5485c599208ed5180b4c567c2a9b7f71fd0773be37c5ae6a42b69a5d29a19dcf

Analysis

max time kernel
137s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 09:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f91102f1380708c41e5859fe5cf3cc00_NeikiAnalytics.exe
Size

94KB
MD5

f91102f1380708c41e5859fe5cf3cc00
SHA1

267546a163454facde0f7a597dff01826b8225f5
SHA256

5485c599208ed5180b4c567c2a9b7f71fd0773be37c5ae6a42b69a5d29a19dcf
SHA512

504549ea7807f6888e140034cf4bb63afb3cbff804bdc1bfa76115e5c742c6f78174c3acb30fa93fe4f18be5ed40a40b7cd050b6d5249c7f9304fe843bb589cf
SSDEEP

1536:vgdmLwu2C0gFk8Ax63lfvomB0Clwnu+k5ZvAGawjh3FNAwLYZJe28Xmd+7BR9L45:ocLbpkpx6VfQmB0Clwnu+k5ZYGxtAwLg

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ehimanbq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afoeiklb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abngjnmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Doqpak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ehedfo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oneklm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oboaabga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Elgfgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkaejf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjdilcla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hiefcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Liddbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miifeq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjbndobo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eolpmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gcimkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Icplcpgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eleiam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqpego32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pbbgnpgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qnnanphk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhkapp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Imdgqfbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmbmibhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odbgim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckcgkldl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ifjodl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bgcknmop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imoneg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mipcob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmbfpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeklkchg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kfckahdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Llgjjnlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nckndeni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgefeajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgopffec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Docmgjhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qfcfml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fohoigfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmgfda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Npmagine.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqnaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ieolehop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Delnin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Doeiljfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecmeig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngpccdlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chghdqbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fljcmlfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eaklidoi.exe

Executes dropped EXE 64 IoCs

pid	Process
4000	Nqpego32.exe
4460	Ogjmdigk.exe
3284	Ojhiqefo.exe
1196	Oboaabga.exe
4268	Ocqnij32.exe
1912	Okhfjh32.exe
3792	Obangb32.exe
548	Odpjcm32.exe
932	Okjbpglo.exe
2304	Obdkma32.exe
1384	Odbgim32.exe
4072	Ogaceh32.exe
4940	Onklabip.exe
736	Oqihnn32.exe
1148	Ocgdji32.exe
444	Ojalgcnd.exe
4520	Oqkdcn32.exe
2376	Pgemphmn.exe
4644	Pjdilcla.exe
2384	Pqnaim32.exe
2544	Pclneicb.exe
4904	Pghieg32.exe
3076	Pbmncp32.exe
3820	Pcojkhap.exe
2664	Pjhbgb32.exe
1884	Pabkdmpi.exe
2484	Pengdk32.exe
5024	Pgmcqggf.exe
2060	Pjkombfj.exe
2284	Pbbgnpgl.exe
1484	Pgopffec.exe
3608	Pbddcoei.exe
3832	Qecppkdm.exe
2520	Qkmhlekj.exe
3884	Qjpiha32.exe
4816	Qbgqio32.exe
5048	Qajadlja.exe
3796	Qgciaf32.exe
1724	Qjbena32.exe
3904	Qnnanphk.exe
3612	Qalnjkgo.exe
3536	Acjjfggb.exe
1272	Agffge32.exe
3764	Anpncp32.exe
1392	Aanjpk32.exe
1232	Acmflf32.exe
4164	Ahhblemi.exe
3300	Ajfoiqll.exe
2524	Abngjnmo.exe
1244	Aaqgek32.exe
2256	Acocaf32.exe
3980	Alfkbc32.exe
1796	Ajiknpjj.exe
3420	Aacckjaf.exe
4432	Aeopki32.exe
4292	Ahmlgd32.exe
828	Angddopp.exe
1524	Aaepqjpd.exe
3236	Adcmmeog.exe
4536	Ahoimd32.exe
1820	Alkdnboj.exe
632	Aniajnnn.exe
2380	Bahmfj32.exe
468	Bdfibe32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mgcail32.dll	Cmqmma32.exe
File opened for modification	C:\Windows\SysWOW64\Pqnaim32.exe	Pjdilcla.exe
File opened for modification	C:\Windows\SysWOW64\Dhidjpqc.exe	Dekhneap.exe
File created	C:\Windows\SysWOW64\Igoedk32.dll	Eoolbinc.exe
File created	C:\Windows\SysWOW64\Hmenjlfh.dll	Hcmgfbhd.exe
File created	C:\Windows\SysWOW64\Oncmnnje.dll	Pnonbk32.exe
File opened for modification	C:\Windows\SysWOW64\Aeiofcji.exe	Aqncedbp.exe
File created	C:\Windows\SysWOW64\Bmbplc32.exe	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Djgjlelk.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Dmjocp32.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Deagdn32.exe	Dmjocp32.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Ocqnij32.exe	Oboaabga.exe
File created	C:\Windows\SysWOW64\Cbjoljdo.exe	Ckcgkldl.exe
File opened for modification	C:\Windows\SysWOW64\Dadeieea.exe	Doeiljfn.exe
File created	C:\Windows\SysWOW64\Ipnjab32.exe	Imoneg32.exe
File opened for modification	C:\Windows\SysWOW64\Qfcfml32.exe	Qdbiedpa.exe
File created	C:\Windows\SysWOW64\Abkobg32.dll	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Mkijij32.dll	Cmgjgcgo.exe
File opened for modification	C:\Windows\SysWOW64\Abngjnmo.exe	Ajfoiqll.exe
File opened for modification	C:\Windows\SysWOW64\Helfik32.exe	Hfifmnij.exe
File opened for modification	C:\Windows\SysWOW64\Oncofm32.exe	Ojgbfocc.exe
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Jlgbon32.dll	Kdgljmcd.exe
File opened for modification	C:\Windows\SysWOW64\Llgjjnlj.exe	Lenamdem.exe
File created	C:\Windows\SysWOW64\Qjkmdp32.dll	Nngokoej.exe
File created	C:\Windows\SysWOW64\Qjoankoi.exe	Qfcfml32.exe
File opened for modification	C:\Windows\SysWOW64\Ajanck32.exe	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Diphbb32.dll	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Debheb32.dll	Aanjpk32.exe
File created	C:\Windows\SysWOW64\Ehedfo32.exe	Eefhjc32.exe
File created	C:\Windows\SysWOW64\Acbmpm32.dll	Eekaebcm.exe
File created	C:\Windows\SysWOW64\Lpcqcc32.dll	Hflcbngh.exe
File created	C:\Windows\SysWOW64\Ippohl32.dll	Jianff32.exe
File opened for modification	C:\Windows\SysWOW64\Ngmgne32.exe	Ndokbi32.exe
File created	C:\Windows\SysWOW64\Ehaaclak.dll	Pdkcde32.exe
File created	C:\Windows\SysWOW64\Njkdbljm.dll	Ecmeig32.exe
File opened for modification	C:\Windows\SysWOW64\Fohoigfh.exe	Fljcmlfd.exe
File created	C:\Windows\SysWOW64\Pjhlml32.exe	Pgioqq32.exe
File created	C:\Windows\SysWOW64\Ifoihl32.dll	Pqbdjfln.exe
File created	C:\Windows\SysWOW64\Ndhkdnkh.dll	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Gifhkeje.dll	Daconoae.exe
File created	C:\Windows\SysWOW64\Bpflfc32.dll	Anpncp32.exe
File created	C:\Windows\SysWOW64\Cdiooblp.exe	Cbgbgj32.exe
File opened for modification	C:\Windows\SysWOW64\Ehedfo32.exe	Eefhjc32.exe
File created	C:\Windows\SysWOW64\Gnchkk32.dll	Iemppiab.exe
File opened for modification	C:\Windows\SysWOW64\Pgopffec.exe	Pbbgnpgl.exe
File opened for modification	C:\Windows\SysWOW64\Bnlnon32.exe	Blmacb32.exe
File opened for modification	C:\Windows\SysWOW64\Bhikcb32.exe	Bejogg32.exe
File opened for modification	C:\Windows\SysWOW64\Fakdpb32.exe	Fomhdg32.exe
File opened for modification	C:\Windows\SysWOW64\Hbbdholl.exe	Hcpclbfa.exe
File opened for modification	C:\Windows\SysWOW64\Kepelfam.exe	Kfmepi32.exe
File created	C:\Windows\SysWOW64\Bhhdil32.exe	Beihma32.exe
File created	C:\Windows\SysWOW64\Eeijge32.dll	Angddopp.exe
File opened for modification	C:\Windows\SysWOW64\Clkndpag.exe	Cddecc32.exe
File created	C:\Windows\SysWOW64\Ehimanbq.exe	Eekaebcm.exe
File created	C:\Windows\SysWOW64\Cagobalc.exe	Cnicfe32.exe
File opened for modification	C:\Windows\SysWOW64\Djgjlelk.exe	Dhhnpjmh.exe
File created	C:\Windows\SysWOW64\Oammoc32.dll	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Lcjakp32.dll	Ahhblemi.exe
File created	C:\Windows\SysWOW64\Ecaobgnf.dll	Mipcob32.exe
File created	C:\Windows\SysWOW64\Fibbmq32.dll	Ngbpidjh.exe
File created	C:\Windows\SysWOW64\Ajckij32.exe	Ageolo32.exe
File opened for modification	C:\Windows\SysWOW64\Anogiicl.exe	Ajckij32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9996	10892	WerFault.exe	541

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gcojed32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ildkgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ipbdmaah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiknll32.dll"	Fdegandp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Foabofnn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ahhblemi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chmeobkq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcdgbkil.dll"	Lenamdem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mmpijp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjkmdp32.dll"	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Npmagine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ehedfo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pgmcqggf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbfmkjoa.dll"	Gfgjgo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hcmgfbhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Choehhlk.dll"	Hecmijim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hoiafcic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngmgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laqpgflj.dll"	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pjhbgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daolnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcnopdeh.dll"	Fhgjblfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Defbnajo.dll"	Glebhjlg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oncofm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cbjoljdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eoaihhlp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eadopc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cajolcjk.dll"	Eadopc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jmhale32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcdmai32.dll"	Odapnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ojhiqefo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cehkhecb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ipdqba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeanii32.dll"	Jlkagbej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kdgljmcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajfoiqll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiglalpk.dll"	Aaepqjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Clbceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hbeqmoji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qajadlja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgifdn32.dll"	Chghdqbf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fohoigfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nngndc32.dll"	Gbiaapdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnjgghdi.dll"	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echmafdm.dll"	Odpjcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jinpgcmg.dll"	Daolnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flnakb32.dll"	Eaklidoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmhnkg32.dll"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Onklabip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bhkhibmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fobdihjo.dll"	Clbceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dlgmpogj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adecfl32.dll"	Icifbang.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfadpi32.dll"	Iifokh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gokdeeec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lpqiemge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cagobalc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhpjkojk.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 4000	1236	f91102f1380708c41e5859fe5cf3cc00_NeikiAnalytics.exe	83
PID 1236 wrote to memory of 4000	1236	f91102f1380708c41e5859fe5cf3cc00_NeikiAnalytics.exe	83
PID 1236 wrote to memory of 4000	1236	f91102f1380708c41e5859fe5cf3cc00_NeikiAnalytics.exe	83
PID 4000 wrote to memory of 4460	4000	Nqpego32.exe	84
PID 4000 wrote to memory of 4460	4000	Nqpego32.exe	84
PID 4000 wrote to memory of 4460	4000	Nqpego32.exe	84
PID 4460 wrote to memory of 3284	4460	Ogjmdigk.exe	85
PID 4460 wrote to memory of 3284	4460	Ogjmdigk.exe	85
PID 4460 wrote to memory of 3284	4460	Ogjmdigk.exe	85
PID 3284 wrote to memory of 1196	3284	Ojhiqefo.exe	86
PID 3284 wrote to memory of 1196	3284	Ojhiqefo.exe	86
PID 3284 wrote to memory of 1196	3284	Ojhiqefo.exe	86
PID 1196 wrote to memory of 4268	1196	Oboaabga.exe	87
PID 1196 wrote to memory of 4268	1196	Oboaabga.exe	87
PID 1196 wrote to memory of 4268	1196	Oboaabga.exe	87
PID 4268 wrote to memory of 1912	4268	Ocqnij32.exe	88
PID 4268 wrote to memory of 1912	4268	Ocqnij32.exe	88
PID 4268 wrote to memory of 1912	4268	Ocqnij32.exe	88
PID 1912 wrote to memory of 3792	1912	Okhfjh32.exe	89
PID 1912 wrote to memory of 3792	1912	Okhfjh32.exe	89
PID 1912 wrote to memory of 3792	1912	Okhfjh32.exe	89
PID 3792 wrote to memory of 548	3792	Obangb32.exe	90
PID 3792 wrote to memory of 548	3792	Obangb32.exe	90
PID 3792 wrote to memory of 548	3792	Obangb32.exe	90
PID 548 wrote to memory of 932	548	Odpjcm32.exe	91
PID 548 wrote to memory of 932	548	Odpjcm32.exe	91
PID 548 wrote to memory of 932	548	Odpjcm32.exe	91
PID 932 wrote to memory of 2304	932	Okjbpglo.exe	92
PID 932 wrote to memory of 2304	932	Okjbpglo.exe	92
PID 932 wrote to memory of 2304	932	Okjbpglo.exe	92
PID 2304 wrote to memory of 1384	2304	Obdkma32.exe	93
PID 2304 wrote to memory of 1384	2304	Obdkma32.exe	93
PID 2304 wrote to memory of 1384	2304	Obdkma32.exe	93
PID 1384 wrote to memory of 4072	1384	Odbgim32.exe	94
PID 1384 wrote to memory of 4072	1384	Odbgim32.exe	94
PID 1384 wrote to memory of 4072	1384	Odbgim32.exe	94
PID 4072 wrote to memory of 4940	4072	Ogaceh32.exe	96
PID 4072 wrote to memory of 4940	4072	Ogaceh32.exe	96
PID 4072 wrote to memory of 4940	4072	Ogaceh32.exe	96
PID 4940 wrote to memory of 736	4940	Onklabip.exe	97
PID 4940 wrote to memory of 736	4940	Onklabip.exe	97
PID 4940 wrote to memory of 736	4940	Onklabip.exe	97
PID 736 wrote to memory of 1148	736	Oqihnn32.exe	98
PID 736 wrote to memory of 1148	736	Oqihnn32.exe	98
PID 736 wrote to memory of 1148	736	Oqihnn32.exe	98
PID 1148 wrote to memory of 444	1148	Ocgdji32.exe	99
PID 1148 wrote to memory of 444	1148	Ocgdji32.exe	99
PID 1148 wrote to memory of 444	1148	Ocgdji32.exe	99
PID 444 wrote to memory of 4520	444	Ojalgcnd.exe	100
PID 444 wrote to memory of 4520	444	Ojalgcnd.exe	100
PID 444 wrote to memory of 4520	444	Ojalgcnd.exe	100
PID 4520 wrote to memory of 2376	4520	Oqkdcn32.exe	101
PID 4520 wrote to memory of 2376	4520	Oqkdcn32.exe	101
PID 4520 wrote to memory of 2376	4520	Oqkdcn32.exe	101
PID 2376 wrote to memory of 4644	2376	Pgemphmn.exe	103
PID 2376 wrote to memory of 4644	2376	Pgemphmn.exe	103
PID 2376 wrote to memory of 4644	2376	Pgemphmn.exe	103
PID 4644 wrote to memory of 2384	4644	Pjdilcla.exe	104
PID 4644 wrote to memory of 2384	4644	Pjdilcla.exe	104
PID 4644 wrote to memory of 2384	4644	Pjdilcla.exe	104
PID 2384 wrote to memory of 2544	2384	Pqnaim32.exe	105
PID 2384 wrote to memory of 2544	2384	Pqnaim32.exe	105
PID 2384 wrote to memory of 2544	2384	Pqnaim32.exe	105
PID 2544 wrote to memory of 4904	2544	Pclneicb.exe	106

C:\Users\Admin\AppData\Local\Temp\f91102f1380708c41e5859fe5cf3cc00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\f91102f1380708c41e5859fe5cf3cc00_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\SysWOW64\Nqpego32.exe
  C:\Windows\system32\Nqpego32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\SysWOW64\Ogjmdigk.exe
    C:\Windows\system32\Ogjmdigk.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\SysWOW64\Ojhiqefo.exe
      C:\Windows\system32\Ojhiqefo.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3284
    - - C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1196
      - C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1912
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3792
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:932
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1384
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:736
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1148
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:444
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2544
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        23⤵
        Executes dropped EXE
        
        PID:4904
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        24⤵
        Executes dropped EXE
        
        PID:3076
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        25⤵
        Executes dropped EXE
        
        PID:3820
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2664
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        27⤵
        Executes dropped EXE
        
        PID:1884
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        28⤵
        Executes dropped EXE
        
        PID:2484
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5024
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        30⤵
        Executes dropped EXE
        
        PID:2060
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2284
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1484
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        33⤵
        Executes dropped EXE
        
        PID:3608
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        34⤵
        Executes dropped EXE
        
        PID:3832
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        35⤵
        Executes dropped EXE
        
        PID:2520
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        36⤵
        Executes dropped EXE
        
        PID:3884
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        37⤵
        Executes dropped EXE
        
        PID:4816
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5048
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        39⤵
        Executes dropped EXE
        
        PID:3796
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        40⤵
        Executes dropped EXE
        
        PID:1724
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3904
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        42⤵
        Executes dropped EXE
        
        PID:3612
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        43⤵
        Executes dropped EXE
        
        PID:3536
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        44⤵
        Executes dropped EXE
        
        PID:1272
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3764
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1392
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        47⤵
        Executes dropped EXE
        
        PID:1232
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4164
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3300
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2524
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        51⤵
        Executes dropped EXE
        
        PID:1244
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        52⤵
        Executes dropped EXE
        
        PID:2256
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        53⤵
        Executes dropped EXE
        
        PID:3980
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        54⤵
        Executes dropped EXE
        
        PID:1796
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        55⤵
        Executes dropped EXE
        
        PID:3420
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        56⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        57⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:828
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1524
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        60⤵
        Executes dropped EXE
        
        PID:3236
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        61⤵
        Executes dropped EXE
        
        PID:4536
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        62⤵
        Executes dropped EXE
        
        PID:1820
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        63⤵
        Executes dropped EXE
        
        PID:632
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        64⤵
        Executes dropped EXE
        
        PID:2380
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        65⤵
        Executes dropped EXE
        
        PID:468
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        66⤵
        Drops file in System32 directory
        
        PID:4348
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        67⤵
        
        PID:856
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        68⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        69⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:804
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        71⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        72⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        73⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        74⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        75⤵
        Drops file in System32 directory
        
        PID:4200
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        76⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        77⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        78⤵
        Modifies registry class
        
        PID:4028
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        79⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        80⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        81⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        82⤵
        Modifies registry class
        
        PID:2496
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        83⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        84⤵
        Drops file in System32 directory
        
        PID:2192
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        85⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        86⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        87⤵
        
        PID:8
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        88⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        89⤵
        Drops file in System32 directory
        
        PID:5176
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        90⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5272
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        92⤵
        Modifies registry class
        
        PID:5320
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        93⤵
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        95⤵
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5496
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        97⤵
        Modifies registry class
        
        PID:5536
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        98⤵
        Drops file in System32 directory
        
        PID:5584
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        99⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        100⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5708
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        102⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        103⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5856
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        105⤵
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5944
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        107⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        108⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        109⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        110⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        111⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        112⤵
        Modifies registry class
        
        PID:5196
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        113⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        114⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        115⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        116⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        117⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5720
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4972
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        120⤵
        Drops file in System32 directory
        
        PID:5876
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5952
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        122⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        123⤵
        Drops file in System32 directory
        
        PID:6108
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        124⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        125⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        126⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        127⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        128⤵
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        130⤵
        Drops file in System32 directory
        
        PID:5164
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5472
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5764
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        133⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        134⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        135⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5576
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        137⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        138⤵
        Modifies registry class
        
        PID:5700
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        139⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        140⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6240
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6280
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        143⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        144⤵
        Modifies registry class
        
        PID:6368
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        145⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        146⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        147⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        148⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        149⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        150⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        151⤵
        Drops file in System32 directory
        
        PID:6672
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        152⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        153⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        154⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        155⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        156⤵
        Modifies registry class
        
        PID:6888
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        157⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        158⤵
        Modifies registry class
        
        PID:6980
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        159⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        160⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        161⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        162⤵
        Modifies registry class
        
        PID:7160
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        163⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        164⤵
        Modifies registry class
        
        PID:6252
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        165⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        166⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        167⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        168⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        169⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        170⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        171⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        172⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        173⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        174⤵
        Modifies registry class
        
        PID:6944
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        175⤵
        Modifies registry class
        
        PID:7008
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        176⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        177⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6224
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6292
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        180⤵
        Modifies registry class
        
        PID:6452
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6552
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        182⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        183⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        184⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        185⤵
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        186⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        187⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        188⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        189⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6592
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        190⤵
        Drops file in System32 directory
        
        PID:6908
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        191⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        192⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        193⤵
        Drops file in System32 directory
        
        PID:6664
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        194⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        195⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        196⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        197⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        198⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        199⤵
        Modifies registry class
        
        PID:6248
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        200⤵
        Modifies registry class
        
        PID:7208
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        201⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        202⤵
        Modifies registry class
        
        PID:7288
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        203⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        204⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        205⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        206⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        207⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        208⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        209⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        210⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7672
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        212⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        213⤵
        Modifies registry class
        
        PID:7768
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        214⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        215⤵
        Modifies registry class
        
        PID:7852
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        216⤵
        Modifies registry class
        
        PID:7892
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        217⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7984
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        219⤵
        Drops file in System32 directory
        
        PID:8028
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8068
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        221⤵
        Modifies registry class
        
        PID:8112
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        222⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7172
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        224⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        225⤵
        Modifies registry class
        
        PID:7376
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7436
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        227⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        228⤵
        Modifies registry class
        
        PID:7612
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        229⤵
        Modifies registry class
        
        PID:7680
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        230⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        231⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        232⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        233⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        234⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        235⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        236⤵
        Drops file in System32 directory
        
        PID:8144
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        237⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        238⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        239⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        240⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        241⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        242⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        243⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        244⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        245⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        246⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        247⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        248⤵
        Drops file in System32 directory
        
        PID:7788
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        249⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        250⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        251⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        252⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        253⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        254⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        255⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        256⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        257⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        258⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5964
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        260⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        261⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7828
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7216
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        263⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        264⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8100
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        266⤵
        Modifies registry class
        
        PID:8212
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        267⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        268⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8300
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8344
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        270⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        271⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8476
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        273⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        274⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        275⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        276⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8688
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        278⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        279⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        280⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        281⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        282⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        283⤵
        Modifies registry class
        
        PID:8932
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        284⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        285⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9060
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        287⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        288⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9196
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        290⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        291⤵
        Drops file in System32 directory
        
        PID:8288
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        292⤵
        Modifies registry class
        
        PID:8364
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        293⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8420
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8492
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        295⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        296⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        297⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        298⤵
        Drops file in System32 directory
        
        PID:8760
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        299⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        300⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        301⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        302⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9108
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9180
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        305⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        306⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        307⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        308⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        309⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        310⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        311⤵
        Drops file in System32 directory
        
        PID:9168
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        312⤵
        Modifies registry class
        
        PID:8352
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        313⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        314⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        315⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8680
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        317⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        318⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        319⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        320⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        321⤵
        Modifies registry class
        
        PID:9188
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        322⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        323⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        324⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        325⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        326⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        327⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9512
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        329⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        330⤵
        Drops file in System32 directory
        
        PID:9608
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        331⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        332⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        333⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        334⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        335⤵
        Drops file in System32 directory
        
        PID:9856
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        336⤵
        Drops file in System32 directory
        
        PID:9896
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9936
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        338⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        339⤵
        Drops file in System32 directory
        
        PID:10036
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        340⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10120
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        342⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        343⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        344⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        345⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        346⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9492
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        348⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        349⤵
        Drops file in System32 directory
        
        PID:9640
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9720
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        351⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        352⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        353⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9948
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        355⤵
        Drops file in System32 directory
        
        PID:10004
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        356⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        357⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        358⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        359⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        360⤵
        Drops file in System32 directory
        
        PID:9448
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        361⤵
        Drops file in System32 directory
        
        PID:9524
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        362⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        363⤵
        Drops file in System32 directory
        
        PID:7396
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9840
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        365⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        366⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        367⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        368⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        369⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10220
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        370⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        371⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        372⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        373⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        374⤵
        Modifies registry class
        
        PID:10184
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        375⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9480
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        377⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        378⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        379⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        380⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        381⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        382⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        383⤵
        Drops file in System32 directory
        
        PID:9288
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        384⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        385⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        386⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        387⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        388⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        389⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        390⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10524
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        392⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        393⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        394⤵
        Modifies registry class
        
        PID:10640
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        395⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        396⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        397⤵
        Drops file in System32 directory
        
        PID:10772
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        398⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        399⤵
        Drops file in System32 directory
        
        PID:10852
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10900
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        401⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10988
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11032
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        404⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        405⤵
        Drops file in System32 directory
        
        PID:11116
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        406⤵
        Modifies registry class
        
        PID:11160
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        407⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11244
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        409⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10308
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        411⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        412⤵
        Drops file in System32 directory
        
        PID:10428
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        413⤵
        Modifies registry class
        
        PID:10520
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        414⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        415⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        416⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10784
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10844
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        419⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        420⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        421⤵
        Drops file in System32 directory
        
        PID:9704
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        422⤵
        Drops file in System32 directory
        
        PID:11028
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        423⤵
        Modifies registry class
        
        PID:11104
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        424⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        425⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        426⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        427⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        428⤵
        Modifies registry class
        
        PID:10552
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        429⤵
        Drops file in System32 directory
        
        PID:10680
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        430⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        431⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        432⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9624
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        434⤵
        Modifies registry class
        
        PID:11156
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        435⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        436⤵
        Drops file in System32 directory
        
        PID:10420
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        437⤵
        Drops file in System32 directory
        
        PID:10624
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        438⤵
        Modifies registry class
        
        PID:10836
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        439⤵
        Drops file in System32 directory
        
        PID:10956
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        440⤵
        Drops file in System32 directory
        
        PID:9664
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        441⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        442⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10288
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        444⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        445⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10892 -s 424
        446⤵
        Program crash
        
        PID:9996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 10892 -ip 10892
1⤵
PID:11172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
94KB

MD5
f58903c5caa7f7b3d40faa39b1d7d182

SHA1
56ffb1c12f5bfe032cf0a8a41597c061a744d3b7

SHA256
13180d73d265d898fbfd99896ef4452c5428d528d1e95d9c3cd58bccf495fc0a

SHA512
8f60d339641bde948a3e9badf4a4c7caa90c707255d3423b5b20bc7c5f5c13dde0726f12af32e4c367f3864917fca04bcd1d13a924eedd2e5f218fd36e7880e1

Download Submit
C:\Windows\SysWOW64\Beglgani.exe

Filesize
94KB

MD5
ffd770979ceda046adf581a4fbb0c51a

SHA1
b5ef3ad7d5222b94add36d18d64f477693e07195

SHA256
6e8dc590b80cf9791692258808fc6dab2536a6610008c30a76d2f7c16d6121e5

SHA512
fb6186702b0a0316d57b8f795a7dcb30081fd4095723f5f986d0402ba10f762bbe2b61ed7023d02ec1880c515dda51bb7a5d0b4c78b5b803cb1ffdb9a8984ce3

Download Submit
C:\Windows\SysWOW64\Belebq32.exe

Filesize
94KB

MD5
0d4236b78bc2f097984916c140073fe3

SHA1
4dbc99e0fe024c905303eaa9790043bc6f886540

SHA256
a392c2fe7ca825785f111360a6f0c46947b6b562d344d8bd5402b833a887b5ff

SHA512
5bc9b4457f6c72da46e7930f93491e0b9e56deb056cca6d3bd4fad5d44ed0df104ab110945320ce301fad6d90f9175172cce1be737ce9e94d41609d96f1ed348

Download Submit
C:\Windows\SysWOW64\Bhhdil32.exe

Filesize
94KB

MD5
355eae2dfce5c50df4f2b4a7f2a37649

SHA1
f141fa31ac017d18d32e9423d2953ab2e42be29b

SHA256
f16a5d807fd0386b7faa9bb45899835875af6564e4f2a39f6c8ac667430823f4

SHA512
bae1d525357bd389411e1be8e7b49999390485876cbcb97da9c62e53f30b829460b935b1cf633b7cfb634e8c0936960c69caca9356de5dcf3d16d8dfef65fcaa

Download Submit
C:\Windows\SysWOW64\Bhkhibmc.exe

Filesize
94KB

MD5
b9219dcb625f669a88d842127827a17b

SHA1
c2b237fce343d5a3bb345658a3e0b49c4df7cb14

SHA256
2df116720f32eebde692a98fe460d7a26db2ea0e2e7acb941f00ab67c4695d3f

SHA512
8d39a046d39e7798d56073c3a5effa626ce20082e2848d46c17529b3eb71ec0ecdf4bf14f32ecfb58efc12d86e219d68c29b10acbfd03a08357386ae2c9631af

Download Submit
C:\Windows\SysWOW64\Cbgbgj32.exe

Filesize
94KB

MD5
032d207fa515edb20cac08b160c0025f

SHA1
6d6452e75179a6ee77caaa77a1c3db35f9557f64

SHA256
829bec58cdaf8f6c21069a5787be04f505e2bc52edcbc1d557c9763d0a4230fb

SHA512
1be213c9241c1b738694e7ab4ab848bcee35ed68ee377a5bfe1e15680c744b8d9cadc9836b331f15f88e119b4256b58a6f0827b80fa58355f66c5ff3caa67f5a

Download Submit
C:\Windows\SysWOW64\Cbjoljdo.exe

Filesize
94KB

MD5
917ae193b5b567018a5628230504fe52

SHA1
bf097958df4ee992be069f3005e42c1c177c9507

SHA256
5f1bc0c7afbdd07528b3a39a760686f0ef6596ea32b6e5d715e0f9a2cf4e6535

SHA512
837fd82923c1859d198e91c4c02bcb81c3474340321325c83f0025c565e49aac90ac5048da4b450abb4adc18487447783ca757c1329492577d04072785a36c3e

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
94KB

MD5
0386d59ced2b851fbe66db67a32e4004

SHA1
bf04d7f86a18fe799b80614d07244a6812037351

SHA256
3d660f88ea2eb8d64dff55bfcdc9be7165b6f7b6f64cd2578df17d9b601e12cc

SHA512
43af59b89cee3f9aff8340cf1980dd2aea040be39ac2885054cb34117e7f4d15dd861f07cb28b210c19d0e75b190cb17e17bf2b56ba8b3f0a496de2130569ad7

Download Submit
C:\Windows\SysWOW64\Cnkplejl.exe

Filesize
94KB

MD5
3d48c585f2a478953dfeb1716a265fbb

SHA1
d331e64c4d20249e770d72dfb95feff3f2f0ded3

SHA256
f5312694a657697d1c476cd4c1f1ea0070a63bc6a2004bbc559618664673aaa0

SHA512
fe53d0e533d1984fbd4366e4b4139762a960fb287cbcf540c59c29e5a0408036800f7ae38dd5b96756b409775e333a3f6dee6b093bab45e34e924cc87f3da6c3

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
94KB

MD5
9535889ed9b846cf5c65f6c7f4488774

SHA1
586b19590fc739f53f39ff57b53e2fcb3a21c58b

SHA256
3f0b1157f2739e286fea2d812023a5cef0adba17fe26d717f32b58eff727b8b6

SHA512
6d77afe372c8a1a13a0223163c2dfa7a4517052de2382eb3213ba67139757536bcb745810b8e7e3df08e169d905078b1f8dfceb5b2d8f53614552543eec0798a

Download Submit
C:\Windows\SysWOW64\Ddakjkqi.exe

Filesize
94KB

MD5
f76f01d4322fdf82e70c6d9dc7ff45b2

SHA1
0b8be4f1b8729e0295b8026be231c1ac4d857b2f

SHA256
bad413c9f50ce4b24a8286fa90ef982e955ad20152d89ef7822e3615b8178971

SHA512
170f3ec802ece1dbe58c73d7e3ba625d10cba8a6baa08b0b6890e5abf159896fa737d98e878e4d98ecd0e7d6845b84f0afd141998fc540b9088ff8c3db16c3d2

Download Submit
C:\Windows\SysWOW64\Ffddka32.exe

Filesize
94KB

MD5
98abe05feee526e587fe98b0527b8f6d

SHA1
3ce7414b5a8e08a855db61a1651a35e7346e2355

SHA256
49267c8c23b75db95f888d8b4756b95af53f1cf558f07eb51e0777884455e118

SHA512
c8a5db204a1d881a8e14dd465597926e74ca802f007164be646a1a11e2f8d5946ab37dbf815c24e619880946252967d9b30fd1fe8538aa980ad2fdfd235bd14c

Download Submit
C:\Windows\SysWOW64\Fomhdg32.exe

Filesize
94KB

MD5
2c8a8783db9764363058d305db48bacd

SHA1
b7e258d84c5eade1f5a175f2b414cfcc3e3b94ab

SHA256
85872dac34a5289ae440365ffaea48422a102cf871615a34b34c205a871f45e7

SHA512
e696156665780d317cbc283617543d22f8765df592148a050fd3c0444647b65d3cbd260488af24ec3b6f6e9dcee9d48777f8dbbda5909447197ac810f49b411c

Download Submit
C:\Windows\SysWOW64\Gbiaapdf.exe

Filesize
94KB

MD5
ff59f32c2bb22a7ff5839fe9f412136a

SHA1
abdffe258c6fa984e78535a74f3d57c2947e2c77

SHA256
582974b2fe1b4057021b4f36ee5ef3d26e1ca24b628d3cd9f1c5c20d4986490e

SHA512
c6870fef8870fcb23ff1754da577158a186b038244030694a2425af1e99ddd10bdaae4b7a65fc9baa1cdfacbe0ee082b246b7828b6ad60ff4fd26b8740b7526d

Download Submit
C:\Windows\SysWOW64\Gdcdbl32.exe

Filesize
94KB

MD5
b6e010d2189ed9566dd21e96eb263b71

SHA1
547a58889cc3fd08a227660993fb31a8d925f569

SHA256
81567d73ccb79e4877cf2313ec22f07bcf5f0a0a0cdcf18f870b47dd4ff3d1c6

SHA512
ac501f279e3f279290651bc949c928f379012edcf37de7713008ea9982d6ef327197ada257d973d792046f247039f8fcc0aab7624a790c0461433c83829dcd84

Download Submit
C:\Windows\SysWOW64\Ghaliknf.exe

Filesize
94KB

MD5
3bf3ca3bc7c537fdbc4fd1c99c3bb20c

SHA1
01e9ba5bae4a001eddba6b6d77cd8e8e173c03dd

SHA256
a8bfc2909b28157a5e0eb843c78dcfef6c886772eb59615fa41703777bbe1645

SHA512
0ea284379265fba4cc389923806ad030b61cae263ff8137fcfcfec1baf66292d567dcea5d0fc9b08ba1e4750e2ab2639285b75a1446a972c976c4ee9be8c63a8

Download Submit
C:\Windows\SysWOW64\Gkaejf32.exe

Filesize
94KB

MD5
93f8b6ecb9b902ce0a3d591bd07af279

SHA1
f326bad61b07bba0e4d1097b2ac3f14fd8f56528

SHA256
029cf4b4055bfe4ac2bf5db9232ebc859ae68a701b8099c8132a1f0f5808cc0f

SHA512
e7d16e9d7975ad4fbd688384bfcf6540c4eb310962dc7930a746a88c110da9c98e5b345638de22c724e7427957b58a78ad16b0ef5c20adcfcd515704ad03823d

Download Submit
C:\Windows\SysWOW64\Hbbdholl.exe

Filesize
94KB

MD5
73dce990707846215b453fd06e7d72c2

SHA1
1bcd78bc2e23f4e6f8c916950dde354548539409

SHA256
bb41a01bf75a8d9eeac4d4951dd22c8b180ae6d8859f1f374fe7700a0cf3f201

SHA512
0d7dbcb81188bd7831f71ea3c888f0fad2712cd898366e63a2d279de0a2c0fbb9a280378a644c54154c29c78eb7a864f03b2b9b761b8e1cc2ad144e7c1b39bf3

Download Submit
C:\Windows\SysWOW64\Ifclaeem.dll

Filesize
7KB

MD5
c45ce438e73d9d4fec8aa841cdce6d24

SHA1
71fc2011bf48d68260abd4bb4a4e0fb738e05ade

SHA256
c0a5e587168c181aef91f8537b59e6fc1ff9895d6ac512dee484b15ee17adb62

SHA512
2dfa5cb6f5caf65daa501d7efefe20e56dda41d5a29b076f85d5670c30113f6df93047f17bea40cc28f6fee409e617cc5633d1d55fc7aa6e58fa7d1b0df46578

Download Submit
C:\Windows\SysWOW64\Imoneg32.exe

Filesize
94KB

MD5
27cc1338c4df8b77cdeddd802028f4fb

SHA1
e6277dc3aa8bdd8298e5cff85aa21735476e080a

SHA256
0a2d5a0549f12853c9e7650d8cf3bef9db1978da511af1e1f5bdd6828ca791d3

SHA512
f1326548e3d03adf5a7a9078e79aeb8dd5d1a9bc31d769c0e8577ed9e7d79c754c409acdd623b1103c3b71f651e5a8d48b58f43de3d2989b75abafe8f4f35892

Download Submit
C:\Windows\SysWOW64\Ipknlb32.exe

Filesize
94KB

MD5
9b4445d17b06ca4f17d6c376377211a7

SHA1
5457f27aea5637c0846e5430d6840d3b1c0d37ef

SHA256
e83faf7905f913827d4a68179dc35ed3f13428b2e822c01920a7924bbf4bd656

SHA512
0e902bf45a314fdb662e0d6228c4c4d602253b5c453817652e8d4d6ffa63128a2287d9eda398fa16662956bff70b8505e8b46b38bf595d02f4b2396d48fef481

Download Submit
C:\Windows\SysWOW64\Jcgbco32.exe

Filesize
94KB

MD5
2ddc96cfa934308acd011e302512e1d7

SHA1
3037abc5247b4ca437d66e45e45a9b9002dbda3a

SHA256
5a7f2cd8e78c321d45943f7777cca4542845313e2773b5ee1912835937863948

SHA512
ff12f4f395a77337e17ac72c7c451d67c53e22ab21370643f04ed753f4370ce717230ad16aa63397c3e1df14c68fea1fc1cf9b99f3a467722106831f4457cc69

Download Submit
C:\Windows\SysWOW64\Jcllonma.exe

Filesize
94KB

MD5
82e27d653b3320cb743d17a802d3e4c9

SHA1
2265f06577a3761ab1c4a7b190d3a4389f965ef4

SHA256
f2e72cc619c0e833dd58e709853d87c830040b9b71477ebddc1a1def779407b0

SHA512
4711ff0b5ba78ea58eda84bd2a1737280f4149419114439bf9718973507ea25ad1c2e74ca236a54e6ae0949469a79f3e45ca02b6d135e53c00aa7ce64369cba3

Download Submit
C:\Windows\SysWOW64\Jfeopj32.exe

Filesize
64KB

MD5
a818a5cc8d6b89bb93df6041cd4be4e9

SHA1
d56f69799864127e90423b5e25281e36e61f65e2

SHA256
ca8243ccaac4bee5ccf901b4fc568b2d93c078f24c2c749bea52d870df339520

SHA512
73742608f80bc0d4d6e88ce233ba4e64ed6cb28546951bb3ae92b8d5b5328283a4e7ce12992cff3892abfe54b17a702cb1ac81bcc4d492951f1e3fbcd258177f

Download Submit
C:\Windows\SysWOW64\Jioaqfcc.exe

Filesize
94KB

MD5
61327b6f811740922236433c4e479e86

SHA1
228619f680cd9f3a683bd5de3cfcbb712bdbee2a

SHA256
e000dfec2168b0e518cb13cb389c915394b20c00c59ce2bd2dccff3e630bdd40

SHA512
9ccedee751564ff95654ec85372e95fb46917a79e6a97df07fd805518a6e4828cf7995b278f3047ba0c1146c8b23e0dd530d0ae0e295b3c7392bdcc9a0a98da1

Download Submit
C:\Windows\SysWOW64\Jmbdbd32.exe

Filesize
94KB

MD5
7120e0d1e9726ad75b5b8f6699f9c34d

SHA1
4874ef6f103b7fcb298cf269c2dd8b00dab4eb24

SHA256
09a24a6816d95bbce8b2cb6c7ad48a93aae502f7a2a475b11983119355a5e437

SHA512
910aaa09d5d3e1de8585cf2dd276a0f70cd309f9922b86ae7b11cebc399d9030d6f0cf2116e2a63ff58378f0aafb6ef388e270c4b8545636230cd23e54a3b384

Download Submit
C:\Windows\SysWOW64\Kdgljmcd.exe

Filesize
94KB

MD5
4093f85e3bffcbd2c7dd27fca7afba7d

SHA1
6da36be18d113d06e5791d4ade0cefd258ae4bd4

SHA256
7193a26dd911cac073846becb9d6649124a1d69eaafff1b2e2cb811c56f6a493

SHA512
d05828e78dfed4216eea814525e664d2188eea3a1dd24355004b690671ad2734777eb77b057ccb14f0c9de7a357ab31418529743a6cfc2e9f8f052d9e1c62fe1

Download Submit
C:\Windows\SysWOW64\Kfmepi32.exe

Filesize
94KB

MD5
119bd789eaf8893f965aad66c30571ff

SHA1
184ab1253bd210e283a46c27c8394291bbeae8a4

SHA256
479f3971532a9250a5125fc069dfc9b588dea3b822e330f816d75a640159d932

SHA512
3f8c31834aa506fc747216bfde73ca865b01a85d9b1c40841a12948a02c9497835b75d297fcf84d88999b1414542cb75ddd1c6b172de98042dd7cdeade49ee29

Download Submit
C:\Windows\SysWOW64\Kpbmco32.exe

Filesize
94KB

MD5
db2b49ee112498de53b8f8519a0e1514

SHA1
67735f7aa04620ad467bac58b2059c21a71f63a8

SHA256
6b44bca2d4734ef47b5626157689704f5de0b9bc563614526a530891c13c8b4f

SHA512
4592d34149b696a8a0dc4c38a1742023f40172705560b53bda375eb7250608e03d0e40476f6b170bae7305ab36c27f9717e76d490332134682eca09bc3b42091

Download Submit
C:\Windows\SysWOW64\Ldanqkki.exe

Filesize
94KB

MD5
0cdf48ec0290a3a2d6263060e3493c3d

SHA1
d885a61cba50be5a4ea9efa52738a06838aa3bd3

SHA256
76b0aeb9ca434915b2c424184903d0907ba7a8d491123606ddaf87a09e5a52f9

SHA512
cf7c8df0d741a9078764e12b1c74d77fe3aef24e70b825c7a05c688763f443bd3d1ba7dca27f8a23f0e83825ee80ab38d3b0e992038ca442e55bbcb40b4463c8

Download Submit
C:\Windows\SysWOW64\Ldoaklml.exe

Filesize
94KB

MD5
2bb464fc5d356cca5393e55693f8c2e6

SHA1
aaed80c614568d451bc97b44b632c86b42dc2111

SHA256
616676e8365d8291536dfd24c4b7e6ea47283de35f5dc879be308787d8584e7d

SHA512
36aff010c966c908a3b4163a3e42371600d2781d71b2b0836e13f740ea3d2f273f02a50e694b144c938e653e553d9d02d763d7e0b39d9ff91f7bff7c74a12186

Download Submit
C:\Windows\SysWOW64\Lenamdem.exe

Filesize
94KB

MD5
edd706cbc4e893c0ae6df99ed0f0c332

SHA1
de202158c987e46f77a5072c14ca9b036ca08a57

SHA256
70b36daacba26502af649b1142d2226c6eaaca00bcb43aac5e431e51e61a0c29

SHA512
4c307d76c6cebab9130675191ea8e9bf2deb53c3015a7744ff7b96cc506a38ddadceb9fc08aa7334b13a3448b28b4af7e4fa907a63e94499a244cba3d8c7e622

Download Submit
C:\Windows\SysWOW64\Liddbc32.exe

Filesize
94KB

MD5
cd7b9e93462f87a891bd78f5248c5311

SHA1
6d071e6b662dc2d5957a414cb2bbdfb2aea0331b

SHA256
c76f2a3137511f323a9c03705611ddada64a41822ce1f1ae7d1c28c460605ab4

SHA512
3ca3813d99a560a4a9450d6b21264cbe670ef2e2c1cc1a8d753d0f5154325218b588e22393d3141d9c60eb457e334b821e7bbdf95644ed55b13c44b7e69d0c14

Download Submit
C:\Windows\SysWOW64\Lllcen32.exe

Filesize
94KB

MD5
acc1810fd0c10198b536f1e97319af53

SHA1
29f4bbf2a7a88f5f5e19d7f9fcdbdc28ae042f54

SHA256
1b86a9d14221532ca3107d590ac4561fac8b3324ccd900487d2dd588ad89d87d

SHA512
fd0dd2a0d232a44575252848f5edc6092af8dba9e5512fed8d2a3bdf1471cbcd5e9ee9e5942b46a863694d2889f3826a681d68a6a2f28cd27d83590a0d4da6d7

Download Submit
C:\Windows\SysWOW64\Mdhdajea.exe

Filesize
94KB

MD5
6ba7576c1271efe02814e70c3b888750

SHA1
1901fe7792344a5b6f7677b80c34c08927959ae4

SHA256
91dbc3aa6e35bf5766621fc8fee1f0c07524547a8e81ad3fa1a5cf2b0c508ffc

SHA512
c854309f4c71a3a6ea6b1a025d9466c5fe0d6397c94d690ea9f7f359975f07e50fe4a3b75f2b1adad5920664fdd015f3c3d155d368e4d5315e21d2d1dd5bab23

Download Submit
C:\Windows\SysWOW64\Miifeq32.exe

Filesize
94KB

MD5
60efb945957fd735fda2347bea92bf8f

SHA1
d7e8425c14171339ce9f91db3197aea18aaabc7a

SHA256
c2e457a9ca1603d2624a1e38244de59612e584f07399e92c56bbc46b6b720adc

SHA512
56e4f2aca3abaaab7a5504b97e7d918d1ae9922cb990d08659dd6ba8962453274695fa74a0d3302e4b796ec1a54f75e5ad2db4c44616746d62c71e4f7e677096

Download Submit
C:\Windows\SysWOW64\Mpoefk32.exe

Filesize
94KB

MD5
468fa13d7f29290e351aee600057669d

SHA1
02b23a206739cba31b761521cb3525a4dbe03e42

SHA256
6139e71e5e9d5c7cfc04be411abdf266b1e341174ce09f7e254f1acc1d17f0ab

SHA512
2cb4a1dfb9a8f57058460bc77effe83f036a0c1b7d4d770236718412137b5f1fef77782fbc9f33564f650421aef9dc92b11ba32745efeb8a86991a7388b14244

Download Submit
C:\Windows\SysWOW64\Ncianepl.exe

Filesize
94KB

MD5
a8649b68c897bbca4cc349c46d8dfaa0

SHA1
70d565b5ac9c6e660d6e72d4aa3ec9bd064ac97d

SHA256
a01ba5ce275608665ac32a7dcda1bf5259d21a9967a8cc42463d507e45deeae5

SHA512
0b6f9eeac49bce8ad187c9330f76334ed1cad2051e6683ecf53bde74c3458f4d4ff43b7e875b84bb93418dc45bac6a9f1977c0e3da9982f015f12da085fd2f59

Download Submit
C:\Windows\SysWOW64\Njnpppkn.exe

Filesize
94KB

MD5
ffec436d86e0183d194a97e2876e80d3

SHA1
146b50b71409fac61db3526c22dc215a8f202662

SHA256
3d58f02dec5fea9b6cc5942091d94834303d4dfb1808c96bca112f0001799c51

SHA512
67906e8a2e55140eb4da8e9f3677a8415d6e74f3a860723b11ec8d2e66c247f57f7c7dcc22506c8422bfa1a633762d43a1f3c7072a574c704b57b7a2455a9cdb

Download Submit
C:\Windows\SysWOW64\Nnlhfn32.exe

Filesize
94KB

MD5
aa36bfb909ec4f6a25d13509d5efc0da

SHA1
5d12211e5ef9b22242c0c10471142d39cf1e806c

SHA256
65ee0d17b9573a14f7216a24d1feedeafc2eef63ba7e2e54c17fd7f6e54382f7

SHA512
e772f7b5a4bca06776ec87df1c9945bf6132cbe6671949c6520a247dcd61475d459dd4249f3ae06756d23ac7c7d2f9f2bb4ec4ad8c663c56aecf0bf240ded88c

Download Submit
C:\Windows\SysWOW64\Nqpego32.exe

Filesize
94KB

MD5
06b1190328f4e25c6bd218bc0f575460

SHA1
dc71428fa6a18064596bc40ab30ea6942c04d28c

SHA256
6aac0b183ff0f556308074fa2e6151a6f153ed0c90c8a079931e1b9f176dd1ce

SHA512
8db1110861b04930930058b954794b21892f28961b46149e256d67a344f68ab6c63b5760103cc9ad23ea9d2d30d45b1e3c0b19023c87276a000bacd24287b2f3

Download Submit
C:\Windows\SysWOW64\Obangb32.exe

Filesize
94KB

MD5
3a07f7f93ff85f29b67c52a12323c68d

SHA1
635dc5ef564086c192ff734dbfdf5485a7c8fd42

SHA256
4b396577154f854b684382f0d9081222a013be617793a77692caab52ae4606f5

SHA512
8e89cb5055f25ab25743b6a30bcd367805d0a13602c456622a6895e996e0fb13c8b10b9c50ea21376382cdfe12530fa1e6c7b6dfd95256b9fbcda76163ee0823

Download Submit
C:\Windows\SysWOW64\Obdkma32.exe

Filesize
94KB

MD5
c76cfb30b00b713587def2c48ba3364b

SHA1
53dfd02e57a2ad7d5475f313ab0b4e418bfbf803

SHA256
2b91a78ca18000c925d2c4737d06d97fc4c2bbf0a776af8b2ad3424ec9be085f

SHA512
b6935897c56f48d4b56c054c018fd6ba4aaaa4b3e8d43d42e677fd1d7ce07047a8dcc4cb7934dc98d6da0ab4664bdc2f9015ab5e97ac64a53ae6eb9cf14358d6

Download Submit
C:\Windows\SysWOW64\Oboaabga.exe

Filesize
94KB

MD5
f2e04275432da5d68bdb6a6cb8e4475b

SHA1
9c74ebebc00322d1fef3fc1cd20cc05e8a493686

SHA256
f30d1a1ac34b2f92cd654dd90551f16158445aa58433df73c5f3d34aa8713b23

SHA512
47b72a7593cc481452bda272d08c0665384123b6ea95e7b3acc3bd06436d920ef743c1905b27a9bb908738dc5e03a4c74fa7144bb58b666502db6b4767677324

Download Submit
C:\Windows\SysWOW64\Ocgdji32.exe

Filesize
94KB

MD5
6f3ea0b21c83c26e7841b9db3833e4c9

SHA1
81f531e8fd11969e1f5db7c375ba9fe73c7fd5a0

SHA256
4437f821d925e41c781dc5ec083e7c3d14cc933c27562fec8e7d753f8685a9f2

SHA512
ab373a32e0c5672bacf5d72397ec1367b1dae917a39a6f73b30523ed2831c1b8b7b36980213513f2b4fe982dd95613e50adb5caa9279f69aa3498a967ed487aa

Download Submit
C:\Windows\SysWOW64\Ocqnij32.exe

Filesize
94KB

MD5
175c0319d0342f1075489a119e2789a8

SHA1
9ca064844e13f269164e2efde35cf52ee6465055

SHA256
99e49b028c45c4d12c434a550f6264438cf5ee1b8f4845472f05b9c3e6546474

SHA512
4c48aaa6ac7ea73a367d3558f4c8279b86c74627ae27c2e62ac26eb7350c905ca3efc881f021a5a213bd5e31fcab7efc7521893c023aca79e27e2660fbfa21a5

Download Submit
C:\Windows\SysWOW64\Odbgim32.exe

Filesize
94KB

MD5
5d283f8b3560d4c22dd2e450dd298ace

SHA1
516b9382ec5a087cf93bd721d07081a8c66f0740

SHA256
5e4e85397200970b8d21b5e4c08e5d9795659d6ce2f5fdf4d47c7a46f739efa8

SHA512
f50ee972c824c2763ad3a2c4d2937da28b7993f1f5ab4a2fa001cceff5da69d0cb27822abce6562cdee9985581c8b8b78f592a8ed4809ae60659732c860fe1a6

Download Submit
C:\Windows\SysWOW64\Odpjcm32.exe

Filesize
94KB

MD5
90f5e76224c8d1e5f7f31734e7baf722

SHA1
4ebc2cf2e019c05f71dfbbd5b9f5839214716121

SHA256
b2b2b3ff29f64b3754ab94621a6e94095010f3799f0ffde01d28dc33a3716def

SHA512
3388b47194c9ba7c974753f1d7a7c4ab0da29c161b99aef03831429ee3385a3999230d0e5c8f1d8f36420ab13ac3577dd1223135126d22f56d88bfe602b45031

Download Submit
C:\Windows\SysWOW64\Ofcmfodb.exe

Filesize
94KB

MD5
257aff10b1b39eca35287aca23535413

SHA1
2ad319953b4ec8099f88878cecbcb7a9b805b77f

SHA256
a29286000f9d40a4489f682855f099bdd57649f9c7c7bcef904599d34d038f74

SHA512
9f034eb71a0fc5df02689bab58d9e2798fd8a6ae14be357e087be5e87b3dbc3f53c25a18c72d7512e68645c7d43535dbd43e375751ea891ed2095022a1ead263

Download Submit
C:\Windows\SysWOW64\Ogaceh32.exe

Filesize
94KB

MD5
2ae1e1895fb1bcc1de83062d1f92071f

SHA1
4a2015185dc1ea64101f9ac4006a6cbeeaaf2132

SHA256
622f9d0cd23796b524e486b0bc06bae634b23ac6fba8a3c1353ee1db8689087d

SHA512
6abd7b719d3d10110a2feded7be38bacdba288e495aa0144524c4a0e21e84726006cdeb16c70e993be52ba59758fe15ffcfaa6b10b64e7027f7a12966da0083c

Download Submit
C:\Windows\SysWOW64\Ogjmdigk.exe

Filesize
94KB

MD5
9a86bc1d387f8a53d40315e60867f960

SHA1
767cabede5a39835d489d80df4203ec670898fd2

SHA256
c474e19ff87f47ddedc10a750fd16ccb7ce7599877675393aa2bddf0e9499495

SHA512
6c8bfa43c5aa0217ee770b9676af90c98c92b529eb3555d45733efde0ecd768d82cbe8ecf514fdbbc2b3f26ec21976ded8a55b8dd0bcbc4258bf43b2a51e1a7a

Download Submit
C:\Windows\SysWOW64\Ojalgcnd.exe

Filesize
94KB

MD5
90b372c5fe6de4869911082970c95d45

SHA1
2deeff4121961a9aaec8115a62c96505a7e70760

SHA256
20ddb3d4842ad7bd3499e0bb98a7753c4380ee146536c68402797185748ea4a8

SHA512
6b0912dec593a98dd5a60a7f0b081e46288bfb64ed49b32f423e31b03456cfac9feaa54809238d9490e7ff02319956055f078fa02b51f6145c311e7a57cfdcd0

Download Submit
C:\Windows\SysWOW64\Ojhiqefo.exe

Filesize
94KB

MD5
849d5a336882ee20c06c3b94859a08b2

SHA1
63bbec83dde7603ccb1b10d82a1d34a768eda105

SHA256
7f4138c5a1926e765f107f97144616903594743bce3c1bc02dc8abcaaeca45e9

SHA512
2988cf2a63d72d54212291dcdd149872a8a00a0af709ef652910cb39807a278d449fc16425bbad00d4065c940e6bc4bcdf168f123ee51a4b1c105deff8e6cd75

Download Submit
C:\Windows\SysWOW64\Okhfjh32.exe

Filesize
94KB

MD5
e45980e2547495acdc32c9087f946472

SHA1
35f9245f97c51cd0646400322dbef5bc369066f1

SHA256
7c034087e237847bf282eb7f20ad179b3084a560cfb5507113401cb9f6799be3

SHA512
8f2d9c6c68fe523d50db2d3a4314a8bb7e124376523d3928c36005e89894a2fab72c2061c49cded69d5e0e9534256b48cc8138f11e9cabdd54154388852b5b64

Download Submit
C:\Windows\SysWOW64\Okjbpglo.exe

Filesize
94KB

MD5
493e6f080f04509439ab2327cc64e96c

SHA1
a6dcf63a377041c22ea0a8e85c1b352a6c80117e

SHA256
73be99cc5011ac295a7dfb751835248458993d2f38cf4d80461ae4be43f8c72d

SHA512
4b4f3514db600a738d4c9fc4ec4501d8dfc27b2750f18c2c54c7bd7aa9ef7aa739d4832655b6d2028f9c6bf193e3e1e9677c7ece4b52bf5340a7599d990d6ed3

Download Submit
C:\Windows\SysWOW64\Onklabip.exe

Filesize
94KB

MD5
5f473864c381116cb11eb1f3df40322e

SHA1
ab9e6a179b1e1a327893dcd187ffc99f516985ea

SHA256
7bf182a89475733d0918e14d27c0e5e2ce42221a0bb22f9e3360a89fe517f5bb

SHA512
d08e412fe66b6c4662c176d65c61fc64971ca9da322ca63139f3e03e2c2ca419926907454b8d2158c01b7987a5bff6eaa0d62968b0aed8024e4ee53d5e315ef9

Download Submit
C:\Windows\SysWOW64\Oqihnn32.exe

Filesize
94KB

MD5
c9df4c4ae6b5721d8829b62cb754bfce

SHA1
ceb510792e5dce6fb607978c70e3bc0338f57377

SHA256
655e9492076d9f54db885337ad48ad70428d05ac062091e601bd69020be63d7a

SHA512
e9e2aba2fabd93d20cd591e22feb6d865bd61df2307088f1c2d93c434101848a2c0914a34fe5ff2bfe408ef90a1a2b011c4645286853e6223ababc049d54c1f4

Download Submit
C:\Windows\SysWOW64\Oqkdcn32.exe

Filesize
94KB

MD5
4e98b22ba8b9d60492912e20c493d356

SHA1
dedea82634ffdb52a84ddebdcb2e9ac1f39b62c7

SHA256
404c40f2881b3b0b3e6f3f87b150661d88b8ec68fc695c7f8a5441303940f963

SHA512
d29a36caa9bdf2b6e87076f7037c70fa4de0266133d2f55e53ed09a1e82373429c8d5bb60141dd6bea4816d21a16214022cbb992abd86d81f9621c8a61c56674

Download Submit
C:\Windows\SysWOW64\Pabkdmpi.exe

Filesize
94KB

MD5
0b3beb2473cdd3c2bb1352b09dbc1832

SHA1
b4f1acb7fbf10759f56325e60706875b9c59000e

SHA256
120c2e889278c08ae9887df0f03da35cd2341b43471bbc933dabf6cce4ae586b

SHA512
746f22f6b0d0e812e903d835de9adc32e949c2fd87e9d8c4a8f28d624fe1c6af0d3122e2808aa3a9d907544be46c2c9294714b1285c04840fa1ca38cede709c0

Download Submit
C:\Windows\SysWOW64\Pbbgnpgl.exe

Filesize
94KB

MD5
c2db05ba6a29195e6d1b66824c09c239

SHA1
5efff5e45ffe6762c9e1017322b43ffcd2323fed

SHA256
83174c2693fcad0876d9213885216585bf6c3873ab31445d6d3d385e5d4af2f0

SHA512
e8f2e951b7c04f5de29b6322b93d933d84b2e3885ccffde990be5b619346651a4a80ef0004b9c7e5071eb373ef5857c9784f63c14506f18f229d2a434cf34da9

Download Submit
C:\Windows\SysWOW64\Pbddcoei.exe

Filesize
94KB

MD5
6b74f3028fc59fee77e97c49512344b2

SHA1
bf760016b0b5a3bc4a03b54ed780f6f5ad257bba

SHA256
22dedc898eb1c430bfe7a662ace22009446a93fa69fa72e90f9e782e9e9ebc26

SHA512
af6a6aa8f84100c75df1a60171b445d4a70817c6924806d13de3fbbf21d063cb2cba3de216ad6a9c0345dfa3d5aa599554a7837716bac3cf7794f96fc8047dad

Download Submit
C:\Windows\SysWOW64\Pbmncp32.exe

Filesize
94KB

MD5
5d35ca0b062b59f960482bec0d0d0dad

SHA1
8d56e94b8301c3a9905fa3bd11fc0f9af1f51d9c

SHA256
fdd657a12e89ee0cd33934ac0fa1159d9d52fe61f7dc7f72cb86d899d7c09f66

SHA512
0d2e184df247936f9d0ab9f7e83f1ad3ed18ecdcfe06667d55faf2f80c22a6543ed2ab59a022964efda986c613593c4f43b7cfd410003894d8c43108c676f8ed

Download Submit
C:\Windows\SysWOW64\Pclneicb.exe

Filesize
94KB

MD5
6a80665783e389efdf353b8c278550cf

SHA1
c3e1ea2507af0e0813df95e3fa2db6d577164478

SHA256
a663e9113d7ce57d1c4c0c6731a70f3f80fc839bb4d786483a4bed22e237afab

SHA512
1f5215e648c384dbf3ed21142abe9baf679ab33f3305af334a589a3503ecda4960a68674af3bb20364beedca2b1b7d3be160279d324b2756cec0e28aa7d15468

Download Submit
C:\Windows\SysWOW64\Pcojkhap.exe

Filesize
94KB

MD5
c198392a7791eb07b66076bbec55a186

SHA1
3a36d9bd01568986a441a83ae7f9a2a6ef0a5753

SHA256
5b95054cc32b23ca3c8bbe6611d9eb0577613f451f8c131297c5c0ac20f5b634

SHA512
322c8033bc1517baf9a1c0cb0f60c5ad92bcb94eb29ce7d003fb2ea113a8cbfaea91a45f485c9f36c3416cc2c51a0904a37dfa3f8aa87b8e83b1c834bc871d04

Download Submit
C:\Windows\SysWOW64\Pengdk32.exe

Filesize
94KB

MD5
90b6ea81f1aa5c879ebd9db120052911

SHA1
dc8854ccc173ed8d86e8526426acd2b121ce0a5c

SHA256
e3afa4dca461dee040ba3b186d370119a75ab3e92ead7b1bd9e55977ed177e90

SHA512
efb1d6a571b9d98e96d34dd9c98c70fb024e920cb7fb811cb96c73b9a09f1b0c924df7de15d03cb4651d990a7adcc246ddd93afd90d8b33eb1f5e533175c8163

Download Submit
C:\Windows\SysWOW64\Pgemphmn.exe

Filesize
94KB

MD5
2f03ddef88d192f6735625b2b7442745

SHA1
6c63bef9a7545c1f3f7ad32d377b2c5b2e5a611a

SHA256
fe1b38415b231c450e11acc88a3470a033419e64e420244351a9a2b06d654f8e

SHA512
9e75d56fde9022a19514cc7e1d4700336a0808bc41629e8ebe5645506067836c5bba942a6789e2fb6edb49811896038f9a420648600cc613e8827add53b332ea

Download Submit
C:\Windows\SysWOW64\Pghieg32.exe

Filesize
94KB

MD5
fa687f9a38c050a8b7a8393dc520053b

SHA1
a929cf0e4b65ee56e30312bbe852a1ee8eab8946

SHA256
226eb7c1d326e30a5fa99f335ea613677684233b3d78b356600ff1d7ec3b7713

SHA512
80a61c839f03842e0885a2b8632be9c33861050d5080b8c0cae20214af91c0e1f7e48078f19d304987ff9fad280b1d35971a2395b5add64d1ea52f10422dc094

Download Submit
C:\Windows\SysWOW64\Pgmcqggf.exe

Filesize
94KB

MD5
06a4bacf4caf22d25c312de41508479b

SHA1
3890b96e9c44fcf9099f3c39ad3d486f56640c71

SHA256
2410a62307825e2bca9b15f2142f6d7515559b2328aff21ea8ce40ebeda6d1ab

SHA512
3c8e2af97bc0990e3dd821feb1ac195aba7f3a48e659b530cf5effc91a5111458fac27ae74c3c75d3853e473e330218588f729ece0ae80a375a9895037333377

Download Submit
C:\Windows\SysWOW64\Pgopffec.exe

Filesize
94KB

MD5
5ff0854b2cb395e943af68dfaa0eea6c

SHA1
0e0d6ad834ef0a842a259e8799d99c9f1195ffc8

SHA256
25d997e9de579b1859d374e0bd8a65318eaba5e99964324e2c1279d9fe5cc663

SHA512
0fb944cdc68d3cca617e8db562e22ce414149c9ec351d496d36b028a826309af4c35eb498e9429ed30ea2e9af149672112c4c6ff44c7843df6e192fc6f742a72

Download Submit
C:\Windows\SysWOW64\Pjdilcla.exe

Filesize
94KB

MD5
6301fd992994bc6a38cb19df9892f28f

SHA1
7065fb8e388d09c72b57b4bd9b2204719619b565

SHA256
c8e1f6786de09d79a26d6eb095bb925e932bf1a585723bd29ac55f4b30616066

SHA512
61fa627397a5a949a9dec155ddcdda11a5212603f528c59ad02f33a6243cbf21cbf59244e75f7651ac14ebe4f00c1f3f0e0807a5cd57a4a46b4719493a4c5be3

Download Submit
C:\Windows\SysWOW64\Pjhbgb32.exe

Filesize
94KB

MD5
5cd4fff970b4f83bc0342455609385d1

SHA1
8454cdca4ef681fc2c462d78c87d3d5e0d4f2037

SHA256
41e9cd6cd2a8f06e2ab000378b997f71d5e3db9e90afce822f4fc2b99bfe2ec5

SHA512
dcc4383305b488d87d4876ef3c10f8646e91837a16d6c79e9126c47070f1f97785a2d04ef58fa6d34e398b9cef75ecefe5e91a1fe7fcbb0b6dd31f6463187597

Download Submit
C:\Windows\SysWOW64\Pjkombfj.exe

Filesize
94KB

MD5
b41959635a67314a8e3471d684062b55

SHA1
336f64e767bd03ed2ddaec9077666addf2253eea

SHA256
d6cc1c80991aea41f640adfbe46bce752ed678938627538c03c9f6b7d73b1210

SHA512
c6c84ccdb36ef244182d3e10384f6ee0253ebb2d6dcebf3e8b56b3caadaa044ba949a121da05d446976a5bdab002bf43d50045613ada4d403ff805cf7288b188

Download Submit
C:\Windows\SysWOW64\Pnakhkol.exe

Filesize
94KB

MD5
04a5112252c3bd56178ed0912d490fc7

SHA1
df27b062e1b47b35826ebd8c0b250a2b3d65d7d3

SHA256
b2b445a9bfc4bd7f70653298e4a59cf8063bbb2c9c86d923e71a752f50544f6b

SHA512
99c10bbc89aec647bc939d6347cdb85d73dda2e188bf7df0b1f6bcf3b68a58a6f61de804398636430c3c3b683844f1fe1b23d1ca196f51394e3af3cf3f561728

Download Submit
C:\Windows\SysWOW64\Pqnaim32.exe

Filesize
94KB

MD5
2792ce75cbb42d7e2cd6be5933830ed8

SHA1
be1517e5f6190d98764aa9bec167790046650424

SHA256
441cb620d8fcc94b09b6c474ebef33e7a6e4b258aa7cce0c0107aef056ae21a9

SHA512
8e6af5a2b919479dbb207c4701c9064166e8ddaa363f06299ffaf1759c397de0079f00357c7d1d20a47a4e890ebe33ba4e600d3db1897a6ef76d7e02a5211a26

Download Submit
C:\Windows\SysWOW64\Qnnanphk.exe

Filesize
94KB

MD5
ee067439f3742156200a05aada5311ca

SHA1
6918414e369beb32fdd259e9a022dd81335d9a55

SHA256
58d6a0b8129ae1baa9c0917f9bc417430e0d39cd5ba818ec0c643180638fbaac

SHA512
c58fb63f84d00b091baea96a04cc2a53b23e86e0ed3452886cef763e030841da9af87088d6a24f109769506a3941de6b9fbb6e4705c2e396288639db5c5e33dd

Download Submit
memory/8-590-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/444-127-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/468-448-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/548-599-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/548-64-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/632-438-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/736-112-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/804-478-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/828-406-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/856-462-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/932-72-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1148-119-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1152-502-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1196-572-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1196-31-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1232-340-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1236-544-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1236-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1244-368-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1260-472-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1272-322-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1356-470-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1376-542-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1384-87-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1392-334-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1484-247-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1524-412-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1724-298-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1796-382-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1820-430-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1884-208-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1912-48-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1912-585-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1956-573-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2012-490-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2060-236-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2192-566-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2256-370-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2284-244-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2304-80-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2376-148-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2380-442-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2384-164-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2484-220-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2496-556-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2520-268-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2524-362-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2544-172-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2664-199-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3044-514-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3076-183-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3236-422-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3284-565-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3284-28-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3300-356-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3420-392-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3536-320-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3608-260-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3612-310-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3716-545-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3764-328-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3772-484-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3792-56-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3792-592-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3796-296-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3820-192-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3832-262-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3884-278-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3904-308-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3980-380-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4000-551-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4000-8-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4028-527-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4072-96-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4164-346-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4200-512-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4268-44-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4292-400-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4348-454-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4432-398-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4460-558-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4460-16-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4520-135-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4524-583-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4536-428-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4560-534-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4644-152-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4732-559-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4816-284-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4888-520-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4904-175-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4940-104-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5024-224-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5044-496-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5048-286-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5128-593-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads