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        153⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        154⤵
        Drops file in System32 directory
        
        PID:6628
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        155⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        156⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        157⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        158⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        159⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        160⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        161⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        162⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        163⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        164⤵
        Modifies registry class
        
        PID:7064
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        165⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        166⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        167⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6268
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6348
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        170⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        171⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6572
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        173⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        174⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        175⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        176⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6940
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        178⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        179⤵
        Modifies registry class
        
        PID:7084
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        180⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        181⤵
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        182⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        183⤵
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        184⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6652
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        185⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6948
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        187⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        188⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        189⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        190⤵
        Modifies registry class
        
        PID:6560
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        191⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        192⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        193⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        194⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        195⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        196⤵
        Modifies registry class
        
        PID:6924
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        197⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        198⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        199⤵
        Drops file in System32 directory
        
        PID:6280
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6508
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        201⤵
        Drops file in System32 directory
        
        PID:7176
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        202⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        203⤵
        Drops file in System32 directory
        
        PID:7264
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        204⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        205⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        206⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        207⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        208⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        209⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        210⤵
        Drops file in System32 directory
        
        PID:7560
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        211⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        212⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7700
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        214⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        215⤵
        Drops file in System32 directory
        
        PID:7792
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7836
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        217⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        218⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        219⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        220⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        221⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        222⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8140
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        224⤵
        Modifies registry class
        
        PID:8176
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        225⤵
        Modifies registry class
        
        PID:7212
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        226⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        227⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        228⤵
        Drops file in System32 directory
        
        PID:7456
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        229⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        230⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        231⤵
        Drops file in System32 directory
        
        PID:7712
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7780
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        233⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7920
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        235⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8048
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        237⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6204
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        239⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        240⤵
        Modifies registry class
        
        PID:7588
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        241⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        242⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        243⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        244⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        245⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        246⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        247⤵
        Drops file in System32 directory
        
        PID:8116
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        248⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        249⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        250⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        251⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        252⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        253⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        254⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        255⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        256⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        257⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        258⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        259⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        260⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        261⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        262⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        263⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        264⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        265⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        266⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        267⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        268⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        269⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        270⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        271⤵
        Drops file in System32 directory
        
        PID:8472
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        272⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        273⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        274⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        275⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        276⤵
        Drops file in System32 directory
        
        PID:8684
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        277⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        278⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        279⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        280⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        281⤵
        Drops file in System32 directory
        
        PID:8916
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        282⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        283⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        284⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9096
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        286⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        287⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        288⤵
        Modifies registry class
        
        PID:8200
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        289⤵
        Drops file in System32 directory
        
        PID:8268
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        290⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        291⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        292⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        293⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        294⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        295⤵
        Drops file in System32 directory
        
        PID:8668
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        296⤵
        Modifies registry class
        
        PID:4048
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        297⤵
        Modifies registry class
        
        PID:2580
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        298⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8812
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        300⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8940
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        302⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        303⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        304⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        305⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        306⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        307⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        308⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        309⤵
        Modifies registry class
        
        PID:8712
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        310⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        311⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        312⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        313⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        314⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        315⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        316⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        317⤵
        Drops file in System32 directory
        
        PID:8860
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        318⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        319⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8228
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        320⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        321⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        322⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        323⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        324⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        325⤵
        Modifies registry class
        
        PID:8412
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        326⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        327⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        328⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        329⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9368
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        331⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        332⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9512
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        334⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        335⤵
        Modifies registry class
        
        PID:9612
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        336⤵
        Modifies registry class
        
        PID:9660
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        337⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        338⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        339⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        340⤵
        Drops file in System32 directory
        
        PID:9840
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        341⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        342⤵
        Drops file in System32 directory
        
        PID:9932
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        343⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        344⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        345⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        346⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        347⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        348⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        349⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        350⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        351⤵
        Drops file in System32 directory
        
        PID:9336
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        352⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        353⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        354⤵
        Drops file in System32 directory
        
        PID:9524
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        355⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        356⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        357⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        358⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9792
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        359⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        360⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10000
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        362⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        363⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        364⤵
        Modifies registry class
        
        PID:10200
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        365⤵
        Modifies registry class
        
        PID:9176
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        366⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        367⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        368⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        369⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        370⤵
        Modifies registry class
        
        PID:9740
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        371⤵
        Modifies registry class
        
        PID:9880
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        372⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        373⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        374⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        375⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9548
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        377⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        378⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        379⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        380⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        381⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        382⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        383⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9904
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9312
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        385⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10088
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        387⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        388⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3584
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        389⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        390⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        391⤵
        Modifies registry class
        
        PID:10288
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        392⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10332
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        393⤵
        Drops file in System32 directory
        
        PID:10384
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        394⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        395⤵
        Modifies registry class
        
        PID:10480
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        396⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10524
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        397⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        398⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10616
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        399⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        400⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        401⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10780
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        403⤵
        Drops file in System32 directory
        
        PID:10820
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10860
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        405⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        406⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        407⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        408⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        409⤵
        Modifies registry class
        
        PID:11080
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        410⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        411⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        412⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        413⤵
        Drops file in System32 directory
        
        PID:11260
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        414⤵
        Modifies registry class
        
        PID:10276
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        415⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10368
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        416⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        417⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        418⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        419⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10596
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        421⤵
        Modifies registry class
        
        PID:10680
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        422⤵
        Modifies registry class
        
        PID:10724
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        423⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        424⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        425⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        426⤵
        Modifies registry class
        
        PID:11024
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        427⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        428⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11156
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        429⤵
        Modifies registry class
        
        PID:11228
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        430⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        431⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10400
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        432⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5316
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        433⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        434⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        435⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        436⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        437⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        438⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11052
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        439⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        440⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        441⤵
        Modifies registry class
        
        PID:10424
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        442⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        443⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        444⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10916
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11136
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        447⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        448⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10552
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        449⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        450⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11020
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        451⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        452⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        453⤵
        Modifies registry class
        
        PID:11032
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        454⤵
        Drops file in System32 directory
        
        PID:10608
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        455⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        456⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        457⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10920
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        458⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        459⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        460⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11372
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        461⤵
        Drops file in System32 directory
        
        PID:11416
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        462⤵
        
        PID:11456
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        463⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11504
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        464⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        465⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11588
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        466⤵
        Drops file in System32 directory
        
        PID:11632
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        467⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        468⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        469⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        470⤵
        Drops file in System32 directory
        
        PID:11804
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        471⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        472⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11932
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        474⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        475⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        476⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12064 -s 212
        477⤵
        Program crash
        
        PID:12156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 12064 -ip 12064
1⤵
PID:12128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aadifclh.exe

Filesize
64KB

MD5
d119519d17a1a22fdcfbe406bc0e6ca3

SHA1
8e40cf2b2ce9512f79339d1599b43cbaae936a96

SHA256
b6cf52d24989e4cc189f5d8ae0f968adc2fa6b2c2aad9a00d3e81382a8d54e4b

SHA512
8f0529067953e1d574c676b7d69f254f5638676d138c90574d860b154d9acbf8844e43d87581969f4a1a99f4236b28084dbbd1158b5ec7d7258296e97fb1eeaf

Download Submit
C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
64KB

MD5
a13d20acb6fb9fdff3883fdc91748b6c

SHA1
f53d2ca38427a1deeaf01e8cc2d5c9704d936a6b

SHA256
9accaca7ee13bf03a1c4a6fe297d332d21cb3c3dd8d28429bf8503921846d65e

SHA512
4b8362acfa51cda2afd4d7df72140ca055898917cb9cd2b93802d1e09a6ef1abde220a9d1fd9d5ea7eb15ab4958e4a606c76acf54ca9cac1bf42481ca24590b4

Download Submit
C:\Windows\SysWOW64\Alhhhcal.exe

Filesize
64KB

MD5
344726892b934ec6b7bb5df0a082911b

SHA1
797ad38c063961f42f7560ad18aa630f738e97d1

SHA256
70afa2327d2d8cfe0fba6cc1d98e1c4136ed45d1fc18c989b2fa08d825d8e65a

SHA512
f6cd00f02b8196f2ff257380395036f7f900465c1bc28d62b1321b1a940d78c417d36a29da2cf388a51cad2f525216e157f2079d02d3a64adc0f85db30ce8c4a

Download Submit
C:\Windows\SysWOW64\Anmjcieo.exe

Filesize
64KB

MD5
bc81763b7bab02e4dfad229c21aca267

SHA1
39f75505108c3dd3b4eaf2a562c8989c9d98b4c4

SHA256
1f668a2fc81633667127d994406012ecd1cc90fe851d07906f6560d29eb066d8

SHA512
7250eba566820fc3db917b6cbedc1a5bb78a528d9c9c3882bdb3f5a8b621a00c32877b61e03d60cfcfb0aac01086ab9358849811ce990d8d2376a10b3b200a4d

Download Submit
C:\Windows\SysWOW64\Baicac32.exe

Filesize
64KB

MD5
896a67ed4f4d09f82936eb13f828346d

SHA1
650818777b9f1b15209cf5c8e2f12f912f6c1b78

SHA256
b7d7e21d6f7de7c7d512221f297f1e6c99770094657875f4e39f0c9b2e2f38cc

SHA512
3b19795b7736d82ed6d15c9674b570ab8b870f5adb34087529f1dbf255e2407d30d371857bf9cc52f516abfd691ab2b3eb563fed66fc2488583ae010dbc975c6

Download Submit
C:\Windows\SysWOW64\Bdfibe32.exe

Filesize
64KB

MD5
8bea2b09406ed4a72d59ec900ca39e67

SHA1
c17d98f361aa2d7f4d0737fdab8c6e551e357d20

SHA256
dc07ebfe25ed41ea7abfb37bd8a47c59f858d6222b90d105f2a0d1b50f9eab5d

SHA512
b9012f014045b59d34f7a590da097deb122171b44ebe4bb0855fb61a7f84eff15ed3bb84b292de4487054110642d1941d464294791af0dbd7bbe35430ab5ddf7

Download Submit
C:\Windows\SysWOW64\Belebq32.exe

Filesize
64KB

MD5
00f618ccc059b3eb9813fd808d96d4dc

SHA1
9707ac9467fc743ac3df1b53a5f2819e24718923

SHA256
8d83c773d95dd2d221adae80109792ee2f9f1d9ea9be3ce196c4e7ca926dfd00

SHA512
f4e4fc5f02a7e0c03070d5486602306d69c6b3bab68e30ac30dd5565bd7091cfcb91ce1052c6e32d28380800f96e23729b92026a18a308a06777bd2152b16be1

Download Submit
C:\Windows\SysWOW64\Bldgdago.exe

Filesize
64KB

MD5
4cf8112556bc85145361cbbca269525f

SHA1
ddedb468566684be28cd60d58e64e607299fc6e6

SHA256
6847872eceb2a53154811b6c383bf76360776fbec710c8dde576b346a9dc63c5

SHA512
89edbb69b90c9d73d1f5a2b7361d60dbee18c298525ceb8469fbe65a2e9d67e8c5b515b9f7363786b76026a60a8ed4fd0995b9b1c2a197f970ee36ae074b5dda

Download Submit
C:\Windows\SysWOW64\Bmpcfdmg.exe

Filesize
64KB

MD5
9e21a70b6c2df18098b642df98d305c7

SHA1
143010b00f9e4044618375e8742e7109466e0e2f

SHA256
ff0a2564ee0d2c8f06e060b6311bf578c98eeeaba7e3a40e640e0e8bc5d96f0e

SHA512
58102336567dbca92582212fbe6a9b09a743e94663134ce34a248bca77687d8f84d1099a5f04ed89ff03a1c5d2ffefceaf20cd3014bef8e47208c6011bc09985

Download Submit
C:\Windows\SysWOW64\Bnpppgdj.exe

Filesize
64KB

MD5
917fcb1aa5b1023d55628db42dafc7a3

SHA1
bb9679ea9d8114586878efe19079e640cd4074ee

SHA256
0319c3accf4343735ea6bb52f8680332d2661c6f1883059f190c7aecf8f7ba9e

SHA512
af7d4c109a37a03a4d4770ee02368de56bc7e8f1a2308d03b8ac10e25fb22d99056dd75f9ef904047b0a5288bb6d8454e1038178b2c024755b4e2bbe5733772c

Download Submit
C:\Windows\SysWOW64\Cabfga32.exe

Filesize
64KB

MD5
7ea668e07c1e1de52b2d36fa37108c21

SHA1
cf9e16b23f79004f813d7b68e50536a6abdeadac

SHA256
225073cdc3d43b72a701070c18a80b7fc5148e900b7b67aeb9144272094e2619

SHA512
e8f5c9dce8731e3575f6040a926502f54330c9c4d8e3e92046f65fc3474ac3ea71f80ff6e0acce6b79b17ad705aa647f2f073bdc0fb03fabf1681635b9e4629d

Download Submit
C:\Windows\SysWOW64\Cdiooblp.exe

Filesize
64KB

MD5
aca269dc5a546b90f3a996d834959a29

SHA1
8e51fc44f1d9d931e95f903d4089ceccd8d1d6dd

SHA256
faba89241e382089c5228b4e5cf57ed97277054009b7ddad4f38f3e19988ded3

SHA512
ac50c54e4034702033b2119675d9eef5eb28918b863aa95d38deca604536ceac0e475f6ba16c3b0d890ca77a91acd7353ab93ef90e1f896987caedc03269588b

Download Submit
C:\Windows\SysWOW64\Ceehho32.exe

Filesize
64KB

MD5
08991022681a1b4c9f6ca08e74ccce74

SHA1
a778bcea0a34f6148b436edbfd8af8682b2bbf7c

SHA256
941c801e1fc86b49aff62a181e6b0e5541a37c654dc67c99a66af8970b434d9b

SHA512
37db6bc2ef0c8aa7a4a20266e7c022eca9c24ee45f1c3b1ab054bbd37bd01632d9676c489de67976b2f52fa7e3dbfc33057156d222ba21a9019d05cb3902c9c1

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
64KB

MD5
92e21ad6009737da15761d316cc091b7

SHA1
2a1b2c7e765ea2fdbfa18287f32f7e7957a84952

SHA256
8618e2e636fffe5ba91d029898ac36141b84f78597b765ffcd771f6539ddaac3

SHA512
ab154c805d364515c48537308fd2f8422075cf40ecfe3089d4a7711eceac4e9b77bb3aae044f9204483087096059f81252d6e4eb77544dbc87c2b8a407fdb3a8

Download Submit
C:\Windows\SysWOW64\Ckcgkldl.exe

Filesize
64KB

MD5
8fd2f2dc889b16ad8547e04449802ac4

SHA1
8d9149be552048624f4cb7d996e7757558b93bad

SHA256
85066071003686932f5a01f94299b424d4b3af8d6991374507a4c8065ad236c0

SHA512
41c0010a1738908626cf73cec12c399edc07fd2b24002b7b3a7e37239ab6f6687e28a36a6ab518dc609c6e0b7076164f7f5966ece4fac8e5adea71f2f9b4967e

Download Submit
C:\Windows\SysWOW64\Cmlcbbcj.exe

Filesize
64KB

MD5
ad3a8595c2d8546ae39f22c4b2b997a1

SHA1
ffa91fd0c92461e4ba43f85cdb634fd5440c4e38

SHA256
c238ce94c2ec8afcf7e74b6422a986c0216d27035df6430ec66e9c90243f8524

SHA512
aaa6493b4639473607209c9ba95c64e6580eaf54a9c27aa669f51f35693dbaa6ff5b2ac5a0baac8af7fe8877077e35661a24571e6c13977a2e884541b655c724

Download Submit
C:\Windows\SysWOW64\Ddmaok32.exe

Filesize
64KB

MD5
6b20501268963ebfb45de18399df561e

SHA1
cb3903f6f132607c1fced23a836f9ac5e8d4e8de

SHA256
8f3e2e4479b097cc6bed5d41c46c5c508fcde2892f984123948a4b8ff0163aa5

SHA512
e5d56b4767608ab71cb231ca0b25e4ba77a656ad0ecaaebcd74cc0ed77f791267bd918bd2d39d838467bab5af13ae0881a7e93ad10976d83c3aca58e7596173b

Download Submit
C:\Windows\SysWOW64\Ddpeoafg.exe

Filesize
64KB

MD5
2cb66e75948c24e38e34aa08dd97a6c3

SHA1
f9e1f849dc9a1f3405a340dbcd7f0bdd2e3848d4

SHA256
acde421d8f021d19e24f129ceafa57a7dc0cdf67759b59f0bb31fda992454cfd

SHA512
98bfd989777df89b553100be1d4bc763da527d249ec9b5aa4a1dac64dc4b0a040370f19feac29926875c7a76405031a44dfe3153f6165b228c587cf5f77302fb

Download Submit
C:\Windows\SysWOW64\Deagdn32.exe

Filesize
64KB

MD5
1b5caa8505c2bd53cc69f45db5923b2d

SHA1
ee24847fbec0345c79b151b81ea75328146bde78

SHA256
ce45760fd14be3266a9c69973731ceb35e1749f48671e7e90fa341f5d1858844

SHA512
413f17b0ed811799f03032aa17e7a333e8692fb821e5078944d1a39171d15c19d5b0d5a7b1d46e445d5f28d70438d7e7d9193b02d9a65651d0f6427a5d5882b7

Download Submit
C:\Windows\SysWOW64\Delnin32.exe

Filesize
64KB

MD5
63b24504e70a142ea8c1649fea5b248a

SHA1
0b6be2c68765f44bfe63b043201cfb1db90de034

SHA256
433e94df30702b9cfee202eb6a932c83f30de8a12fd43a1af05761f9abea22ab

SHA512
82bdc9dd2eff8f5024662cd4003762b23368ca56495e3fd9910db21986e5bfced7898b684451952b08f54bd21b1634281af4b62d7c199f778d042cfb53466e2a

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
64KB

MD5
ff84faaac9ceb8b3f06c9ccefcfdb8aa

SHA1
6245c1474c5d1670d7bbc8b3aeba59f84b3246ed

SHA256
7f03f0827f91f7d9ea62e046613c30f9d8b10b2f5f8e2542846113a5f624816c

SHA512
dd7faee741b020b2965a8991505ebad248628305b85ff0a7e5045a6e42ad63cdc9e6f555bfd9ccd82683ad1ef03781332dbca299c900bfaba17874d3fa62e1d6

Download Submit
C:\Windows\SysWOW64\Dhidjpqc.exe

Filesize
64KB

MD5
bffe71750bf19f087c912cdbd39b1129

SHA1
dd3390980d90a35ebd7c52fb2752d74ab444ba52

SHA256
3a7aa8b0cb41106e473722884b336337321f76d6e5a1b750808a7ed49e12b575

SHA512
d4a3fbb8c4521f40951e37b1e1d261a27bda75c2d1a51efcec05dc4734ae0df7490d0b6bf91bfb6a963db0f8acac8a91d14587a5b7fde5935adb5a829ac276d2

Download Submit
C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
64KB

MD5
8af1b6144297543bca04126d55e1313d

SHA1
f874c8465d3dd713024dc8df164cbc9a83fe1ff6

SHA256
b56fcbad08a79bd9443a8a36001382a69e2b5cb5fae8343327c71974d7fe8637

SHA512
12186fb882ddde7ac2a2c497087ef2a526143d03f6ba9f346383dd48e1c094529d21b7491010b4e4d60dd89408ec7fdea007bdbc6eac242f22bc24c9e0a14f54

Download Submit
C:\Windows\SysWOW64\Eabbjc32.exe

Filesize
64KB

MD5
60789d05b0ee8d8edffdec0b427189b3

SHA1
43f6e2c774bd7340d192f4ab211fe7c43273d702

SHA256
ddac9b050821fec4038ea6b93db9768fccddc53f2214f6748b04742c14a9a79c

SHA512
aa3be78fd49d2fff1496ee98e6f325f95b795ac09f1644b96f23639267017049042568d768252648c09a1bd11a28e103695df83c6f103e0a81381a239ff3b087

Download Submit
C:\Windows\SysWOW64\Edihepnm.exe

Filesize
64KB

MD5
ee1f6daa5d746c36e9840105b6058b72

SHA1
0e66fdc06e4b478bc31b5e53c63766a833cd45d7

SHA256
e42e64d6f5c0a1d28b8f6981d8927ef3d63b6461fd305c2e87b02c97f763238b

SHA512
0a7f300fccf2d5f8b975879dcc668b03c90ac5097d0dc84929f692a45283a802ec4c60d2eca9469743992b76f2edcac5245c4e14cc0e0e9e21c3f26b14f65ffa

Download Submit
C:\Windows\SysWOW64\Ednaqo32.exe

Filesize
64KB

MD5
360f9d802665c312c36b76908df1fcf1

SHA1
6bede42d30a2479b9e0926bc554a3b1747493f65

SHA256
0d2bb3f18e01e8a498ba2aace9f0f55cfff2d6832c9cc0d37f9ccdad0e3bd703

SHA512
1ec42f4b4f4f86235ccb7fa6fc79759c760ac5e800e0689942a375291d5cb654c9c8eb78b542a0ba8a83f7af0e93c97dc3166cede4a23f12d731850f41e155fd

Download Submit
C:\Windows\SysWOW64\Ehljfnpn.exe

Filesize
64KB

MD5
319bd3e0912e960ff1cbc98e00ce3def

SHA1
64c8d0ba5ccbec36fa1922c1b34e407fa12fe81b

SHA256
6568d97cd2ece0a7c764d153786b6f0a7886ff4afebb672b2c0a8e588df48575

SHA512
4e658668f93011446febcf07a1ae861d4d35ca02bf696194b2666a346d1d3fe14ae09a51296f536ecf80157472998eef3f4b3e37e6088ba36494961ad4174b92

Download Submit
C:\Windows\SysWOW64\Fllpbldb.exe

Filesize
64KB

MD5
3f914f84d3b511493e7c56fbad0da551

SHA1
7c0162a26dca7d1ae7a9e2b3d435d640cef29cb9

SHA256
e953c3094f746be970f40f134eaa1dbd0d1b87639543963641025f0bc241adcb

SHA512
caf991f6504acb001ad701d9b0bd6feb99df296e40e2b63a666bbfebfdd9a74235ca3864fb3292ad262f185678e3bd466eeadc3f19a74157d48254f680604e9d

Download Submit
C:\Windows\SysWOW64\Fohoigfh.exe

Filesize
64KB

MD5
24a590983160c142620dbdf21af3a04b

SHA1
5e7f2245db8c1c927642afcfbffeec2ed492d5ea

SHA256
2340d6a91eef3d4769638afe4ddc5949eb9a66d645f923ad5db35ceced73db67

SHA512
bdc9a21e93d74648ff34e3cbae537b3408831603f5c69ab746059526990b02487869701c430b055315531b7e0510a3eb20aedac9063213580cd8de3a04c7a630

Download Submit
C:\Windows\SysWOW64\Fooeif32.exe

Filesize
64KB

MD5
734a407510577405a956b8d73670c51c

SHA1
582693b0857c4fad4c297d423286933bb01cbde6

SHA256
e32bab42af0c9fa7f3477a9d146ee80ef603323b6fc3d7c433226969df146580

SHA512
bee6545b04dd60f496d9c06b17304bf8a226bef591b048e916961e7d87e684ffbc53e14d65a9c177c4d2c120d5084301022a153af36c8132d397db1a4d0ce663

Download Submit
C:\Windows\SysWOW64\Gbgdlq32.exe

Filesize
64KB

MD5
cb07f7616e62846fe8396640af54b789

SHA1
2e2ec5068d2c78dd0e3396e354b5f637bd418d92

SHA256
c76c64efe6d744c0f02f525d598542937e1234fd4aa7f6b1e9f77b5237f7f109

SHA512
8c5eab988741984459f1cba36d85bbbb6ae1a212f63e8129687117d401f0c3e12441a33932489f50c705a323e1deb0d7a0ca40a5ef7aac9fee3e81a99990956a

Download Submit
C:\Windows\SysWOW64\Hkikkeeo.exe

Filesize
64KB

MD5
9b761412f37ac53bf4db7be10bce8e3e

SHA1
4872c53cb1e263e5fa8851e66b91433f9f639b43

SHA256
5c7cf0e891707a02b20d045d5ab179e739d03395c66ae19a771e0594aeb408a5

SHA512
fa14f11e1fcb658c82096b502366eccebcf255ff243fc25bdaa5be6eadef891f98001a7f1c9bf404d7ba92101847d3777c16d5420748c81d750a7179c8cc1045

Download Submit
C:\Windows\SysWOW64\Imakkfdg.exe

Filesize
64KB

MD5
f1021cf404950791132cb7200d2c670c

SHA1
93eb3c58ab05dd015d5b5880acaa3f9c00eb32ce

SHA256
765ae2b7b6369f7de468f5dd13ee70a8b565a198671885b10ebd42ca30126e02

SHA512
4c3182e4f32beb303befb56486480e6008058884bd496ee2db25de25a9a88db4174f9c37a38bf20d484fb11f28d2caa0885d0b0bc2240037fa4da1b86b91d4df

Download Submit
C:\Windows\SysWOW64\Imihfl32.exe

Filesize
64KB

MD5
ed85646eab9193f1e77273d2706fe4eb

SHA1
2386686dfd10e0ebc53d345eef077c52d2ba4fc2

SHA256
0c88a63a4288a443ec2dd4763220375418b431ebf3ce7c85e558bfc11cd15147

SHA512
033c77fb420045cf6bca29c1a8965f104bbdbb4035aa4e82f1cf262cc3ca4743b0b35018f9c3cb518e468a90b2b6db323290b53a4eb6152fd41e1a427f9a1892

Download Submit
C:\Windows\SysWOW64\Ipbdmaah.exe

Filesize
64KB

MD5
14449bddfa9c3d72610155577d8a46a5

SHA1
23c0627cd82ff10349b22671ca839761ceafa76d

SHA256
a7fa7c1124711ed42ef9e0abaa100b063e29a274208f5fe9b27c3fc76c9aa4ed

SHA512
01dd76a9b8339dc7c84d9d94e8bda9f8588e8ec804edbdf7e2dc90913894769b91dd2c89ab988f3284aea2477f367864159120ebf9cd5e8e125a452393557169

Download Submit
C:\Windows\SysWOW64\Jaimbj32.exe

Filesize
64KB

MD5
4236ef1034c4b91453bf15bbbda99aa2

SHA1
a77f55ca1df410ecc5107eca270c847319e926b6

SHA256
6ccc3c465eac91b10e151e84ad0b7ef758fee5c3378f75ae2e0045bca82fdd8a

SHA512
27d9d8035bb4ea8e31e2197a029518820c73ab14d809acfa82d7a2f5ab8e18c0094f878850d33d06738259918c45c9f80a2a8f957385895a469c492d607adc56

Download Submit
C:\Windows\SysWOW64\Jangmibi.exe

Filesize
64KB

MD5
cabaf24cfd89e7df7b09d4f716c77bf6

SHA1
b2a4a1c806ff91d41697587ca4ca6a3eebdbe673

SHA256
e183f3500f439ead96c707591c89fb962ad3524e78e5cd6b453c494e4c9d07b4

SHA512
d8e991c793a6fdc4efd0d569de80838086d4b995ba839f34cdda02754aba67d6efd5b0e2169657d459b72f49c3ab2fa035742743938020f2c119530bd6b702d9

Download Submit
C:\Windows\SysWOW64\Jbkjjblm.exe

Filesize
64KB

MD5
148d4c1bc8422d45b2aac7ec97c51752

SHA1
942dae4c24b718033827da1caef140c822d9c7c8

SHA256
d66af7f3e2d8cf88845196089773ce0b3c10481e4426f613371538e25ff768fd

SHA512
4e85f2ffade91bc7c69a0a534982793e751271bc239dd1e3347f507d9bb887f02514e523c3ab585992f52496b9e4fa1fc8cdf3c4c3c730f540ce5116ecc30fb1

Download Submit
C:\Windows\SysWOW64\Jbocea32.exe

Filesize
64KB

MD5
31cd125c40587f1f51401a5c2ac5d4ef

SHA1
f5e618a7e741b84333ed6c04dd7ebd42eb60b308

SHA256
fe3d2f1fdf75c101a87a2ba37def36e5d1ddc7ff052cb3846dac7a4fceffd001

SHA512
32a00c0f20cf125f4690d711f7a33fc96e8d71cc64a3cfbeb626e356feaf1973edabf87d26cfa920a6034e6d52e64e5765a76ae7de05b6dec33b6936ba588d75

Download Submit
C:\Windows\SysWOW64\Jdcpcf32.exe

Filesize
64KB

MD5
3d3e4eff37362b63fefcaef102d52842

SHA1
136363729f19ef4b9d5d4e835f701a7d50de184e

SHA256
54df7a8551e6509ea1a7c83953187a22a804068c8b1849cf909696f3ce919c04

SHA512
5ef1a6165eea7363e579642d579f9a41dbc34c445fd792b85f78917f8b4c6255171593659f33ff022f66d9b9f89d8fc3baab00886158def16aae1e7c0c37a84d

Download Submit
C:\Windows\SysWOW64\Jdjfcecp.exe

Filesize
64KB

MD5
8ef4f1cd57e69f24df1f4c9439d2f75c

SHA1
3d3d65113ca1c2f0ec919a1772cc1f4fbbd9b9a8

SHA256
828fc016d57d42499331c69d1bc1939caa133e92681491f093c8904e20c04bf5

SHA512
5138eda7da8d9219c1c8691b75c5df875013ce5ad2ec400078876dbe503957e04b118ea585c0b2bbc564750ad0f75445dff9fd5a5f884936796f690ca2dfe02d

Download Submit
C:\Windows\SysWOW64\Jeaikh32.exe

Filesize
64KB

MD5
9a206d2775b94cfc8cc13746b578932e

SHA1
5dba3f236f93b730b9899cc728fb4eaaebfc1208

SHA256
1b01c83ed58e705f254743b7397503adde9c084afe1d9589be97f423dac30245

SHA512
ae59a8823764c07b7463f19df5d51f8a8765bc109a416b6d3dc77e394ae47fd8abe6071382e32cc60251ddc641d959d94488ac7eca467f4ef2b09f08bbe0ff85

Download Submit
C:\Windows\SysWOW64\Jfdida32.exe

Filesize
64KB

MD5
63261231962b4117d256ba1bbce215a6

SHA1
b5972e236d30bddd12385985814943fac1679e64

SHA256
78921b5c146b341e9ebb108001f5328c89baa7813cd4442a2ae99d6f20767b92

SHA512
210309e7fb47f1eff67669bd741ade9f11bc52eec63e1bc0e91801f67c55d4c352e18e52c9c818f0539e73a63835a1302533b5b13525811006667bf6a8c96bd3

Download Submit
C:\Windows\SysWOW64\Jfffjqdf.exe

Filesize
64KB

MD5
b407636e0507b811a063fd9993521d4d

SHA1
24e28c9bb0f233bc917e1bdf1739c28ed46705d8

SHA256
43373decdfde88947fc52db71dbc36474fecfcb8ff8fa54614699a13994d13d7

SHA512
88ecbb419d99c39e9bd7a713e3e584bece76ad150f27847253b389d75bbd4dd1b9d6f099760d7cb6b968e851e7e98e999bee9ebbeeade2d57efd39f66f2e0d7f

Download Submit
C:\Windows\SysWOW64\Jibeql32.exe

Filesize
64KB

MD5
926edc1612b3ae7f55d1ab9ed4c03ea6

SHA1
90a8ee8e6be3d105ae49528fd7f8e00996efccda

SHA256
f1521e1c9d01ee27a2c920c47c5ee82271876e26c7989691d74fa21ce62e94e5

SHA512
34347da1aac2e36dd8615e3c86b76ed2ed42b05a58b129e4382721b6bf52dfc048317a655c616145f8244d9c7f0be73b41a30735fa314c6f7809e61585f5437d

Download Submit
C:\Windows\SysWOW64\Jigollag.exe

Filesize
64KB

MD5
b2200f4ebd69c6e15299681408dcdbff

SHA1
e7257408f0bfe228d7469d8a8c75b674acf29b95

SHA256
ac107896bdc13e78dd51034c71e30ce65b591cf860b7d566f948360fef1f5246

SHA512
3ba8d03c16340752f206f74f059cf4a7be65202ba9dc53ee84b7576d7e9c330e9c1012ab8b048b1c92c6c235908e85d4cd5a1c07278d61fac58d2bed10e82e85

Download Submit
C:\Windows\SysWOW64\Jjmhppqd.exe

Filesize
64KB

MD5
ecb739f74d08b7d8373dad66b2b1e562

SHA1
d7ed033fe1130d933fc327320a2d5623e773e18a

SHA256
a3185347c400ab9d78615f89453114cce425d31f41e0daf9d3cd4bfe4846e4e2

SHA512
5be853b911d9070a86542bea5547120691d6ab8651fee905a38d4215a6be329c04d289c0277fe8f7fdb7bd1492fda268c14d1bb8f5fb74e49b8814a559440868

Download Submit
C:\Windows\SysWOW64\Jmpngk32.exe

Filesize
64KB

MD5
bc4bd5daa97f7ebed59ccdaf494aa345

SHA1
34acadc70bdbe51d31078c4e9276899c723d77c1

SHA256
22bdda57e07cdfc3eb07ca652d760c6f3160e8d228675a7ea9afb916dfc3ce14

SHA512
1655328f52d576b2e7fb0e707e3d6bb1dab1a7801fd36ded4a60288322daa06c9ff1614421b76d4c6dcf7da6ef37ab8fc1125f8b9d65e1c08739e4d0075a119e

Download Submit
C:\Windows\SysWOW64\Jpjqhgol.exe

Filesize
64KB

MD5
0c7ff0ed54f04852b1627d106db99100

SHA1
bd4e94ae6aa21e9994b717eba5c9968698136ffb

SHA256
83e7c175462e1cbfdaf04b86654bbfe91ac25be92d69b134d3ceabcf3cac2ded

SHA512
32da773604a8952e74c3bcecfa7596158f9252044a1603541a6c506bf7f0a64d04ffb988494fd7ca74de2f92663fb68808eecb9642259486c30fee1a2d6386eb

Download Submit
C:\Windows\SysWOW64\Jpojcf32.exe

Filesize
64KB

MD5
661f7d598c0ded4b808753cb4fbc3618

SHA1
1bfb2cb4c2d16c11a209dd3ca4cdbccf232c5d4e

SHA256
6cca952761bdc2f1b751e9246cfed89be9fd40b807e065b36092687a520b9cdb

SHA512
50509ecfae8faf8a5d029bec141743f56115f03958f76edca17d43e61698933ee636fc81e6fc53b27af77253b4d039c06f6aa55d01075f69464a40ad61a26a1d

Download Submit
C:\Windows\SysWOW64\Kaemnhla.exe

Filesize
64KB

MD5
f199e9c55770e73801b085562fee8aac

SHA1
067575f151c5c8c867fe58be5b48153f344be647

SHA256
f54f951567b449e17688760129be0c829bef0c7b17bbdd6e057ea9d62e571968

SHA512
6b7733440c28fc3e21a13c7415355dd9f1bdf83b527532b861038f9894bd6cfcd6361a28b043e44162ab25385d78658afda50896f5199cf3390692f2f6d69ff6

Download Submit
C:\Windows\SysWOW64\Kajfig32.exe

Filesize
64KB

MD5
07a7437709c66f000d9d0e0b376e76f4

SHA1
edfe7d46ebc7cc97b7c1d4736d799345527815be

SHA256
84d65606e9689f794bf02d6b04f671695937ecaedaae691dd6737a5b3be630a0

SHA512
4be04773e92ee8f73ea899454b9da918c1e21f6836ebac9a91d5bdcf405143ab4d8373ec309b92ff82ef411277572bd0e22de33b0fac7c7e4905cd51925930f7

Download Submit
C:\Windows\SysWOW64\Kaqcbi32.exe

Filesize
64KB

MD5
c76c55e55c1dbecaa58c26e9441aee73

SHA1
664871e4942562ac21f987fdfd54c916c8265fc7

SHA256
9bb0abe1f8ad0653c1fbb156df642df1897e458c847e8d14beb466e86a7ad8e1

SHA512
a38fcd9103e95dd696f2ed64307ce94203187de680daef455804807af45a67141a1d4ebce318bd6f4bf4119c5e01c97f4c2eaf0385e5c25cbdbf8166e96e1305

Download Submit
C:\Windows\SysWOW64\Kbfiep32.exe

Filesize
64KB

MD5
e02b10a63d77ea69dbdecc9ec142285a

SHA1
df108419b8894043d7ab521c79e1534b5316c591

SHA256
f52e27d875dab5419af30277e9b430e51ad3a2f4a367d9a0ba5c1544d8c6f3e7

SHA512
6915488d64843c5050c25804004453d860bcd7cf69d369fa005be368e75fe22c8e0dc64f03c13ee768886b677a45f6d1d1e4dbdccf6a1d6e823b4deb4fb0cb37

Download Submit
C:\Windows\SysWOW64\Kcifkp32.exe

Filesize
64KB

MD5
02dcbf0ac010287da1f9e9d605e0f986

SHA1
16e03cc03da3ca738e0e9ebdd15cb1af566de2b3

SHA256
877991ec3f0b9b0c413b5719c2a5fd225c7c45bee343e1d8d5e5ad82c1feeb2d

SHA512
f9837f21a2ef69c575226cd8b429f25b280fb04ac268add58020d19d41161450b129837d050af809f50f469ac688740ec625e93ea40f45132836934d3a3c8825

Download Submit
C:\Windows\SysWOW64\Kdnidn32.exe

Filesize
64KB

MD5
ddfb12b28ecf5f924e94fd25588118a7

SHA1
ac8d54dcc0a96e77269c98517d5dc59cfa2871fa

SHA256
2aca9cacf2e24ccf3518264c04a04444667aaac8fecaed17b8884226bafbe2dd

SHA512
95746ec87dc7fd8745694a95e938f4d99b6f89d1ccc89900735828d975c118775a07eb7754d88266ec57db02ccd4175ab4882e0f1e208423fb5c80d3fff55c7f

Download Submit
C:\Windows\SysWOW64\Kdopod32.exe

Filesize
64KB

MD5
d2c47e891dfdb310ac38662ab46e30f6

SHA1
d4eaa98f7c12c2c3bc9ca4faf6243ba13f1e16cb

SHA256
c59c3f0c5bd6ab52e3da85c5abd7d60289909f028107bea46d806707134d5332

SHA512
31df9f266b507207a8f84bf01b7e417d5a4a26340f137ca14f55b78f9595072ed40374b279e447145c21dd9243df8c35d29114fee4c63307196dda506ec887b7

Download Submit
C:\Windows\SysWOW64\Kefkme32.exe

Filesize
64KB

MD5
060581ec8a298d7a2854214994cb235e

SHA1
b47d0fb35913725bcee1e8ced5cca856111ea7af

SHA256
4526705cd4dfdd3ec4ffdc9ea3d52583824819997ac096f46111718a9ce5636f

SHA512
5a65b8ad83a4badaa3ef7a688a4c590137722be2794b1ebd6ae734af72defa1b2f9066102993c710b9bfcc7b20b7764c5a4e20044f76809c48e1d1e40ad15c5f

Download Submit
C:\Windows\SysWOW64\Kgfoan32.exe

Filesize
64KB

MD5
ae81486f971b7a6d5d502018e2cb3d04

SHA1
32a7c90c6d980dced141aeca55e4b6d246f851bc

SHA256
e08adc38c46e3cd76cfe912fcd9577599f6129f725706fef1458912513d30df6

SHA512
e57c2208fc75c822c14da0cdf59e985a98cd85a7366114b8e15f0c25ba137fb4a83c450eb7848be1b393f576fd63a206669a870431a1b1a0ad07974d3bfe8655

Download Submit
C:\Windows\SysWOW64\Kgphpo32.exe

Filesize
64KB

MD5
95a181b8e09c57251a785ec8a40201cb

SHA1
ca25b8044874052a441936ceec25e63fb424e3d6

SHA256
75af1c4e2b54c9ad28e7daab4859cf24ab19d37f49f9e597242056eb4a39b634

SHA512
91d8eb4eb6ee8636e6cdba048acdec239963ca1f39c4b623cd4fe2d57d6765702182a6e564d839fc28507b9e95fc533ac9987c79298301a10a505f276df5456d

Download Submit
C:\Windows\SysWOW64\Kinemkko.exe

Filesize
64KB

MD5
8b00ee62e1a7a99159982e7c30025e0a

SHA1
7e61eb26e4a3a8c7e0e4813dd01a7c2f36648c68

SHA256
f9655591048f434152d119f61c46af0d4989fb33d9e04fb2e68da7139a3a105a

SHA512
4e0894bbe639bcffc6d520e8e805e77ea12d18e0fb4013286bd387389cc72feb2737233ec8171abb12d1459a0919f230224376d6cf6843614968db07dac34f5c

Download Submit
C:\Windows\SysWOW64\Kipabjil.exe

Filesize
64KB

MD5
4d8fde747c51180a51e40b4eac06264b

SHA1
1a4392ff43f140493c33ff8acfd9bc708a10373d

SHA256
b34cb765a171c09b4c6759da45d71c443a57cd3b7ca131a1fbb7660641167394

SHA512
b4c350a8de61beea9e7107e22c3a413156cbae47bb2755c8e6676f0871ca8703198378a714bf82ad9701686d70f33d3642538b6f2b9e20e1ee926d47b36a7a75

Download Submit
C:\Windows\SysWOW64\Kkihknfg.exe

Filesize
64KB

MD5
88e6c0b496c2acbeef8ee7788f60d30d

SHA1
826aeb53a0b026cfa40fa6373626f670318aae0a

SHA256
7c113335ce02af59f8719bc969bafc3e8ad10b679bc36f60739f10535bc6e452

SHA512
91e1d50a5c03fffef6ed8035afbe106a4cdd634336165bc2828c03d512e6dcee2820d18eb5ced61a9a215859ad872aff17cd84331c91289a50978586b4caa43c

Download Submit
C:\Windows\SysWOW64\Kkpnlm32.exe

Filesize
64KB

MD5
dc84409a4f1af67b9208a3871a91bc69

SHA1
63d9b2ba4b7eb0bb48550dceb15c7f4596d2ce8c

SHA256
526369aefd0d267a286475c406b8423cdf0297961a93a0588f7942af5445a771

SHA512
e2aa272e04648831e0284922e2209243068b7dc4beccb107c850f9f61279baf73324d5eecf1836f77539ea2032d78379ce5b7635ab89621e599c97e942bd6beb

Download Submit
C:\Windows\SysWOW64\Klljnp32.exe

Filesize
64KB

MD5
971e8ca95157eb51dd6b7509bb0e99fa

SHA1
e5c59487d908f8164eda0c2ecbad60627dcd825f

SHA256
9cbd63728bc718349a049d54319bcea0f89ae7543f2e0d29d5cde5640f6db43d

SHA512
d1c995d0c80d7013d9ff8a2d5a4e895b9b17e39004389abd8fdb5b4c826d040f1fb6c57d6748ba8ad0e4d104dc95aae4ebb319aaf9312c36f892abb0752a2568

Download Submit
C:\Windows\SysWOW64\Kmkfhc32.exe

Filesize
64KB

MD5
b8902767086bb0654fb8c1ff8f61fbc3

SHA1
7dd76dfc570e1a6fb2faaf412edeef230570d8ac

SHA256
6bceec78680aea1d433e0fbe5c305d42d2e6eb5577fc6a40415a677f031c7d48

SHA512
e6e43d942ceb5cf1a497daeae2279dda6c5f0fb9fdd897db172fb2ab2a2b6a1a1419a1e185a8762ce9f2b03842a94bd35766317f2d3fe946d813fb18c6d68d37

Download Submit
C:\Windows\SysWOW64\Kmnjhioc.exe

Filesize
64KB

MD5
d865c15eba153c897c383b8ccb9ca3f6

SHA1
7b74910f5651e5a05499071b59978efea1620b8e

SHA256
ad386a7aac498f11cd59f2e061097bacbf2752a84b21d8a0ade0a70dd3de6b0d

SHA512
32f4e9072f369c3d3fc8ff8d97b9868990411b5548bc4972f30ea0911a92a094ea01cf2c6d617aaaf9d4f38e0440a8cfc30e0f5704bd6799978ffadcaa6c2895

Download Submit
C:\Windows\SysWOW64\Kpepcedo.exe

Filesize
64KB

MD5
fdaa0bcb77dcc99cc6da927dd278186b

SHA1
4a6bb9d20e52e36511348332c54f8d9ac224eb19

SHA256
13eebaa9657b78a98da4f1643b8395dae63a1d85af5e90863f5e8f27a47ff8b3

SHA512
e59dc7acc8b36cb43d22c7a648c3774584acb3aa1eac03f3cc6f6704245563faace03af193d1a87e9332b43a3bef75d5ec05f93caabccba482ac6da445381e0d

Download Submit
C:\Windows\SysWOW64\Kpjjod32.exe

Filesize
64KB

MD5
55e301605681c7c3c49e4529ac4862ef

SHA1
0145edb0cee4d9a5145b4c555b6c645ff2fa6de5

SHA256
eab72be784017866ae369767d8e5057d5517c1d06c3b9d639d6df00e1bcc2b98

SHA512
4047b653ceebb14fd1857988660ab58dac4ce8f9269d7b37f245a1c7157683e83dca90ac6db4836a06e71dffe1795de97a3fadd8438633918de429f38ffaaf77

Download Submit
C:\Windows\SysWOW64\Ldkojb32.exe

Filesize
64KB

MD5
157d04f945ab5d48f271165ca043b0c6

SHA1
8cec4a836a107e199a39981e566d7b9e1c43a25f

SHA256
393956f96fbbb250de83701eb4187d3b7d97f6a605e706492096b68206678b9d

SHA512
0fd3150796feb55fe9013cbd4131d80ca9b4a0ecea65ee275dbc84c75360037db568de3d1f9662e3afd37d9027ee53dfc5fba41bc8fd71cc18d7bc02aa785b02

Download Submit
C:\Windows\SysWOW64\Liimncmf.exe

Filesize
64KB

MD5
c52d9b995a54579599315a3315d61c2f

SHA1
689aba7ec89659833a2c8639a37634d1b329a0e8

SHA256
b817418db2a4afb36196ec8c7f8dca59d8c4a98214a01d3dcf181afee6315574

SHA512
da0e63e2c2d2c229dc2a8a9c7909bd5b4e3000a0e3a4e96a3f41ef8dc50b50d7a2eb911ebfcda18b65b50922dc4d373e84b3f61c1261a1cbad56e0a0052da067

Download Submit
C:\Windows\SysWOW64\Lmqgnhmp.exe

Filesize
64KB

MD5
77b69113b15cc306559d274445b66b25

SHA1
8552685d803cb167180fde79feb29d39a5273db4

SHA256
2ef3809b4da94ab8dc648f42d80b8d5f2bee6dec735b5160a0b2e520cd9cd258

SHA512
a95a6e642d3c2a17f6a2df66f55ef1b9cec06aef687dd045b9ee7b0c197cabad8cb65cbe3d8a8959dbbf31ba92ff2ad4c916347f16f1a9cd5e50627e60022edd

Download Submit
C:\Windows\SysWOW64\Mcpebmkb.exe

Filesize
64KB

MD5
2de835c7eb1a5fce8eb9da270ff25217

SHA1
f488867fe0cee016bb0f9fa07ae9941a2928d984

SHA256
80980d70f0fe1b0d8bf8a904bfe25cd3d6517958ed23cc1c0a58e11fd5bfd152

SHA512
6bb4af70c26888dfed90d70b751ceb09c763824bfd82915b4ef6a886760c34c5cb63cb2b31f0c2ffe35eec1613e6dfb61b3217acfdc3af8b10a54beb76ffc5af

Download Submit
C:\Windows\SysWOW64\Mdckfk32.exe

Filesize
64KB

MD5
5d29e9f909ae04b9546f755247ad0041

SHA1
f0fb2c73bf2505acbe3ce1da714fae6b3f7a1556

SHA256
133f6d203e18da000701a7c84d21a8ae04c1ee8316c51030387dddca46a252bb

SHA512
357c07d0e95ed4c89d04d38e55f8c9389a3b3dbd7996124e16ec9583e0ca48c9e2c518e4a18c662e54f6c3a522bd2f816021d106621fb50e25dcfc50902ca201

Download Submit
C:\Windows\SysWOW64\Mdkhapfj.exe

Filesize
64KB

MD5
ed9e57bc6f4a66888cb1d403d87dfa94

SHA1
eee75c70ddb41c0c002c7e8ec60b768ae97711fc

SHA256
e0f08de830caa5aacd9edd5d120335bd5755bf0e212a882d0115929409895903

SHA512
b56e3a6f329211b3325455a2ef1ffea64c111b0fd10f151e70b428c13d5c8089f8f02c8a9889e44db7ef84810edfbefd179441f9396ae327ba94472c6f37254f

Download Submit
C:\Windows\SysWOW64\Mgfqmfde.exe

Filesize
64KB

MD5
a6132b9d32e1f4314fa0799f4a98cd8a

SHA1
94bf40837c39c400316fb599604c14bdc0de1c7b

SHA256
a485096e656040a7d92753933ba3169c6925e9c4e4427b2b2538f2ec9e4e2110

SHA512
d50e12de41e16823a28f00b56992b53f1948f3d0bdf0e7d2230e56d5169fb33ed712bfbd8ed79da279698eb47411cc9396d6a3adef77f75e47a66dc588a5e976

Download Submit
C:\Windows\SysWOW64\Mgimcebb.exe

Filesize
64KB

MD5
a2099c85b9f882d95b9f3982e7608d76

SHA1
f0e464dfb76dfdc8fec1b0945f9bb2574ec01e3e

SHA256
b62129c303d6169b7d5e3a26e7ca90770530b8ed884e2b425b753280e631b21b

SHA512
8eb1d0feee67295dc1d2309cb2dc9df45bbcca5513e817e7f1dd6f83f9cd79648c7f3e90f4aa6bcad22a0b472378f00a677c71041fe04e50763b68f0ac8a5d75

Download Submit
C:\Windows\SysWOW64\Mibpda32.exe

Filesize
64KB

MD5
719f91272df6be852a11e59935e7f709

SHA1
662dfb78647312df0da45fbd9f8e0841b6358c95

SHA256
bf132f2ffc70ef8da8968c555adfcefc9f6d28bd5677a7c000b4d2e75fb5f5bc

SHA512
bffb517844bd981f8c218721d65ebf6be6aff7876e98fcb68638cccde409ede87bf68006d8842602932d3a0976ffe02dbe6f584745e197da9103b2b15cdbdf5f

Download Submit
C:\Windows\SysWOW64\Mjjmog32.exe

Filesize
64KB

MD5
37424007d2c3499a98fcb3a7b2322832

SHA1
db5a65ced24e7731edb711629f4c58a68b508326

SHA256
01d19b34ef43afad0859e1ee81f8406cc1b0b10f52cc1c8c2bc15aa68140bb3a

SHA512
e3b8790ba936111469ab9de29295b3ee88e26cd84b11f2b7ca0a315d47eab38b0b9cb3db1673676017fa07269633fa22b18e0967a98dfa3ab7d22e3fab894c16

Download Submit
C:\Windows\SysWOW64\Mpablkhc.exe

Filesize
64KB

MD5
c33185a2df7e08d9ec2d59463603232e

SHA1
5f3d798e7736d5e47832ddcf43fdc20dc16d5469

SHA256
1189ca023f7d113f0b6fae33c4393c948cd07c550982b04df783c5f700d9c829

SHA512
74835d4ce16722c56fb797c22760cf50421cc7f279de68aa60457600eab4cd96102ab444a995b924cb78df157737cbf6720494cf241d6de8887aec3604f990da

Download Submit
C:\Windows\SysWOW64\Nbhkac32.exe

Filesize
64KB

MD5
428e4d9d763d2a0d4007e35f2d2b93d8

SHA1
4af3fef07de5dd3b2fdd288e6f1121178e2c100d

SHA256
86bc0f98528a61e1ea2d94f1bba571b94a711aacb2906b4b99c4bfcdc341d29b

SHA512
7149a416e6f29ccdcd0f05ccb62bcdba04f0e874f99ea32984a55fa88c1b1fcbf42081022263149a66ab33223c73bf612a9567efa76e89c12ce991edd9ee8663

Download Submit
C:\Windows\SysWOW64\Ndbnboqb.exe

Filesize
64KB

MD5
9a975d5325aefe278acfb7194d1969da

SHA1
b138c781a51c500aa8574c358505ee32c659bc71

SHA256
40fd91766620b90c75c9efb1e6964942f61cab3db9ab4e454619e5c6107292e2

SHA512
98d81392b21ee48bb5c26e1c60203cf1e852fd67ccb1c4a262646ffa5d9ee66c5adbf525787c68e487f70b2718e7d4999cde80f3cdfdc316ee61ea4bba470136

Download Submit
C:\Windows\SysWOW64\Ngpccdlj.exe

Filesize
64KB

MD5
8b91d0ee00d8df778fa7587b2ee482a1

SHA1
d0877f30430a937e86644ea15d3a1edbbeef49ff

SHA256
8b5e250bc0e2f6aa7f2dc0c6811705e5f3e5b1084b7aca1f7a65b383955f9517

SHA512
97dd44ba3f64af41f16ddf05554a4452be2b4a4305f21c7a68d8570d72defcb9e7a51f3bf32e019ae70387dbf050c3dee3b254eeebd1a3805c4bac5ce5daa246

Download Submit
C:\Windows\SysWOW64\Njefqo32.exe

Filesize
64KB

MD5
f0e8f5f2e35c564d6238624d8cafac2c

SHA1
edefb702ebcb18d7a76d6ac01247a8cf1ea972e6

SHA256
18e19d4da80cfefca987db88525222f32329252eacf49c7141c1120907df19f2

SHA512
bd323207d2830e8c43faf6fd212871c95d7264127b0f1dc394c8f0f479b2eb8d42c411ad4521d7e1a71eb7102d16dc68e2e4cded78168d90f2ae9e3a13976ae8

Download Submit
C:\Windows\SysWOW64\Ocqnij32.exe

Filesize
64KB

MD5
b31925778c9f460a536c298db2fb070f

SHA1
c66edce254b29128bee186b1fd766252b0f34608

SHA256
aac2d611122d02baf7642acfb3d425e8181e4501756272052070e50aa76aece9

SHA512
c46985f531213b040c260b5573ddb1f12c47abe2a76e03e7c3b50eedbe804d10749e53aff4fbe7c84424a8a7e517b438e6c446b58de2c25bad78fef67745e75f

Download Submit
C:\Windows\SysWOW64\Ofnckp32.exe

Filesize
64KB

MD5
9b0bceefa08099501cb35fbe4d7a01a6

SHA1
65cf323dfae16c1682766f78d0449a0672f428e3

SHA256
8862c4ea09438108f3875aa822a60c5f45bd551b98af64d5824f6e6ae039f7d7

SHA512
f9583b60229c578055769e34653158f10bea48741481f3e50a7ea4d6c52640e37ae278ef172f495c6a352fa200b516263d2a6cb91fe5b344fad09a2b65b8bf7b

Download Submit
C:\Windows\SysWOW64\Ojhiqefo.exe

Filesize
64KB

MD5
903178f03d7f20b4754ab28f4a5c7288

SHA1
faaac85e7e50cf9cebd7ae3d98af42c1ce1dde05

SHA256
ce36a804415f6a3c082bcf45e5c1d913818be0228ea8ff46f196a9d18dd33fb2

SHA512
8f3551467d49c32404e7c0b31da641cf8a60917015c8dca458e678e38812c0ee70b9a63f1ea0726b8040add6d96fa671c9e4c7c261bf67492688ed07a6b6bda4

Download Submit
C:\Windows\SysWOW64\Ojopad32.exe

Filesize
64KB

MD5
a8fb41d1a0ffae399858b1dc5ab1241b

SHA1
62a142e217ba86910dbe1507c6fa2385546baab5

SHA256
aad0e63dcfcd6ce910d87c9523be4dda6f5db7d67dafdaf1b82a9359872fb7cb

SHA512
2f6c9c439e9654edfdc3267ec57e7f148cb92bb0ebb13e0914c51acfdd0690b2d4d82adce058b99df53731beb4d9419530135a96452303c88f7b9d31f45d89a2

Download Submit
C:\Windows\SysWOW64\Pjcbbmif.exe

Filesize
64KB

MD5
e5bcab4d5b22f0a54540bc366e511cea

SHA1
efb646f007119925c3eb4c7ad2ba5fe11051c917

SHA256
5327ad7cab3de3f64c54273c4e0da2d5355d6ca78e29b197226424d82b9a40ff

SHA512
8803bda9733b4b277402351e5b6a0110f526056ad1e328f1ec30c0e751979bc76ce3c18967774640da5ec479a764c493bdddffa408f56a76ebeb13a9d6a94cec

Download Submit
C:\Windows\SysWOW64\Pjeoglgc.exe

Filesize
64KB

MD5
a800727a5eee749ed4a4eccd9b2c9901

SHA1
506996119efb846000a46f6306fecc1cae4d2a84

SHA256
eef3e9b5405348b7dbb6ebd063a6d13cc5909b3ee72e0a6fe16e31ff720962db

SHA512
d4716d7448119923501461076686182735bcb71761b441a71e46e002fd946b5406f7a374957b8feda6f0c2b47cefa729a297225ce76c7bf096251f0a2d77a778

Download Submit
C:\Windows\SysWOW64\Qbimoo32.exe

Filesize
64KB

MD5
b542a9fdb03a7becdcb92c5c8d107d28

SHA1
c4a5a612ad801ab1f6fae92d2eb49c9a2af3ccea

SHA256
cb97ca41674a5476ffb4325ff368599f8c70cb829406161790383ef8fc997349

SHA512
6951575a6512ee1136902ce09bc6f79a088c64ad3aca3d216d500aa4a061efda14496b1acd4e5086574810199c2bb7fbaeaaa61078736db83404fcb84d70306b

Download Submit
C:\Windows\SysWOW64\Qkmhlekj.exe

Filesize
64KB

MD5
42e6b9c4e5ebd848b16d0f5a9f390e94

SHA1
1fc1ded85b211e5b683794000976c48a4558dacd

SHA256
cbe1843634e2f63a23fd800432e42475219ff79cb314ceacd5ac617ca9024f66

SHA512
bd75539ccc8c29df7e433cc111741cd9bf1e53734e53388a948a77acf2369d30e710ea5a94697713431657f0851be8d58da9e653ad24f6d4a718a830263a4d46

Download Submit
memory/116-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/116-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/212-237-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/212-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/388-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/388-90-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/624-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/876-414-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1000-446-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1272-301-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1292-424-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1416-122-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1540-154-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1540-245-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1632-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1632-206-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1728-199-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1728-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1832-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1844-171-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1844-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1860-439-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2036-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2036-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2172-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2172-162-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2224-344-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2224-279-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2232-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2232-126-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2412-345-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2492-163-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2492-254-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2528-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2528-360-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2572-140-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2588-194-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2676-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2764-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2764-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2932-325-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3208-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3208-370-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3304-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3304-100-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3316-137-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3316-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3320-433-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3392-398-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3392-459-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3716-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3716-393-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3852-387-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3852-456-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3940-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3940-309-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3968-109-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3968-198-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3992-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4020-315-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4020-380-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4100-229-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4256-371-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4280-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4360-327-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4360-259-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4372-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4372-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4400-214-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4400-127-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4432-246-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4436-283-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4436-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4484-98-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4484-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4512-405-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4516-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4516-108-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4536-457-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4572-404-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4572-334-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4596-91-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4596-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4640-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4640-215-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4672-378-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4784-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4784-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4784-5-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/4788-82-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4788-170-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4936-381-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4936-445-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5052-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5064-255-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5068-238-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11976-3326-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads