5623cd98b8a3ccf9c4570447b1cd4ce260a4e952db79f1c95e7f130fb08b19b0

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

460fc62fa77f65e90ac4e02a09c9ca00_NeikiAnalytics.exe
Size

96KB
MD5

460fc62fa77f65e90ac4e02a09c9ca00
SHA1

36f00c28c1ea51c8b4a19f329ab103c975b0a804
SHA256

5623cd98b8a3ccf9c4570447b1cd4ce260a4e952db79f1c95e7f130fb08b19b0
SHA512

e47466b5e535a12ba012ad5d50bffada9b1be971b2bc2920e9f6573f4397ad2e0e90aae287a6cd2537d79620986c4e9c7352230f2bcfa9d090c3aa7693495939
SSDEEP

1536:ItovkaT2IJn87UQTsgh0Vgii2LBsBMu/HCmiDcg3MZRP3cEW3AE:IesaT2mn87UQTqmgBa6miEo

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbimoo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Megdccmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnlaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dccbbhld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eaklidoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifllil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdina32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnaikd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbkamqmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmnldp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikbnacmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnlhfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmidog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfoafi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lekehdgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pagdol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmlhii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcimkc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqdoboli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adapgfqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bblckl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqdoboli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cecbmf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icgjmapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkjlge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbbkaako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acmflf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cknnpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aacckjaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngbpidjh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqknig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aclpap32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chdkoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfpcgpae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hofdacke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kedoge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmlpoqpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqpnombl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbgdlq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kimnbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Leihbeib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Helfik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqknig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eekaebcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ildkgc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfjhkjle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdcbom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edkdkplj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkoggkjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbdgfa32.exe

Executes dropped EXE 64 IoCs

pid	Process
4316	Lkdggmlj.exe
4776	Lpappc32.exe
5064	Ldmlpbbj.exe
4808	Lgkhlnbn.exe
3884	Lijdhiaa.exe
3144	Lpcmec32.exe
4392	Lkiqbl32.exe
3532	Lpfijcfl.exe
4236	Lcdegnep.exe
3708	Ljnnch32.exe
4968	Lphfpbdi.exe
4652	Lgbnmm32.exe
2140	Mnlfigcc.exe
3108	Mdfofakp.exe
3180	Mkpgck32.exe
948	Mdiklqhm.exe
4584	Mkbchk32.exe
4724	Mpolqa32.exe
4960	Mkepnjng.exe
4932	Mncmjfmk.exe
4756	Mpaifalo.exe
4372	Mkgmcjld.exe
4904	Mnfipekh.exe
2648	Mpdelajl.exe
2244	Mgnnhk32.exe
4232	Njljefql.exe
4656	Ngpjnkpf.exe
1564	Nafokcol.exe
3632	Ncgkcl32.exe
2692	Ngcgcjnc.exe
4052	Nbhkac32.exe
4744	Ngedij32.exe
1256	Njcpee32.exe
3456	Nbkhfc32.exe
4624	Ndidbn32.exe
4748	Njfmke32.exe
1276	Nnaikd32.exe
3116	Ndkahnhh.exe
1620	Okeieh32.exe
996	Oboaabga.exe
4348	Odnnnnfe.exe
1440	Okhfjh32.exe
3744	Onfbfc32.exe
4352	Oqdoboli.exe
2956	Occkojkm.exe
1672	Okjbpglo.exe
4056	Ojmcld32.exe
4852	Obdkma32.exe
3380	Oqgkhnjf.exe
3476	Ocegdjij.exe
2564	Onklabip.exe
4108	Oqihnn32.exe
4304	Ogcpjhoq.exe
4224	Ojalgcnd.exe
3104	Obidhaog.exe
224	Odgqdlnj.exe
2844	Pgemphmn.exe
3492	Pjdilcla.exe
4560	Pbkamqmd.exe
1968	Pkceffcd.exe
2356	Pnbbbabh.exe
1912	Pqpnombl.exe
4980	Pcojkhap.exe
4896	Pndohaqe.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Aacckjaf.exe	Alfkbc32.exe
File opened for modification	C:\Windows\SysWOW64\Lbabgh32.exe	Lpcfkm32.exe
File opened for modification	C:\Windows\SysWOW64\Lbdolh32.exe	Lpebpm32.exe
File created	C:\Windows\SysWOW64\Hjqaij32.dll	Dkoggkjo.exe
File opened for modification	C:\Windows\SysWOW64\Elgfgl32.exe	Eabbjc32.exe
File opened for modification	C:\Windows\SysWOW64\Foabofnn.exe	Flceckoj.exe
File opened for modification	C:\Windows\SysWOW64\Gohhpe32.exe	Gkmlofol.exe
File created	C:\Windows\SysWOW64\Hafgeo32.dll	Gcfqfc32.exe
File opened for modification	C:\Windows\SysWOW64\Helfik32.exe	Hbnjmp32.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	Dogogcpo.exe
File created	C:\Windows\SysWOW64\Mpjlklok.exe	Mmlpoqpg.exe
File opened for modification	C:\Windows\SysWOW64\Nfjjppmm.exe	Ndhmhh32.exe
File opened for modification	C:\Windows\SysWOW64\Qchmagie.exe	Qajadlja.exe
File created	C:\Windows\SysWOW64\Klohnjkj.dll	Qjbena32.exe
File created	C:\Windows\SysWOW64\Hffdjk32.dll	Bjpaooda.exe
File created	C:\Windows\SysWOW64\Eefhjc32.exe	Eaklidoi.exe
File created	C:\Windows\SysWOW64\Jiopcppf.dll	Jbeidl32.exe
File created	C:\Windows\SysWOW64\Hqdeld32.dll	Kimnbd32.exe
File created	C:\Windows\SysWOW64\Gefncbmc.dll	Lcdegnep.exe
File opened for modification	C:\Windows\SysWOW64\Gkhbdg32.exe	Fhjfhl32.exe
File created	C:\Windows\SysWOW64\Ghopckpi.exe	Gfpcgpae.exe
File created	C:\Windows\SysWOW64\Ejnjpohk.dll	Klljnp32.exe
File created	C:\Windows\SysWOW64\Mpablkhc.exe	Migjoaaf.exe
File opened for modification	C:\Windows\SysWOW64\Nnaikd32.exe	Njfmke32.exe
File opened for modification	C:\Windows\SysWOW64\Dadeieea.exe	Doeiljfn.exe
File created	C:\Windows\SysWOW64\Eaklidoi.exe	Eolpmi32.exe
File created	C:\Windows\SysWOW64\Ciglpe32.dll	Hobkfd32.exe
File created	C:\Windows\SysWOW64\Mjddiqoc.dll	Jfcbjk32.exe
File created	C:\Windows\SysWOW64\Nlplhfon.dll	Klimip32.exe
File opened for modification	C:\Windows\SysWOW64\Lcdegnep.exe	Lpfijcfl.exe
File opened for modification	C:\Windows\SysWOW64\Oqgkhnjf.exe	Obdkma32.exe
File created	C:\Windows\SysWOW64\Pcojkhap.exe	Pqpnombl.exe
File opened for modification	C:\Windows\SysWOW64\Nljofl32.exe	Nilcjp32.exe
File created	C:\Windows\SysWOW64\Mkijij32.dll	Cjinkg32.exe
File opened for modification	C:\Windows\SysWOW64\Oncofm32.exe	Ogifjcdp.exe
File created	C:\Windows\SysWOW64\Pqmjog32.exe	Pjcbbmif.exe
File opened for modification	C:\Windows\SysWOW64\Mdfofakp.exe	Mnlfigcc.exe
File created	C:\Windows\SysWOW64\Bhdbhcck.exe	Beeflhdh.exe
File created	C:\Windows\SysWOW64\Fcnopdeh.dll	Fdlnbm32.exe
File opened for modification	C:\Windows\SysWOW64\Gcfqfc32.exe	Gkoiefmj.exe
File opened for modification	C:\Windows\SysWOW64\Hmhhehlb.exe	Heapdjlp.exe
File created	C:\Windows\SysWOW64\Kimnbd32.exe	Kfoafi32.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Agjhgngj.exe
File created	C:\Windows\SysWOW64\Aabmqd32.exe	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Ndclfb32.dll	Ldmlpbbj.exe
File opened for modification	C:\Windows\SysWOW64\Mpdelajl.exe	Mnfipekh.exe
File opened for modification	C:\Windows\SysWOW64\Pbkamqmd.exe	Pjdilcla.exe
File created	C:\Windows\SysWOW64\Aelcfilb.exe	Anbkio32.exe
File created	C:\Windows\SysWOW64\Inlekh32.dll	Ecandfpd.exe
File opened for modification	C:\Windows\SysWOW64\Lepncd32.exe	Lbabgh32.exe
File created	C:\Windows\SysWOW64\Ekipni32.dll	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Dhkapp32.exe	Demecd32.exe
File created	C:\Windows\SysWOW64\Olpppj32.dll	Hopnqdan.exe
File created	C:\Windows\SysWOW64\Hnmacdaj.dll	Icgjmapi.exe
File created	C:\Windows\SysWOW64\Bfkedibe.exe	Banllbdn.exe
File created	C:\Windows\SysWOW64\Ngpjnkpf.exe	Njljefql.exe
File created	C:\Windows\SysWOW64\Ehedfo32.exe	Eefhjc32.exe
File opened for modification	C:\Windows\SysWOW64\Ghopckpi.exe	Gfpcgpae.exe
File created	C:\Windows\SysWOW64\Iefioj32.exe	Hbgmcnhf.exe
File created	C:\Windows\SysWOW64\Nilcjp32.exe	Ngmgne32.exe
File created	C:\Windows\SysWOW64\Majknlkd.dll	Ncgkcl32.exe
File opened for modification	C:\Windows\SysWOW64\Pcojkhap.exe	Pqpnombl.exe
File created	C:\Windows\SysWOW64\Nqbjqh32.dll	Cafigg32.exe
File created	C:\Windows\SysWOW64\Gjihje32.dll	Dedkdcie.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11208	11116	WerFault.exe	510

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Alhhhcal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaekmb32.dll"	Dadeieea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cafigg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkmchi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Okhfjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Obdkma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqpnombl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pndohaqe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Immapg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odgdacjh.dll"	Ngmgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpaekf32.dll"	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghekgcil.dll"	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjmcmj32.dll"	Pqpnombl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgempgqo.dll"	Baaplhef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cbqlfkmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mifnjj32.dll"	Ekhjmiad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmgfda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpcmec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecmeig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kepelfam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lepncd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghilmi32.dll"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgjpndjd.dll"	Acjjfggb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acmflf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cknnpm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiojlkkj.dll"	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njljefql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aealah32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qjbena32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jedeph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kofpij32.dll"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdkldb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcgdbi32.dll"	Gofkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ingapb32.dll"	Jpnchp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Megdccmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcnhho32.dll"	Opakbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcbibebo.dll"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbllbm32.dll"	Pnbbbabh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Paegjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iefioj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgagbf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nljofl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofeilobp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oahicipe.dll"	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Becifhfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhaebcen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqbjqh32.dll"	Cafigg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlncan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdckfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oboaabga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eefhjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilidbbgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lijdhiaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pkceffcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjdgcbkb.dll"	Bbgipldd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nffbangm.dll"	Jbjcolha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcllonma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iefioj32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 4316	3644	460fc62fa77f65e90ac4e02a09c9ca00_NeikiAnalytics.exe	82
PID 3644 wrote to memory of 4316	3644	460fc62fa77f65e90ac4e02a09c9ca00_NeikiAnalytics.exe	82
PID 3644 wrote to memory of 4316	3644	460fc62fa77f65e90ac4e02a09c9ca00_NeikiAnalytics.exe	82
PID 4316 wrote to memory of 4776	4316	Lkdggmlj.exe	83
PID 4316 wrote to memory of 4776	4316	Lkdggmlj.exe	83
PID 4316 wrote to memory of 4776	4316	Lkdggmlj.exe	83
PID 4776 wrote to memory of 5064	4776	Lpappc32.exe	84
PID 4776 wrote to memory of 5064	4776	Lpappc32.exe	84
PID 4776 wrote to memory of 5064	4776	Lpappc32.exe	84
PID 5064 wrote to memory of 4808	5064	Ldmlpbbj.exe	85
PID 5064 wrote to memory of 4808	5064	Ldmlpbbj.exe	85
PID 5064 wrote to memory of 4808	5064	Ldmlpbbj.exe	85
PID 4808 wrote to memory of 3884	4808	Lgkhlnbn.exe	86
PID 4808 wrote to memory of 3884	4808	Lgkhlnbn.exe	86
PID 4808 wrote to memory of 3884	4808	Lgkhlnbn.exe	86
PID 3884 wrote to memory of 3144	3884	Lijdhiaa.exe	87
PID 3884 wrote to memory of 3144	3884	Lijdhiaa.exe	87
PID 3884 wrote to memory of 3144	3884	Lijdhiaa.exe	87
PID 3144 wrote to memory of 4392	3144	Lpcmec32.exe	88
PID 3144 wrote to memory of 4392	3144	Lpcmec32.exe	88
PID 3144 wrote to memory of 4392	3144	Lpcmec32.exe	88
PID 4392 wrote to memory of 3532	4392	Lkiqbl32.exe	89
PID 4392 wrote to memory of 3532	4392	Lkiqbl32.exe	89
PID 4392 wrote to memory of 3532	4392	Lkiqbl32.exe	89
PID 3532 wrote to memory of 4236	3532	Lpfijcfl.exe	90
PID 3532 wrote to memory of 4236	3532	Lpfijcfl.exe	90
PID 3532 wrote to memory of 4236	3532	Lpfijcfl.exe	90
PID 4236 wrote to memory of 3708	4236	Lcdegnep.exe	91
PID 4236 wrote to memory of 3708	4236	Lcdegnep.exe	91
PID 4236 wrote to memory of 3708	4236	Lcdegnep.exe	91
PID 3708 wrote to memory of 4968	3708	Ljnnch32.exe	92
PID 3708 wrote to memory of 4968	3708	Ljnnch32.exe	92
PID 3708 wrote to memory of 4968	3708	Ljnnch32.exe	92
PID 4968 wrote to memory of 4652	4968	Lphfpbdi.exe	93
PID 4968 wrote to memory of 4652	4968	Lphfpbdi.exe	93
PID 4968 wrote to memory of 4652	4968	Lphfpbdi.exe	93
PID 4652 wrote to memory of 2140	4652	Lgbnmm32.exe	94
PID 4652 wrote to memory of 2140	4652	Lgbnmm32.exe	94
PID 4652 wrote to memory of 2140	4652	Lgbnmm32.exe	94
PID 2140 wrote to memory of 3108	2140	Mnlfigcc.exe	95
PID 2140 wrote to memory of 3108	2140	Mnlfigcc.exe	95
PID 2140 wrote to memory of 3108	2140	Mnlfigcc.exe	95
PID 3108 wrote to memory of 3180	3108	Mdfofakp.exe	96
PID 3108 wrote to memory of 3180	3108	Mdfofakp.exe	96
PID 3108 wrote to memory of 3180	3108	Mdfofakp.exe	96
PID 3180 wrote to memory of 948	3180	Mkpgck32.exe	97
PID 3180 wrote to memory of 948	3180	Mkpgck32.exe	97
PID 3180 wrote to memory of 948	3180	Mkpgck32.exe	97
PID 948 wrote to memory of 4584	948	Mdiklqhm.exe	98
PID 948 wrote to memory of 4584	948	Mdiklqhm.exe	98
PID 948 wrote to memory of 4584	948	Mdiklqhm.exe	98
PID 4584 wrote to memory of 4724	4584	Mkbchk32.exe	100
PID 4584 wrote to memory of 4724	4584	Mkbchk32.exe	100
PID 4584 wrote to memory of 4724	4584	Mkbchk32.exe	100
PID 4724 wrote to memory of 4960	4724	Mpolqa32.exe	101
PID 4724 wrote to memory of 4960	4724	Mpolqa32.exe	101
PID 4724 wrote to memory of 4960	4724	Mpolqa32.exe	101
PID 4960 wrote to memory of 4932	4960	Mkepnjng.exe	102
PID 4960 wrote to memory of 4932	4960	Mkepnjng.exe	102
PID 4960 wrote to memory of 4932	4960	Mkepnjng.exe	102
PID 4932 wrote to memory of 4756	4932	Mncmjfmk.exe	103
PID 4932 wrote to memory of 4756	4932	Mncmjfmk.exe	103
PID 4932 wrote to memory of 4756	4932	Mncmjfmk.exe	103
PID 4756 wrote to memory of 4372	4756	Mpaifalo.exe	104

C:\Users\Admin\AppData\Local\Temp\460fc62fa77f65e90ac4e02a09c9ca00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\460fc62fa77f65e90ac4e02a09c9ca00_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Windows\SysWOW64\Lkdggmlj.exe
  C:\Windows\system32\Lkdggmlj.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\SysWOW64\Lpappc32.exe
    C:\Windows\system32\Lpappc32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\SysWOW64\Ldmlpbbj.exe
      C:\Windows\system32\Ldmlpbbj.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4808
      - C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3884
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3532
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4236
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3708
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2140
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3108
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3180
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:948
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4584
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4756
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4904
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        25⤵
        Executes dropped EXE
        
        PID:2648
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2244
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4232
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        28⤵
        Executes dropped EXE
        
        PID:4656
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        29⤵
        Executes dropped EXE
        
        PID:1564
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3632
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        31⤵
        Executes dropped EXE
        
        PID:2692
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        32⤵
        Executes dropped EXE
        
        PID:4052
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        33⤵
        Executes dropped EXE
        
        PID:4744
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        34⤵
        Executes dropped EXE
        
        PID:1256
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        35⤵
        Executes dropped EXE
        
        PID:3456
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4624
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4748
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1276
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        39⤵
        Executes dropped EXE
        
        PID:3116
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        40⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:996
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        42⤵
        Executes dropped EXE
        
        PID:4348
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1440
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        44⤵
        Executes dropped EXE
        
        PID:3744
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        46⤵
        Executes dropped EXE
        
        PID:2956
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        47⤵
        Executes dropped EXE
        
        PID:1672
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        48⤵
        Executes dropped EXE
        
        PID:4056
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4852
        
        C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        50⤵
        Executes dropped EXE
        
        PID:3380
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        51⤵
        Executes dropped EXE
        
        PID:3476
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        52⤵
        Executes dropped EXE
        
        PID:2564
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        53⤵
        Executes dropped EXE
        
        PID:4108
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        54⤵
        Executes dropped EXE
        
        PID:4304
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        55⤵
        Executes dropped EXE
        
        PID:4224
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        56⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        57⤵
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        58⤵
        Executes dropped EXE
        
        PID:2844
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3492
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1968
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2356
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1912
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        64⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4896
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        66⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        67⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        68⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        69⤵
        
        PID:636
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        70⤵
        Modifies registry class
        
        PID:728
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        71⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1160
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        73⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4444
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        75⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        76⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        77⤵
        Drops file in System32 directory
        
        PID:2860
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        78⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        79⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5032
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3776
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        81⤵
        Modifies registry class
        
        PID:912
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        82⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        83⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3924
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        85⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        86⤵
        Drops file in System32 directory
        
        PID:4156
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        87⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        88⤵
        Drops file in System32 directory
        
        PID:4032
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1668
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1252
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        91⤵
        Modifies registry class
        
        PID:2144
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        92⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        93⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        94⤵
        Modifies registry class
        
        PID:5168
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        95⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        96⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        97⤵
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        98⤵
        Modifies registry class
        
        PID:5404
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        99⤵
        Drops file in System32 directory
        
        PID:5460
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        100⤵
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        101⤵
        Drops file in System32 directory
        
        PID:5572
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        102⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        103⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        104⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        105⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        106⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        107⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        108⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5992
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        110⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        111⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        112⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        113⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        114⤵
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        115⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        116⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        117⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        118⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        119⤵
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        120⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        121⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        122⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        123⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        124⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        125⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        127⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5656
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        129⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        130⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        131⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2616
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        133⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        134⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        135⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        136⤵
        Modifies registry class
        
        PID:6112
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        137⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        138⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        139⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        140⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        141⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        142⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        143⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        144⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        145⤵
        Drops file in System32 directory
        
        PID:6236
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        146⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        147⤵
        Drops file in System32 directory
        
        PID:6332
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        148⤵
        Modifies registry class
        
        PID:6372
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        149⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        150⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6500
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        152⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6576
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        154⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        155⤵
        Drops file in System32 directory
        
        PID:6668
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        156⤵
        Modifies registry class
        
        PID:6708
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        157⤵
        Drops file in System32 directory
        
        PID:6748
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6800
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        159⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6844
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        160⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        161⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        162⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7020
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        164⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        165⤵
        Modifies registry class
        
        PID:7112
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7160
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        167⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        168⤵
        Modifies registry class
        
        PID:6232
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        169⤵
        Drops file in System32 directory
        
        PID:6308
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        170⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        171⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        172⤵
        Drops file in System32 directory
        
        PID:6528
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        173⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        174⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        175⤵
        Modifies registry class
        
        PID:6736
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        176⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        177⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        178⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        179⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        180⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        181⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        182⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        183⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        184⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        185⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        186⤵
        Drops file in System32 directory
        
        PID:6644
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        187⤵
        Drops file in System32 directory
        
        PID:6740
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        188⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        189⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        190⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        191⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        192⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6720
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        194⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        195⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        196⤵
        Modifies registry class
        
        PID:6272
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6572
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6980
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        199⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        200⤵
        Drops file in System32 directory
        
        PID:6836
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        201⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6820
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        203⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7224
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        205⤵
        Drops file in System32 directory
        
        PID:7268
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        206⤵
        Drops file in System32 directory
        
        PID:7316
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        207⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        208⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        209⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7488
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        211⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        212⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        213⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        214⤵
        Drops file in System32 directory
        
        PID:7656
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        215⤵
        Drops file in System32 directory
        
        PID:7712
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7776
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        217⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        218⤵
        Drops file in System32 directory
        
        PID:7856
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        219⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        220⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        221⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        222⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        223⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        224⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        225⤵
        Drops file in System32 directory
        
        PID:8148
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        226⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7212
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        228⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        229⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        230⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        231⤵
        Drops file in System32 directory
        
        PID:7432
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        232⤵
        Modifies registry class
        
        PID:7512
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        233⤵
        Modifies registry class
        
        PID:7556
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7648
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        235⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        236⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7852
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        238⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        239⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        240⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8180
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        242⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        243⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        244⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        245⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        246⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7624
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        248⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        249⤵
        Modifies registry class
        
        PID:7848
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        250⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        251⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        252⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        253⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        254⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        255⤵
        Drops file in System32 directory
        
        PID:7580
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        256⤵
        Modifies registry class
        
        PID:7868
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        257⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        258⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        259⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        260⤵
        Drops file in System32 directory
        
        PID:7612
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        261⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        262⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        263⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        264⤵
        Modifies registry class
        
        PID:7764
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        265⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        266⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        267⤵
        Modifies registry class
        
        PID:7636
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        268⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        269⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8276
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8320
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        272⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        273⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        274⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        275⤵
        Modifies registry class
        
        PID:8492
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        276⤵
        Drops file in System32 directory
        
        PID:8536
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        277⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8624
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8664
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8708
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8752
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        282⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8836
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        284⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        285⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        286⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        287⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9044
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        289⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        290⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7792
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        292⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        293⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8480
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        295⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        296⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        297⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8828
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        299⤵
        Drops file in System32 directory
        
        PID:8888
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        300⤵
        Drops file in System32 directory
        
        PID:8956
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        301⤵
        Modifies registry class
        
        PID:9040
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        302⤵
        Modifies registry class
        
        PID:9124
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        303⤵
        Drops file in System32 directory
        
        PID:8056
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        304⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        305⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        306⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        307⤵
        Modifies registry class
        
        PID:8736
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        308⤵
        Modifies registry class
        
        PID:8900
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9000
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        310⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        311⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8564
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8644
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        314⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        315⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        316⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        317⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        318⤵
        Drops file in System32 directory
        
        PID:9136
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        319⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        320⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        321⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        322⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        323⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9228
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        324⤵
        Drops file in System32 directory
        
        PID:9268
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        325⤵
        Modifies registry class
        
        PID:9320
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        326⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        327⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        328⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9504
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9548
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        331⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9632
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        333⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        334⤵
        Drops file in System32 directory
        
        PID:9720
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        335⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        336⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        337⤵
        Drops file in System32 directory
        
        PID:9848
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        338⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        339⤵
        Modifies registry class
        
        PID:9932
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        340⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        341⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        342⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        343⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        344⤵
        Modifies registry class
        
        PID:10152
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10196
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        346⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        347⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        348⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        349⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        350⤵
        Modifies registry class
        
        PID:9452
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9500
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9584
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        353⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        354⤵
        Drops file in System32 directory
        
        PID:9736
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        355⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        356⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        357⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        358⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        359⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        360⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10228
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        362⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9356
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        364⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        365⤵
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        366⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        367⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        368⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        369⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        370⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        371⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        372⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        373⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        374⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        375⤵
        Modifies registry class
        
        PID:9436
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        376⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        377⤵
        Modifies registry class
        
        PID:4592
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9864
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        379⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        380⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        381⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        382⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9512
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        383⤵
        Drops file in System32 directory
        
        PID:1920
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        384⤵
        Modifies registry class
        
        PID:1116
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        385⤵
        Modifies registry class
        
        PID:1608
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        386⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        387⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        388⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        389⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        390⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        391⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        392⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        393⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10180
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        395⤵
        Modifies registry class
        
        PID:9988
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        396⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9820
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        397⤵
        Drops file in System32 directory
        
        PID:10268
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        398⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        399⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        400⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        401⤵
        Drops file in System32 directory
        
        PID:10428
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        402⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        403⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        404⤵
        Modifies registry class
        
        PID:10556
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        405⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        406⤵
        Modifies registry class
        
        PID:10644
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        407⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        408⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        409⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        410⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        411⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        412⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10900
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10944
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        414⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        415⤵
        Drops file in System32 directory
        
        PID:11032
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        416⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        417⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11116 -s 396
        418⤵
        Program crash
        
        PID:11208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 11116 -ip 11116
1⤵
PID:11180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Banllbdn.exe

Filesize
96KB

MD5
1c0543f1ac9b30a39c39fe38b8cbb8e5

SHA1
84a774b3df462f6bb14113dad638da41148e8402

SHA256
e948444ca4796a887fea0fea99671649c17861b31997d456321540f86687427c

SHA512
0e0b0c078b6f538437127a4c8d98c0def7e03ff293ed62cbcbf930154a928872c42987a95724a90ce18592a027958d2f3657b4f4a6a82d156d83d11e84610da9

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
96KB

MD5
b7d1c271782dd109ed9058b4cdc1b0bc

SHA1
77c09a7c9af0b952245e609946fffb561916e92c

SHA256
cdb2dfa396203fb1e4e3e3140b73dcd3901633d85b2d71c208a882321208d28e

SHA512
219b1c5dcee9b0e0a594a838c0fda0521953f0f4d192a5336ac791d904fdbdea688c7c59581f4f1e03342b2775cf1afd1c5932a2c8c7b64667fe8715570eab01

Download Submit
C:\Windows\SysWOW64\Cafigg32.exe

Filesize
96KB

MD5
460e5c2443bbef55251be47b82669b3f

SHA1
009792ad09b1ec6d9511a42ec2bb15f6f87a2697

SHA256
7256fe3fc82b57e6c862e664968a107b0cb1d1e51aaf267334c2d5287d24b2cd

SHA512
697cd123e75fe3fc9f18f48221c2584d3d8311d7778cf6636b86beb728ab5f8cb6b517f526089a4bcadd46c3a1b3ab6e219f4944e28204aaa40b50c46853690a

Download Submit
C:\Windows\SysWOW64\Cenahpha.exe

Filesize
96KB

MD5
e9ed8c88abf63546b2051221ed671e28

SHA1
71a0cad791b5c50900fdf737b6eb5f8d673ba4cb

SHA256
a278d2807fc080b37efe8409609f06f80d80b0d645ee6231498c6fd07c54964d

SHA512
8bed5a1bd77d695a7383b0ab5f8d366fb66b9596a06c9be4035c14e70d1ea0dd247c88dc2cd231c5506991b46031d94a833b806b25094db5b805037cbaa84c04

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
96KB

MD5
81b04cf407a77db4a41caed38a98ae8e

SHA1
e0c049cb26312836eebce2861ca317478761bc8f

SHA256
73d03354d4fe855bda583288fdef4ae0822e26bb362e882697ed544aa6683956

SHA512
934ffb0e8f19faed124383504d3ae5d08a7d25e82325e533670bbd4ce8efbc5cb3753012a396ddbd55c81f383634f870ce155256f432ce11cc76b12db2bccc73

Download Submit
C:\Windows\SysWOW64\Chpada32.exe

Filesize
96KB

MD5
328d01669dd382348ad0af8c4bf118ca

SHA1
8bf6852fa0efc9b206e8d96941bade1e0d45b351

SHA256
1c2bd7b48e83ecbe2346af6d228abde0e8d6ef91afd9a0dea45c204b15ff61e0

SHA512
b4607466aa12053085e380f7f58f669c7865d99a03759b00c5ab2aab7f36f4620337d46f64dd47eef58caf6abbdb4ed764e2266178268457feb54e3b3e7eb962

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
96KB

MD5
75c1b92073b93c95cd2c4e9b658476f2

SHA1
b7a1fc9b4495ae1661f996574d29d82cfeb6ecf7

SHA256
8a8f1528777923311e148ea2f7a302d821ebcc0244847d2c4d81f9323b7f1fc5

SHA512
8832e805ddbb037e3aa5f89ae04eb9b699cf588c2028e300d40fcd5432172965fdcb7a34adb6e65c46241d5a263872233619053cf38c45e76217045bd6a2dce9

Download Submit
C:\Windows\SysWOW64\Dhpjkojk.exe

Filesize
96KB

MD5
ce446a32d849b51a32008e2b2e5dc285

SHA1
6788510550768402f98411259de3b8daf6a92598

SHA256
5c757f0f03c2b1f76cce52db6a8969bd2cc62464c97eba0ae82debf464bae542

SHA512
301cc1b4317409277567be1917c67ebc2b20136a01a3a3646aac8ba31a24629b73b327f4c530d40daec31b849953c2a73af93a2cf6f2fb5df94cc1625c8044c0

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
96KB

MD5
4fbc899903154964100ce74ef20d079e

SHA1
9c8da8b755d535a80e8beeb4c5da9c8f1d56b43a

SHA256
fe403e843e6116f11d6a3bc1aa24c422b2781c1aaf3e287b654649f2a23a6320

SHA512
d1abc035e0285abc7aae9a069a41478381ddf0a14bc2bf2acd669eb35dd2aed105cc39fdf9982b7aa94e4f7fe26a5559375a49de6fcae606458f9bdc75c2201e

Download Submit
C:\Windows\SysWOW64\Ecandfpd.exe

Filesize
96KB

MD5
d3d0ec7494d95c7dbfe5c517ec89d5e5

SHA1
a7757e35afa3c9a47a9e7233d3a104561c058321

SHA256
ef83e5b71dc36de28c751ceff3745777b1e9a2eff4a1566a3582a232832a0a8d

SHA512
19775b5d1300f9824b377a526ee14c6035ea443c5bb432d6fc7da3303795c1b5bb772b03fa5ae025c1ff6e27b94c1bb715f27dfce65607c461757be2f8db4c9e

Download Submit
C:\Windows\SysWOW64\Eekaebcm.exe

Filesize
96KB

MD5
73dfa81cf0c718f13f72032940eff1b0

SHA1
f9b5cfd8dd9a706691c15e6e364ba9fafa1beafa

SHA256
73167e0154c8b0489b8f26ed734be0ba0e2f9ed607ee0c81a2bd3be0a9a713d2

SHA512
a06f52977cf04357ed7b1e1bc60e33d91ac1c186427f9a087cab71945c08e7a4752b9e51df8a1b7ba66820d1c0a45754ede534c7608c510cc81b38646beacd81

Download Submit
C:\Windows\SysWOW64\Ehedfo32.exe

Filesize
96KB

MD5
653a415a48278c74aa3bdf8294a033b3

SHA1
91f8e7e8eaa0453ba02d4df03e5ee7f4769b70c6

SHA256
4101f0a22679bc2a24825f4881e0189eaf42b43c0fcb691a153f4c7b90bba875

SHA512
91d72b1825ea0fa11430a2ca30fac3600dc30dae90e30a1111ae691ba19954f946c059a2d3e5b13167d344c471e0fd1867cf8a79b43981bfc8960e7b41d176af

Download Submit
C:\Windows\SysWOW64\Fljcmlfd.exe

Filesize
96KB

MD5
7e78ff71d4d267deca3b34a90dfe6b08

SHA1
8657f8b829858e13b40eea7256c204a1713572e3

SHA256
e67af541884dca40d8913e6f5f89836c97a042ef0b28bd844abad96beae5f1d1

SHA512
c2c15ddb3603287cdb95ed675da7a75ad72e9e468624e589107474d060601c289a16da9ebfad5d994634a622ef7be7bea821b56e472a821f2d24c2c798c3430a

Download Submit
C:\Windows\SysWOW64\Ibnccmbo.exe

Filesize
96KB

MD5
3c0f3b878b45ca517f8bd4ba255ce52c

SHA1
41a5926e33f44ac67cd3edbc82177da804271210

SHA256
16621ef728bb15b31c470289ce634c88f9462bfee020d145ffb085c099300198

SHA512
9ef0518bcb8394c2579ea04e0ad8cf5f80fc8a8c284f802b06ba955b1329a45f5c2dc9ed1dd44b727aa46622ae1f80285d55d761d0f719ea56ea092c7b028c19

Download Submit
C:\Windows\SysWOW64\Imdgqfbd.exe

Filesize
64KB

MD5
e2889dfe7ce5b01de8769110b0f5a365

SHA1
57ecc604b5617d8fb9810a2e3557c8a061a40ca9

SHA256
bb5b3a90442910b6d923dda5102a201f4347ebd2a7052d4ad33db5874d2d876e

SHA512
eb4c48ad9f6f22a65c1c722db0030eee72b953c581aab7ee9f08f66c20566aa42e41b64cf127286d2c2f45d7913d3427fc1efa49121896e29753d0afc73b120f

Download Submit
C:\Windows\SysWOW64\Jcioiood.exe

Filesize
96KB

MD5
4c585c58273bc182566e966f8838fb79

SHA1
ad8cb1f556e1fb7ffc1d14cf227414edaa4f3f0a

SHA256
6b2eddf567dd5d6f6aafd9da79aa204a695d312f0009cabf40593482a7b7f9be

SHA512
e09af5da9f668940c6f51f2694ede15fea17e561ea0c5d0f11cc8da019535478731c26d495e4318a4fbc6a3678e09667ba6a879c20fc3de8023c2c37c0c3ba7c

Download Submit
C:\Windows\SysWOW64\Kfjhkjle.exe

Filesize
96KB

MD5
df760a84257770a1c9a9d193a1a19a0f

SHA1
a0ed989166f7a415700de304e34ca333c4edec74

SHA256
0cfbee3b4b90b74193b0bcdef2e12e10d72071be761af8a50cd4a2343a6336b9

SHA512
dac7c09f227da77ca1c5c63b638ae2255c68139c5542ee4970055c14d2d50f895f5c0645b064f842aba4b20ec1aea2a50a9c286d4bab9b4663f50e679469ca46

Download Submit
C:\Windows\SysWOW64\Lbmhlihl.exe

Filesize
96KB

MD5
0caeaf1e054275fb82e3b48bd7605b10

SHA1
782a5f5ab9164ae4c0e9b626ab1d94b7252a9ac2

SHA256
922a0303b1f6d6637d9f9da7adab66e97846e44d4185b314a3b2eaf0cd2c7a2b

SHA512
c627e7c0cf4f79f8d29ee312462ba355066fab133e781106198dd15ff5589bbf02c0c2abe5c873365035cb39f576494f74d228b127b0ba9a699036f6f4408e3a

Download Submit
C:\Windows\SysWOW64\Lcdegnep.exe

Filesize
96KB

MD5
e96c70cbbfaaf8f4028a0f08c7a40a5f

SHA1
86cbaddebc7b800df2bd27c6d06f48b163048ac1

SHA256
f88029a24b8583682cacaa423dff1e79dcd217a04f37340dd25240cf84bfb2aa

SHA512
3fd88aec3ac47eff83230c17db028935ea51dab266a0547dd9c6c5d674fd29d729fdd9ee70f8863319b862406109be2d5f3adaf332f4949fd859c72d7f106561

Download Submit
C:\Windows\SysWOW64\Ldmlpbbj.exe

Filesize
96KB

MD5
48c6fe6357ae12e864d761517b9fb22e

SHA1
620ef5cea079fadb0cd69e243efc6b8a9a2675cf

SHA256
00341185cbde4f99134dd26fc55e433075fd932b4c1c243b6eda7539d293c509

SHA512
d3e2d844e8ec4774c5e09ac28da28d8b787b4358f68ed9f2215af02f2f014cf57f23a12147fe660c4e422c49bbbc96a50c4a993874e9dddd64fbccab5b6ebd2f

Download Submit
C:\Windows\SysWOW64\Lgbnmm32.exe

Filesize
96KB

MD5
eb9c04f41779f8c878ce6eac8a88bbed

SHA1
faae8607c0d8238bef2b61a4bf7c28629dbb9060

SHA256
45b5ffd5eb9c870800918a3396a218c0f86415c6ce28cdfbcdc4904163f43b25

SHA512
eac97e65d4e02ecd129034ec7b3928a3f12ffef8f27475fd7aa36367462c0d788a9db532ad1d5fca1d2e6aec129e55112c3eb6aa3c0d4b22a92d001ff069db88

Download Submit
C:\Windows\SysWOW64\Lgkhlnbn.exe

Filesize
96KB

MD5
8279f58ce86371b4b4a34dc8f01eb042

SHA1
6fd05c8a87766f21375f6cb3a77b65a2ff98045a

SHA256
42583013ecf8a97e370af98620aa71b2da81a2e0beeb740cecd2fb80b7fab3b6

SHA512
064776c4659fefa19214076b4cf3e9e115680f6f13c49cbeb2323d4c83ec8ad56fccbc26662ebcae6b400bdf58d9306d41a96466d7196f084e67fd8634932f34

Download Submit
C:\Windows\SysWOW64\Lijdhiaa.exe

Filesize
96KB

MD5
b99bbc9bab6b921437a49f5620f3840f

SHA1
162c3b689c99858c99971b0939879de1fca03793

SHA256
a47bf799047b6d3ac3986bdb2ee84bc10bf4e3ae5dabfc1317fca9b994734f8b

SHA512
880003746c9c4eeff0fb36fe93c5a28d2a8c6f0f41aa68070a9729c1bb6a1f8eaa36c20e6990970b869b45608360ebc188b0b9a045060fa9b8278a7cd1388914

Download Submit
C:\Windows\SysWOW64\Ljnnch32.exe

Filesize
96KB

MD5
8faa9bf7e4485fc7bb21b9466fc3325d

SHA1
7fb93e1a1679b97940329b11884ac6889ec6bb05

SHA256
0dddf565b93fc2aa618d8912ebc43fcd2f6bbbf9a777c9eab3281ddc13099c91

SHA512
8750cfdce9a917b47a38025e15fc54f8b4e785b07d0d06b0c4f37d56472c722e7fb9c51dea5ed4ce1d423240efd8cd17a44b1ca05d3f85889afb5d64c937ac4a

Download Submit
C:\Windows\SysWOW64\Lkdggmlj.exe

Filesize
96KB

MD5
55bc0a30e24734c88a6890a2f37c076d

SHA1
91115bd5f0aab639576f1b6be12a82a9c9242c9f

SHA256
4da59cb742438fb3fa87d65d0cba5f4fda468e927df1141b844d2bc90904a93a

SHA512
73888a0561b1f0017ff0644f7b39024f0752e295ea60369ccb39c58fc148c4bbf208824bcb11ae4d82f46119d1d0e9b53d971aaf616d40e398c6ed4356901c4c

Download Submit
C:\Windows\SysWOW64\Lkiqbl32.exe

Filesize
96KB

MD5
c3dbb8b947d94458f3462883bae53653

SHA1
95e73c033cc468007e8ead12b70fad8c348795fe

SHA256
816b87fd2c5e4fcd8f5833855cb626ec277f36a6e5ef8e5b061fd13c2eadeb4b

SHA512
0c7946fa94ff99aa2557ac7b747ca63922a3d82609fca9671567586002211b3af9e8ea1279ccd3c46fc4d05c0b853c1ca00c45c6ab4cc3f40dca210c666c3bb8

Download Submit
C:\Windows\SysWOW64\Lpappc32.exe

Filesize
96KB

MD5
28a54b0c352ddedbd526382488fce4e0

SHA1
2bbefd851b6936d14a9bda405368b50579b86b49

SHA256
f745fc770631bfa7baebcabd04a18c4bcdde2f72939c4233297e915332eac72f

SHA512
b9f1ba63d77f7e2c1e8c0a07b168eea37d2f6990ab7f710033bb9a16c7be62972ba3439c34acda350efc7e83c6d753d927b639eadd3290efbbb9a7780d73c51e

Download Submit
C:\Windows\SysWOW64\Lpcmec32.exe

Filesize
96KB

MD5
fd887fbe5988fb926fd1969aa59c3a7f

SHA1
9461df53da1a27d3c56b32d508a528338bc5dcae

SHA256
a876f47b8fd4acc23828326304fd5cdf49236946961581eedf4baaf799ae3ce4

SHA512
c7693ffe3cfaba581e17d3109c2796ccba5c7419a69d0b3c831ef017f6669b11875c2c64dd9a4d2efb51843d2b14166a8eccebb29205b2031e78511e1eca60e9

Download Submit
C:\Windows\SysWOW64\Lpfijcfl.exe

Filesize
96KB

MD5
de621e54f3352e61a500e6526a54bb95

SHA1
adaad1e83299fe66e2c1490c1878c8e55d369436

SHA256
0e9e57d32166bdede493836ef40f069db2f1c5ea65bfd0036df9a61baadff27e

SHA512
01896a026563083f3141cf28965e4f2a96ff16e1bde5613a5c42f9dd013585a8124e0b2135047e623870ea0150648e6d020e0469b92b26d0e26bc8be02d64477

Download Submit
C:\Windows\SysWOW64\Lphfpbdi.exe

Filesize
96KB

MD5
913fc7e933ad2247665a8c4148a636b5

SHA1
6bf9c7b17e3ea8db7707a8d44353bbb4af00cf0b

SHA256
09443df2aa17710337087de2c73437b6c74d867ff52533dc3c74fac282e9696c

SHA512
40f252e2960b01dc6e0b72b4d486d76bcaf7f291b289d121d66c95df562e1595e9f824aa1eb0feb39745a9eb07670a21f1a311c3970da067d96b362ad3d3c76b

Download Submit
C:\Windows\SysWOW64\Mdfofakp.exe

Filesize
96KB

MD5
5e7cdcc5c5e9cdaa9922f294daf32471

SHA1
1d4e2e7bf0c9d5bee90f8894b32bfed85657667d

SHA256
cc70788c46a590944c5f103f9ee267636cbd5426ce65167f5b9fd2d1618f1cc0

SHA512
5b0f5a847214e37f256acc8ae685a68bf761f816763b31c22abc2ebab5d1cf5b25379acb1ed409128d625fbb17d10ccc47e9d4abad68a0094ecca1aa9f629b69

Download Submit
C:\Windows\SysWOW64\Mdiklqhm.exe

Filesize
96KB

MD5
9d988b836db4dbb4f8c357bf5cebc149

SHA1
68d3b6ff509bb5680ef5b135b5ec24c7038769d4

SHA256
61238f00683b454ec2e327cbad1788e4105e0458fb2f5c62f4a5ea5fb7a981a5

SHA512
741802b64c3ba149161173a73ee48c0a3e44833d8d796df19ff78b4f763033cccad66c9034c2bc5ac52064704d5024b542844f46a85b5781c6713fbac1b18dae

Download Submit
C:\Windows\SysWOW64\Mgnnhk32.exe

Filesize
96KB

MD5
b7d28ed1292c7e606ac2d69722c473dd

SHA1
7cb5f1d2f65faa71d0702d57d2b17c7e3e335122

SHA256
55be26e42d07e01d507001df8ecfb8f8baad369d26f28f05142d066e332f522d

SHA512
beed6aa75690970484fc5e882a623cab45062580812fc097f89a782549a22f57b4e5b77e31235215c15708db160eb56ea7fb42f7d2dafd5c9dc043ec6049da80

Download Submit
C:\Windows\SysWOW64\Mkbchk32.exe

Filesize
96KB

MD5
875f5d0c2d4d9afb45c3642d8a15240c

SHA1
638a57f97929e7db4ccc97ef906d102fc0b6a3f8

SHA256
7d9ad88fd8af3c428e28e380fd96aaa8f34bac9074c479e8c99e2a032725c981

SHA512
277e114967eca1fd70dd1a2d56a89c6ce11d268fd9e365fbfe0073a77ff312865ef46480ec156dc74ac4dfa7d14cfccbed9e08b592652d15225d252329d06d29

Download Submit
C:\Windows\SysWOW64\Mkepnjng.exe

Filesize
96KB

MD5
659491a43520596fa9f5e85654b7f10a

SHA1
8453f18bc1b95e5230e63945a92a1b2a6d426202

SHA256
b0af0c4f84dea2f610a0617fd8558f19603682321979c6d6ae0fabcae5b08db2

SHA512
46d85fd91e5aa69fa8abd7b6d227ec8097074ca7931fc71d145445a9a255d8d71ab6fcdcd9220e3c0978986c62155389d56dc58544fb420ebc73f4970626474a

Download Submit
C:\Windows\SysWOW64\Mkgmcjld.exe

Filesize
96KB

MD5
77602beb49709bc90daa4860bf6b6491

SHA1
e58e8085ca21c6921c406f63ce4bc645b05f0e7b

SHA256
cf44e3f24f315c4c21363341657d35d7cc878b4853a0a3be23bca335b5f8df74

SHA512
0fe064230b291f9369fa6b221612cfca7c746c386188832dd789d2a55a95a05e6bf255d28046ba9d483acb385b5b4e10e00d2465e77634f6da53acd1906116c3

Download Submit
C:\Windows\SysWOW64\Mkpgck32.exe

Filesize
96KB

MD5
e6dab85e07df062eb245b2bc1c1df92d

SHA1
89bda3e296377fb741c47a731daa40af1015f9fa

SHA256
8ec107122fd5a80fd8f4b5feccbb02e6f3d62fac15ce10630f9b11a904d8a2ff

SHA512
fb563bdd5616a46dd1e5912e8bca4a8c89e5f8d1de7f2b0f50698104c6525750ff5865892caaefd3c98fe5ab6dca55d3e0beddb94f317da81e6c84dd5316bd11

Download Submit
C:\Windows\SysWOW64\Mmnldp32.exe

Filesize
96KB

MD5
7b2ffbb7ab39400cad42445521b93d56

SHA1
2c307c16d7f7e62344f5efa683d89ce46148a9da

SHA256
ba1c88b7c14974a30a71e0ab50ccf370bfc9403619bfad27764c9c43627b6d1c

SHA512
805f3fb3ad5f4c3bb9b75f271881bc3950f69b14dbcbff05047fc34c24eb89b15f0e325fdb4fb120266d74c9696589e146f72ada05cb45dd3cac4194397a5bd8

Download Submit
C:\Windows\SysWOW64\Mncmjfmk.exe

Filesize
96KB

MD5
a3bdeb655a9b72308445b137e3c783a2

SHA1
c64a2eee728b949d0a1ad33ecbdc59a20ed5b803

SHA256
b110faa82e1943eef7c350c456a21305bd5c5118ea5cf01c8b6bd40877d86a60

SHA512
48e0e92a24d4b90d3f2e034ca066366fd8c2c8a3af2eb360c4dd036b0d6bef7bc3666724d9a996fbcfed147fa2a3cd9309fc83f1ee053c431826e77b316e7452

Download Submit
C:\Windows\SysWOW64\Mnfipekh.exe

Filesize
96KB

MD5
09a76b23eaebeca770ca72a034ec5bbc

SHA1
64a16eed0af5fbbe6bf2ed1bc30ce1ed68a32703

SHA256
d283ba97158dde6163e95f3e754ce24dd6b46223412cb98af5fda1e96d9f7767

SHA512
010b84e542ab7e592ed308c8a9d579efcc8cb9e57254e58ead57b9066e00a2671277fe9358c5d7a2f1cca0354ed188c1ee17ad7e15238f5e8ee99954e65cd57b

Download Submit
C:\Windows\SysWOW64\Mnlfigcc.exe

Filesize
96KB

MD5
d6f16a5c9cbdfac4237dde49d2a88486

SHA1
d9304e86c491aabe5bbdc5e260f668f3357225b1

SHA256
f77078dc4fb6f0f870e0812e5cb2f6663300783310ccc39414cb951c17b15681

SHA512
c91cd82fea4fc46f799567cba01056cc491dff794c8a2cf2b3c4c95f73727757dcd01837ed0a2ae933417e3625c0231bb5d768ef593a8238e9a292161c4d0aa2

Download Submit
C:\Windows\SysWOW64\Mpaifalo.exe

Filesize
96KB

MD5
ff9dc7b4e51e9f5d39120073cf4c8f08

SHA1
1c6ae3f3864aaf17ec3c7971facf82de78256d21

SHA256
016643a4440dbfa436cb616e910e933ce18447946556c4b8acc6128332c7f436

SHA512
a6cb3250ce3406375656156a8f56cd225d31800ceeb72b51d0fc5c9f3cade454b5c3258f8274abe97897314deeda8a46558cc6cb0551817b3dfb62aab0de803a

Download Submit
C:\Windows\SysWOW64\Mpdelajl.exe

Filesize
96KB

MD5
9c5e1603f7707ab029e5b4c39a6bdbe4

SHA1
2c57c712d48253f2285d9b76cbd54067069c33af

SHA256
fc2cc7fef183bfa1756610eb7b579b1dfbb8332e9afe08b8bddbc320998fd206

SHA512
670e728fc49bb694a9ebe5b216f12ee7aa98d6b74f4fd8f1aac2dd40e12f96068113d8eb597f1f170acb991e0b6399f59f59f08db5c103ac8c374d2adb96089b

Download Submit
C:\Windows\SysWOW64\Mpolqa32.exe

Filesize
96KB

MD5
d33c0c199e51c65f0b43c13ccf8c2694

SHA1
3fdd83087d0b816e37612680dcd7b1d206ba7173

SHA256
28dd70a9f9c1a47127e626b9360ada7083aabaf7a23331569cb1fb45fa6830c1

SHA512
0698a77fe0f20e0b4efcae213588ffe2dee66b8d633e942155f6ebcbb0f4a8467757c02614004724771e6335e5717f5e9633bad89c6f425aed0587025872ac6a

Download Submit
C:\Windows\SysWOW64\Nafokcol.exe

Filesize
96KB

MD5
b5841c13634047e6ba0bd3c83f5b2cdf

SHA1
ebea73e8e86ac0d0e27de7c056adfb1784ae90fe

SHA256
5fa258da54b5d0ec74afbe6ff0ca3e50a08227e3ad97bfa557292d5d72e9cbb6

SHA512
bc31f0d0f2f1659e9eb3f0e91ba5cbb680ba0b7de9641e0602a776200d829a040c0d20110aa37199b77d7cbf3f73bfe410b947b5cbff18e31c09b50b0ac7e15f

Download Submit
C:\Windows\SysWOW64\Nbhkac32.exe

Filesize
96KB

MD5
9fe8c905abf08c7f2404b70e81a37b50

SHA1
e22ced3f50d9a6e41449dd0353f6f3943718e792

SHA256
ac30ec45ea1bc11278a457191e7829159031dce4362f1dbb5218c4c08d2bf36a

SHA512
6a8c86d412d98930885cc08b50ddd57149575e207d09eda12d311cd3fc702c2e9d6f06d409f033e5c57c652f5ba207dd9f305481ecbdf5325725584f1c21565d

Download Submit
C:\Windows\SysWOW64\Ncgkcl32.exe

Filesize
96KB

MD5
f5d591b57bcf7d87612a59fee26a4088

SHA1
98b7369ba27f3a778142e092c9d2aa7d51b718b0

SHA256
24ba63472095f98cf945ef21f5f0405c6283d50416d88a04a7effb8d4bf4c1ea

SHA512
032e81b1a116a82d2b2bfc51ef57689286474513aec9c693116855fa3a3b378fa55c85591d6b91108007740efee9885aecb1e7e6445e32ee1531fd3fe52a5934

Download Submit
C:\Windows\SysWOW64\Ngbpidjh.exe

Filesize
96KB

MD5
488d3ed617cbd9a4000ab2ef0b8385b9

SHA1
b16b57f0af21ec794d51ffdac01315bec7a6f691

SHA256
6af9ff09c0c2acad5c9cc905ae2394e21f660e36efb4a04d06fc762c7b78f4f9

SHA512
4239c6f23b03ae4631ec2c3ef5fd844c44a89fa4dac1df34273078ac0b6be2289a4bcb5e73fa1ed05b32bb0570df35761d1324baa2dcff1fcce1d36f72a34c8b

Download Submit
C:\Windows\SysWOW64\Ngcgcjnc.exe

Filesize
96KB

MD5
8537730139c2f5040a36818c35e185a5

SHA1
f4d3b10dc00a62564999a3fd69703fcdea26a778

SHA256
bb7a31aac2f3b649c00cce6c0f604276ec57fa1e7eb76e422f106125ae4e039f

SHA512
87bc125bc37acac3f4b54296cf513a140ab3e4c5a4920991ac82b7928616efc86ca89db97ff8492b6c8d87e7d32eeeb44e5ce6ffa5cdfca6a5555e4be2770c7a

Download Submit
C:\Windows\SysWOW64\Ngedij32.exe

Filesize
96KB

MD5
8e54936a2e9facf8e468f2d114c275ec

SHA1
f652425d1ede3ae2a56fbe2075b7c7812ef02e9d

SHA256
377484f11c8e0c77b0690bae8ddd98e66fefeb9d931cbdc328fba2ae349bf53b

SHA512
f2a3316e727f5e362bcf667a515cc762077dbc1c78cccc23387a52f440811beab3877cafeb6c36face99fd4bc9806b750133fd8008b9874172514a3a86561a57

Download Submit
C:\Windows\SysWOW64\Ngpccdlj.exe

Filesize
96KB

MD5
79d6017556eb9bf5be2b930baeedb339

SHA1
214316bfde662d9e0d77539416e5e0c1fd4b4417

SHA256
c4408d97bc5d2ec5404fd570b68011608db58d28124c50b5780a33909428e9c0

SHA512
bc928a4a34c6d7d729074415da13fff83008fbe63c50d893f9afc92d051e28635719d1bcf9295b4a981099a4a69f4d542679eb29fa488f6061bca324b9c4bae4

Download Submit
C:\Windows\SysWOW64\Ngpjnkpf.exe

Filesize
96KB

MD5
5674ff0a295046b4f1afb96f94d3c4ea

SHA1
81f0bdd518fb4a18f6dff5219198d9d89563481d

SHA256
3ec9fe4f287e94c6ae6ffcd13692cce6bcd539f1acc6d44ccecab5348c664bda

SHA512
a0a70c337ea85da976b4ff6301c26a179f26b24a360ea162050c8cb03504bd55412e7cb92411f913a525498bfb9126bf15b9e16ea93dcb03642516cb855fb059

Download Submit
C:\Windows\SysWOW64\Njljefql.exe

Filesize
96KB

MD5
2865d2924fab781eb01423ae3adfdc4b

SHA1
aa1ad188064f258b4d8d8a47aeb133d6960e8bf4

SHA256
6db49825527d8da8bb26cc6c7dfcbf5b49464b34111fa2adbd9186bbcaf79b73

SHA512
0c708975ad9720db2ed084f561e9d899890a83e63b2d0049e9550a71584ec16c55e9deedc52102f6a63da278ac59d835116428deac39e03662300ed0f594586c

Download Submit
C:\Windows\SysWOW64\Obdkma32.exe

Filesize
96KB

MD5
746a284a9cb29d2650813020e85bb856

SHA1
ecb57baeee7b3cdf6a8bba742fcf4e8f0aa6bbb2

SHA256
d578c92ee96a2e531f3268bb6ad25515c4f3ee7528742258b247773a11330422

SHA512
9f876e763aae796ec958e2dde91229e236e4dd54381061f145f8f2b4b3dc97b1f2c39f5b3de2c9d81a8e140b8ee30acbdf13bf9eaee86c0b683ba76dda4fd844

Download Submit
C:\Windows\SysWOW64\Ogifjcdp.exe

Filesize
96KB

MD5
b82966335259dea9289cf4b3f1dab4eb

SHA1
961acf013a8e95b3a8f6bf7513840debede81f57

SHA256
c6897c01ab3e87eff50c95c42a27926a6cd8092d2c07604f5d67e74f88fa9477

SHA512
821f52d2167755bd35f34837a3b708581e7346bc39da100a8c3e7ea43e6082aca745632ef636313a1dc160570c0da8e300f01c93910c3fdc4bb7dc110baf4e2e

Download Submit
C:\Windows\SysWOW64\Ognpebpj.exe

Filesize
96KB

MD5
5ca71d0f5f8339b867bfb25913db3d44

SHA1
72c857f032fc4f85c4462f2b88af8f63f23a4e75

SHA256
f8cb52e283dc9d37e0d76785c9e48c35f241d9bb893e39d7a54f967fdde23ea0

SHA512
c9dbb9ab61068a914872e896f271a677239135d6be1941262da10de3d3200945a3aabe0852a65de6a03e5473b00059c72482b8114e558aa6d0e0cbd037ffed71

Download Submit
C:\Windows\SysWOW64\Oneklm32.exe

Filesize
96KB

MD5
88d9ff7c8c1f5b1048fb06c0469ac203

SHA1
5153f43f039d284871251c837d085c641bcc32d1

SHA256
c8b92884bef4706a0be67c2e37e9c1243183f618c7e019bacda0a1b009523f13

SHA512
65c8894f9da07e0127dd7bd6cb065d814e2fd5359c4c88e26e05e34bc66211ae696a80bb10e0be42c7fcbb2a23f7959f313cfda630fa0d9a2f702484add4b042

Download Submit
C:\Windows\SysWOW64\Pbkamqmd.exe

Filesize
96KB

MD5
49d20c7ff9ab0edb684e11aa500c8f5f

SHA1
3137c1702519294ab03f4b0b1864afb232ad4bf0

SHA256
451a785f840fa8a99d9e4bebe16f2de781391869fc6fe54062a9178bbfb69cc3

SHA512
d51548a124cf76fa7822f46af656b6e96fdbb97e7c528cec0f387800104f00415c9560b409e8b36ae61b1d8f1ddf9fe61a2efd5acca9bfc9fcb8de839ec23c50

Download Submit
C:\Windows\SysWOW64\Pndohaqe.exe

Filesize
96KB

MD5
760f61a2e95a46560e65dc10dfc504b2

SHA1
ae49700bb7c336c5725aec9cdd5d88cfe4b6e2b3

SHA256
4fad196bf553d8ad2dabce1b67878c42754c438b8b0383fa705f4d3db665e42c

SHA512
2238903d9c83cca479ac980a34ae96c27e6b8ff95165e5fadea4b1b0677222da898ffe1023252a58c87c63a484377497ff0e9c8c4edd8a5dc960cae006719978

Download Submit
C:\Windows\SysWOW64\Pnlaml32.exe

Filesize
96KB

MD5
b7e62f654a942599487c54c2d867d5fc

SHA1
2dfdb5b8a64979e397b95f5abb387629bbcd9242

SHA256
87cd0d2467165c8b392a3f6d58bc36c9316dc240e176b27fa36737d49f4b760c

SHA512
d5f6d4b2ab7c5d158c40c67f961d68a08ac03365ffcc20ca8cee2256f5d91282dc3d34d26079058025b29743274acf948c9e1e2125408c41c962a1fd37bd5a83

Download Submit
C:\Windows\SysWOW64\Qgallfcq.exe

Filesize
64KB

MD5
58ed2be48d4e28a6505442292b419440

SHA1
c787cb680ec7fa65f4311d41ee1625446d8d7352

SHA256
7b4c6bf81d4f857848f52337ef18ec37b1460c1280cf317366a89b3b99560540

SHA512
a0a20243fe486a866d56e82d370e047923f9c6d15d0f98a808da9b9ee0dc30349cb661325e2f5dac885247533c84dd19a4a50df92f0b0c2be9253e9cc0d2a24e

Download Submit
memory/224-405-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/636-477-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/728-483-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/912-546-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/948-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/996-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1160-491-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1256-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1276-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1440-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1536-509-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1564-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1620-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1672-346-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1744-573-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1912-437-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1968-425-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2064-591-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2140-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2244-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2356-435-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2564-375-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2648-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2692-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2844-411-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2860-521-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2956-339-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2968-553-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3104-399-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3108-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3116-297-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3144-590-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3144-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3180-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3380-363-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3456-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3476-369-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3492-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3532-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3616-489-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3632-237-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3644-5-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/3644-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3644-539-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3708-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3744-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3776-540-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3884-45-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3884-583-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3924-566-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4000-459-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4032-594-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4052-253-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4056-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4108-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4156-585-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4180-515-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4224-389-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4232-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4236-77-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4296-466-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4304-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4316-552-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4316-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4348-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4352-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4372-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4392-593-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4392-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4444-503-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4560-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4584-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4624-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4652-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4656-216-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4724-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4744-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4748-286-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4756-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4776-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4776-559-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4796-527-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4804-467-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4808-572-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4808-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4852-357-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4896-449-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4904-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4932-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4960-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4968-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4972-560-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4980-443-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5032-533-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5064-29-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5076-501-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/9544-2849-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10476-2833-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10728-2823-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10860-2818-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10900-2817-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads