8d149d740b17747d42eda3aa0ed4698c606726010023f2fe69b951956476da13

Analysis

max time kernel
133s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 05:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e9206a84ee406b542adac3ab697f000_NeikiAnalytics.exe
Size

72KB
MD5

8e9206a84ee406b542adac3ab697f000
SHA1

ba525d88af6070c56b8ced2b7dc9a3891b83685b
SHA256

8d149d740b17747d42eda3aa0ed4698c606726010023f2fe69b951956476da13
SHA512

8a2743ce0d03ee876267c050bcc1f0b3290d059ce15d48c8431ade07b1d9fb9bbae643ddb2cfe89ee10c28363c355656717f369443cbb969453bb998b87d543e
SSDEEP

1536:twRTW+ypjE7SOiaAwW4TIfHTDIN6rKL0yRNmfZF4n6RQ+cDbEyRCRRRoR4Rk4:AW+yiUwWmIfzE8rzle9Ey032ya4

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gmjlcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmabdibj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ndokbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fdgdgnbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bopgjmhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njqmepik.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icifbang.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ekemhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cehkhecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fkopnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gdqgmmjb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldleel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ocqnij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Baaplhef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dkoggkjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fafkecel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ldanqkki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mlefklpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afmhck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okhfjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgemphmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mmnldp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fljcmlfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jlkagbej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcmabg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjhlml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agffge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdfbibnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldoaklml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jpgmha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clbceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fhqcam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kepelfam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdqejn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eofbch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ifjodl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Okloegjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bldgdago.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eapedd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jimekgff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njqmepik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ldohebqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cegdnopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aegikj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cojjqlpk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfdhkhjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ogogoi32.exe

Executes dropped EXE 64 IoCs

pid	Process
3524	Ldohebqh.exe
3184	Lkiqbl32.exe
4964	Lnhmng32.exe
4764	Lpfijcfl.exe
1960	Ldaeka32.exe
656	Ljnnch32.exe
3484	Lphfpbdi.exe
1784	Lgbnmm32.exe
4140	Mnlfigcc.exe
3448	Mdfofakp.exe
2184	Mkpgck32.exe
1212	Mnocof32.exe
3520	Mdiklqhm.exe
2524	Mkbchk32.exe
1900	Mpolqa32.exe
712	Mcnhmm32.exe
1204	Mjhqjg32.exe
2124	Maohkd32.exe
708	Mpaifalo.exe
4396	Mglack32.exe
3760	Mnfipekh.exe
3252	Mpdelajl.exe
1792	Mgnnhk32.exe
4984	Njljefql.exe
1988	Nacbfdao.exe
4180	Nceonl32.exe
4972	Nklfoi32.exe
5092	Nafokcol.exe
2264	Ngcgcjnc.exe
1168	Nnmopdep.exe
1796	Ndghmo32.exe
3980	Nkqpjidj.exe
3116	Nnolfdcn.exe
4644	Ncldnkae.exe
2952	Nggqoj32.exe
2752	Nnaikd32.exe
1740	Nqpego32.exe
4740	Okeieh32.exe
448	Odnnnnfe.exe
1572	Ocqnij32.exe
3344	Okhfjh32.exe
612	Obangb32.exe
3728	Oqdoboli.exe
380	Ogogoi32.exe
3504	Ojmcld32.exe
2588	Obdkma32.exe
3380	Ocegdjij.exe
2760	Okloegjl.exe
4636	Obfhba32.exe
4564	Ocgdji32.exe
4804	Ogcpjhoq.exe
2944	Onmhgb32.exe
4088	Oqkdcn32.exe
2196	Pgemphmn.exe
3928	Pjdilcla.exe
1328	Pbkamqmd.exe
2528	Pclneicb.exe
840	Pjffbc32.exe
2416	Pqpnombl.exe
4064	Pgjfkg32.exe
1460	Pjhbgb32.exe
4824	Pabkdmpi.exe
2980	Pcagphom.exe
3900	Pkhoae32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Hkfoeega.exe	Hihbijhn.exe
File created	C:\Windows\SysWOW64\Bbjiol32.dll	Mmnldp32.exe
File opened for modification	C:\Windows\SysWOW64\Nloiakho.exe	Njqmepik.exe
File created	C:\Windows\SysWOW64\Eokchkmi.dll	Cegdnopg.exe
File opened for modification	C:\Windows\SysWOW64\Mpaifalo.exe	Maohkd32.exe
File created	C:\Windows\SysWOW64\Clkooklb.dll	Gdqgmmjb.exe
File created	C:\Windows\SysWOW64\Mibpda32.exe	Mgddhf32.exe
File created	C:\Windows\SysWOW64\Gaiann32.dll	Miemjaci.exe
File opened for modification	C:\Windows\SysWOW64\Ajiknpjj.exe	Aaqgek32.exe
File opened for modification	C:\Windows\SysWOW64\Lffhfh32.exe	Kplpjn32.exe
File created	C:\Windows\SysWOW64\Kjiccacq.dll	Migjoaaf.exe
File created	C:\Windows\SysWOW64\Nekfmb32.dll	Hijooifk.exe
File created	C:\Windows\SysWOW64\Jbeidl32.exe	Jpgmha32.exe
File created	C:\Windows\SysWOW64\Lboeaifi.exe	Ldleel32.exe
File created	C:\Windows\SysWOW64\Agocgbni.dll	Ndokbi32.exe
File created	C:\Windows\SysWOW64\Ohbkfake.dll	Opakbi32.exe
File created	C:\Windows\SysWOW64\Gpnkgo32.dll	Mcnhmm32.exe
File created	C:\Windows\SysWOW64\Dedkdcie.exe	Dahode32.exe
File created	C:\Windows\SysWOW64\Fdlnbm32.exe	Fbnafb32.exe
File opened for modification	C:\Windows\SysWOW64\Aeklkchg.exe	Aqppkd32.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Chcddk32.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Dfpgffpm.exe
File opened for modification	C:\Windows\SysWOW64\Lkiqbl32.exe	Ldohebqh.exe
File created	C:\Windows\SysWOW64\Dboiieof.dll	Oqkdcn32.exe
File opened for modification	C:\Windows\SysWOW64\Nilcjp32.exe	Ngmgne32.exe
File created	C:\Windows\SysWOW64\Codqon32.dll	Nngokoej.exe
File created	C:\Windows\SysWOW64\Lhibca32.dll	Onmhgb32.exe
File opened for modification	C:\Windows\SysWOW64\Bdfibe32.exe	Bahmfj32.exe
File created	C:\Windows\SysWOW64\Elppfmoo.exe	Eefhjc32.exe
File created	C:\Windows\SysWOW64\Gbdhjm32.dll	Neeqea32.exe
File opened for modification	C:\Windows\SysWOW64\Odapnf32.exe	Oqfdnhfk.exe
File created	C:\Windows\SysWOW64\Pqpgdfnp.exe	Pnakhkol.exe
File opened for modification	C:\Windows\SysWOW64\Pjffbc32.exe	Pclneicb.exe
File created	C:\Windows\SysWOW64\Behbag32.exe	Bbifelba.exe
File created	C:\Windows\SysWOW64\Ocdfloja.dll	Kfjhkjle.exe
File created	C:\Windows\SysWOW64\Bchdhnom.dll	Mgkjhe32.exe
File created	C:\Windows\SysWOW64\Afmhck32.exe	Aeklkchg.exe
File created	C:\Windows\SysWOW64\Cegdnopg.exe	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Fbpnkama.exe	Fcmnpe32.exe
File opened for modification	C:\Windows\SysWOW64\Gkmlofol.exe	Gmjlcj32.exe
File opened for modification	C:\Windows\SysWOW64\Gomakdcp.exe	Gkaejf32.exe
File opened for modification	C:\Windows\SysWOW64\Lmppcbjd.exe	Liddbc32.exe
File created	C:\Windows\SysWOW64\Gjeieojj.dll	Lgokmgjm.exe
File created	C:\Windows\SysWOW64\Oadacmff.dll	Oncofm32.exe
File created	C:\Windows\SysWOW64\Hjfhhm32.dll	Cndikf32.exe
File created	C:\Windows\SysWOW64\Lpfijcfl.exe	Lnhmng32.exe
File created	C:\Windows\SysWOW64\Mgqddl32.dll	Cddecc32.exe
File opened for modification	C:\Windows\SysWOW64\Mpoefk32.exe	Mmpijp32.exe
File created	C:\Windows\SysWOW64\Oedbld32.dll	Mkpgck32.exe
File created	C:\Windows\SysWOW64\Ppelifin.dll	Qeemej32.exe
File created	C:\Windows\SysWOW64\Ijmanlfp.dll	Fkmchi32.exe
File created	C:\Windows\SysWOW64\Iifokh32.exe	Ifgbnlmj.exe
File created	C:\Windows\SysWOW64\Hdaeob32.dll	Adapgfqj.exe
File created	C:\Windows\SysWOW64\Khkaedic.dll	Gokdeeec.exe
File created	C:\Windows\SysWOW64\Ikkokgea.dll	Lllcen32.exe
File created	C:\Windows\SysWOW64\Eflgme32.dll	Bgcknmop.exe
File created	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bjagjhnc.exe
File opened for modification	C:\Windows\SysWOW64\Cjbpaf32.exe	Chcddk32.exe
File created	C:\Windows\SysWOW64\Miemjaci.exe	Mgfqmfde.exe
File opened for modification	C:\Windows\SysWOW64\Qbimoo32.exe	Qjbena32.exe
File opened for modification	C:\Windows\SysWOW64\Agffge32.exe	Aegikj32.exe
File created	C:\Windows\SysWOW64\Doeiljfn.exe	Dlgmpogj.exe
File created	C:\Windows\SysWOW64\Dekclg32.dll	Gbgdlq32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12164	11976	WerFault.exe	579

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gefncbmc.dll"	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cbcilkjg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ecoangbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Migjoaaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcjlfqa.dll"	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ajiknpjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bkidenlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbcaee32.dll"	Ceoibflm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhidjpqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjqehkaf.dll"	Docmgjhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jihdea32.dll"	Eefhjc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oncofm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pqpnombl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Elgfgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdbinofi.dll"	Jmpgldhg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mibpda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qjbena32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cojjqlpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lebkhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Miemjaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjlibkf.dll"	Mnebeogl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nnneknob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Najmlf32.dll"	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmphmhjc.dll"	Pfaigm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Okloegjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hkmefd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jblpek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mgkjhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ngmgne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnlden32.dll"	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkmlea32.dll"	Qffbbldm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjfhhm32.dll"	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klohppck.dll"	Cliaoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfkgaokd.dll"	Fhqcam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iledokkp.dll"	Ildkgc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ageolo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgcomh32.dll"	8e9206a84ee406b542adac3ab697f000_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dddojq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eamhodmf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hiefcj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Beihma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Conclk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fbpnkama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jianff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kfjhkjle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nilcjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Booogccm.dll"	Ocpgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odljbk32.dll"	Okloegjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfgeem32.dll"	Pclneicb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gkhbdg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qbimoo32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 3524	212	8e9206a84ee406b542adac3ab697f000_NeikiAnalytics.exe	83
PID 212 wrote to memory of 3524	212	8e9206a84ee406b542adac3ab697f000_NeikiAnalytics.exe	83
PID 212 wrote to memory of 3524	212	8e9206a84ee406b542adac3ab697f000_NeikiAnalytics.exe	83
PID 3524 wrote to memory of 3184	3524	Ldohebqh.exe	84
PID 3524 wrote to memory of 3184	3524	Ldohebqh.exe	84
PID 3524 wrote to memory of 3184	3524	Ldohebqh.exe	84
PID 3184 wrote to memory of 4964	3184	Lkiqbl32.exe	85
PID 3184 wrote to memory of 4964	3184	Lkiqbl32.exe	85
PID 3184 wrote to memory of 4964	3184	Lkiqbl32.exe	85
PID 4964 wrote to memory of 4764	4964	Lnhmng32.exe	86
PID 4964 wrote to memory of 4764	4964	Lnhmng32.exe	86
PID 4964 wrote to memory of 4764	4964	Lnhmng32.exe	86
PID 4764 wrote to memory of 1960	4764	Lpfijcfl.exe	87
PID 4764 wrote to memory of 1960	4764	Lpfijcfl.exe	87
PID 4764 wrote to memory of 1960	4764	Lpfijcfl.exe	87
PID 1960 wrote to memory of 656	1960	Ldaeka32.exe	88
PID 1960 wrote to memory of 656	1960	Ldaeka32.exe	88
PID 1960 wrote to memory of 656	1960	Ldaeka32.exe	88
PID 656 wrote to memory of 3484	656	Ljnnch32.exe	89
PID 656 wrote to memory of 3484	656	Ljnnch32.exe	89
PID 656 wrote to memory of 3484	656	Ljnnch32.exe	89
PID 3484 wrote to memory of 1784	3484	Lphfpbdi.exe	90
PID 3484 wrote to memory of 1784	3484	Lphfpbdi.exe	90
PID 3484 wrote to memory of 1784	3484	Lphfpbdi.exe	90
PID 1784 wrote to memory of 4140	1784	Lgbnmm32.exe	91
PID 1784 wrote to memory of 4140	1784	Lgbnmm32.exe	91
PID 1784 wrote to memory of 4140	1784	Lgbnmm32.exe	91
PID 4140 wrote to memory of 3448	4140	Mnlfigcc.exe	92
PID 4140 wrote to memory of 3448	4140	Mnlfigcc.exe	92
PID 4140 wrote to memory of 3448	4140	Mnlfigcc.exe	92
PID 3448 wrote to memory of 2184	3448	Mdfofakp.exe	93
PID 3448 wrote to memory of 2184	3448	Mdfofakp.exe	93
PID 3448 wrote to memory of 2184	3448	Mdfofakp.exe	93
PID 2184 wrote to memory of 1212	2184	Mkpgck32.exe	94
PID 2184 wrote to memory of 1212	2184	Mkpgck32.exe	94
PID 2184 wrote to memory of 1212	2184	Mkpgck32.exe	94
PID 1212 wrote to memory of 3520	1212	Mnocof32.exe	95
PID 1212 wrote to memory of 3520	1212	Mnocof32.exe	95
PID 1212 wrote to memory of 3520	1212	Mnocof32.exe	95
PID 3520 wrote to memory of 2524	3520	Mdiklqhm.exe	96
PID 3520 wrote to memory of 2524	3520	Mdiklqhm.exe	96
PID 3520 wrote to memory of 2524	3520	Mdiklqhm.exe	96
PID 2524 wrote to memory of 1900	2524	Mkbchk32.exe	97
PID 2524 wrote to memory of 1900	2524	Mkbchk32.exe	97
PID 2524 wrote to memory of 1900	2524	Mkbchk32.exe	97
PID 1900 wrote to memory of 712	1900	Mpolqa32.exe	98
PID 1900 wrote to memory of 712	1900	Mpolqa32.exe	98
PID 1900 wrote to memory of 712	1900	Mpolqa32.exe	98
PID 712 wrote to memory of 1204	712	Mcnhmm32.exe	99
PID 712 wrote to memory of 1204	712	Mcnhmm32.exe	99
PID 712 wrote to memory of 1204	712	Mcnhmm32.exe	99
PID 1204 wrote to memory of 2124	1204	Mjhqjg32.exe	100
PID 1204 wrote to memory of 2124	1204	Mjhqjg32.exe	100
PID 1204 wrote to memory of 2124	1204	Mjhqjg32.exe	100
PID 2124 wrote to memory of 708	2124	Maohkd32.exe	101
PID 2124 wrote to memory of 708	2124	Maohkd32.exe	101
PID 2124 wrote to memory of 708	2124	Maohkd32.exe	101
PID 708 wrote to memory of 4396	708	Mpaifalo.exe	102
PID 708 wrote to memory of 4396	708	Mpaifalo.exe	102
PID 708 wrote to memory of 4396	708	Mpaifalo.exe	102
PID 4396 wrote to memory of 3760	4396	Mglack32.exe	103
PID 4396 wrote to memory of 3760	4396	Mglack32.exe	103
PID 4396 wrote to memory of 3760	4396	Mglack32.exe	103
PID 3760 wrote to memory of 3252	3760	Mnfipekh.exe	104

C:\Users\Admin\AppData\Local\Temp\8e9206a84ee406b542adac3ab697f000_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8e9206a84ee406b542adac3ab697f000_NeikiAnalytics.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\SysWOW64\Ldohebqh.exe
  C:\Windows\system32\Ldohebqh.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\SysWOW64\Lkiqbl32.exe
    C:\Windows\system32\Lkiqbl32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3184
  - - C:\Windows\SysWOW64\Lnhmng32.exe
      C:\Windows\system32\Lnhmng32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4964
    - - C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4764
      - C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:656
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3484
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1784
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4140
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3448
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1212
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3520
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:712
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1204
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:708
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3760
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        23⤵
        Executes dropped EXE
        
        PID:3252
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        24⤵
        Executes dropped EXE
        
        PID:1792
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        25⤵
        Executes dropped EXE
        
        PID:4984
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        26⤵
        Executes dropped EXE
        
        PID:1988
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        27⤵
        Executes dropped EXE
        
        PID:4180
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        28⤵
        Executes dropped EXE
        
        PID:4972
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        29⤵
        Executes dropped EXE
        
        PID:5092
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        30⤵
        Executes dropped EXE
        
        PID:2264
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1168
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1796
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        33⤵
        Executes dropped EXE
        
        PID:3980
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3116
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        35⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        36⤵
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        37⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        38⤵
        Executes dropped EXE
        
        PID:2752
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        39⤵
        Executes dropped EXE
        
        PID:1740
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        40⤵
        Executes dropped EXE
        
        PID:4740
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        41⤵
        Executes dropped EXE
        
        PID:448
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1572
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3344
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        44⤵
        Executes dropped EXE
        
        PID:612
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        45⤵
        Executes dropped EXE
        
        PID:3728
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:380
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        47⤵
        Executes dropped EXE
        
        PID:3504
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        48⤵
        Executes dropped EXE
        
        PID:2588
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        49⤵
        Executes dropped EXE
        
        PID:3380
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2760
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        51⤵
        Executes dropped EXE
        
        PID:4636
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        52⤵
        Executes dropped EXE
        
        PID:4564
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        53⤵
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2944
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4088
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2196
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        57⤵
        Executes dropped EXE
        
        PID:3928
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        58⤵
        Executes dropped EXE
        
        PID:1328
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2528
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        60⤵
        Executes dropped EXE
        
        PID:840
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2416
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        62⤵
        Executes dropped EXE
        
        PID:4064
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        63⤵
        Executes dropped EXE
        
        PID:1460
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        64⤵
        Executes dropped EXE
        
        PID:4824
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        65⤵
        Executes dropped EXE
        
        PID:2980
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        66⤵
        Executes dropped EXE
        
        PID:3900
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        67⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        68⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        69⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        70⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        71⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        72⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        73⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        74⤵
        Drops file in System32 directory
        
        PID:3044
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        75⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3736
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        76⤵
        Modifies registry class
        
        PID:912
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4500
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3864
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        79⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        80⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        81⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        82⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        83⤵
        Drops file in System32 directory
        
        PID:4276
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        84⤵
        Modifies registry class
        
        PID:1388
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        85⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        86⤵
        Drops file in System32 directory
        
        PID:2120
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        87⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        88⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        89⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        90⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        91⤵
        Drops file in System32 directory
        
        PID:2644
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        92⤵
        
        PID:836
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        93⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        94⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        95⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        96⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        97⤵
        Drops file in System32 directory
        
        PID:5352
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        98⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        99⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        100⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5540
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        102⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        103⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5704
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        105⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5812
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        107⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        108⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        109⤵
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        110⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        111⤵
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        112⤵
        Modifies registry class
        
        PID:3992
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        113⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        114⤵
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        115⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        116⤵
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        117⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        119⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5716
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        121⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        122⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        123⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        124⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        125⤵
        Modifies registry class
        
        PID:5152
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5320
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        128⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        129⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        130⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        131⤵
        Modifies registry class
        
        PID:5956
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        132⤵
        Modifies registry class
        
        PID:6112
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        133⤵
        Drops file in System32 directory
        
        PID:5296
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        134⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        135⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        136⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        137⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        138⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        139⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        140⤵
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5808
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        142⤵
        Drops file in System32 directory
        
        PID:5912
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        143⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        144⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        145⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6200
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        146⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        147⤵
        Modifies registry class
        
        PID:6288
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        148⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6372
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6416
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        151⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        152⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        153⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        154⤵
        Modifies registry class
        
        PID:6592
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        155⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        156⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        157⤵
        Modifies registry class
        
        PID:6728
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6772
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        159⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        160⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6896
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        162⤵
        Drops file in System32 directory
        
        PID:6948
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        163⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7020
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        165⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7112
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7156
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        168⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        169⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6324
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        171⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        172⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        173⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        174⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        175⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        176⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        177⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        178⤵
        Drops file in System32 directory
        
        PID:6848
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        179⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        180⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        181⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        182⤵
        Drops file in System32 directory
        
        PID:7152
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        183⤵
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        184⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        185⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        186⤵
        Modifies registry class
        
        PID:6516
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        187⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        188⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6844
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        190⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        191⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        192⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6296
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        194⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        195⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        196⤵
        Drops file in System32 directory
        
        PID:6808
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        197⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        198⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        199⤵
        Drops file in System32 directory
        
        PID:6608
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        200⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        201⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        202⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        203⤵
        Drops file in System32 directory
        
        PID:7120
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        204⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        205⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        206⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        207⤵
        Modifies registry class
        
        PID:7280
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7328
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        209⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        210⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        211⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        212⤵
        Drops file in System32 directory
        
        PID:7496
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        213⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        214⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        215⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        216⤵
        Drops file in System32 directory
        
        PID:7672
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        217⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        218⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        219⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        220⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        221⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        222⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        223⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        224⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        225⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        226⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        227⤵
        Modifies registry class
        
        PID:8188
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        228⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        229⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        230⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        231⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        232⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        233⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        234⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7716
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        236⤵
        Drops file in System32 directory
        
        PID:7784
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        237⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        238⤵
        Modifies registry class
        
        PID:7920
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        239⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8092
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        241⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        242⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        243⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        244⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        245⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        246⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        247⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        248⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        249⤵
        Modifies registry class
        
        PID:8016
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8156
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7276
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7556
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        253⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        254⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        255⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        256⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        257⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        258⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        259⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        260⤵
        Modifies registry class
        
        PID:7976
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        261⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        262⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        263⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        264⤵
        Modifies registry class
        
        PID:8280
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        265⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        266⤵
        Modifies registry class
        
        PID:8368
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        267⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        268⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        269⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8544
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        271⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8588
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        272⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        273⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        274⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        275⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8800
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        277⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8884
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        279⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        280⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        281⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        282⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        283⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        284⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        285⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        286⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        287⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        288⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        289⤵
        Drops file in System32 directory
        
        PID:8408
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        290⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        291⤵
        Drops file in System32 directory
        
        PID:8536
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        292⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        293⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        294⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        295⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        296⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        297⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9004
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        299⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        300⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        301⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8316
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        303⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        304⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        305⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8912
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        307⤵
        Drops file in System32 directory
        
        PID:9096
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        308⤵
        Modifies registry class
        
        PID:8212
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        309⤵
        Drops file in System32 directory
        
        PID:8484
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        310⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        311⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        312⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        313⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        314⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        315⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        316⤵
        Drops file in System32 directory
        
        PID:7392
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        317⤵
        Modifies registry class
        
        PID:9084
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9256
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        319⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        320⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        321⤵
        Drops file in System32 directory
        
        PID:9412
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        322⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9472
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        323⤵
        Drops file in System32 directory
        
        PID:9516
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        324⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9616
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        326⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        327⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9712
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9752
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        329⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        330⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        331⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9888
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        332⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        333⤵
        Modifies registry class
        
        PID:9980
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        334⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10068
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        336⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10108
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        337⤵
        Modifies registry class
        
        PID:10148
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        338⤵
        Drops file in System32 directory
        
        PID:10188
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        339⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        340⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        341⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        342⤵
        Drops file in System32 directory
        
        PID:9392
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9468
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9532
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        345⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        346⤵
        Modifies registry class
        
        PID:9676
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        347⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        348⤵
        Modifies registry class
        
        PID:9868
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        349⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        350⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        351⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        352⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        353⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        354⤵
        Modifies registry class
        
        PID:9252
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        355⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        356⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        357⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9596
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        358⤵
        Drops file in System32 directory
        
        PID:9700
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        359⤵
        Modifies registry class
        
        PID:9852
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        360⤵
        Modifies registry class
        
        PID:9964
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        361⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        362⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        363⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        364⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        365⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        366⤵
        Drops file in System32 directory
        
        PID:9788
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        367⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        368⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        369⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        370⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        371⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        372⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        373⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        374⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        375⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        376⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        377⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        378⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        379⤵
        Drops file in System32 directory
        
        PID:10312
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        380⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        381⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10440
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        383⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        384⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        385⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10612
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        387⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        388⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        389⤵
        Modifies registry class
        
        PID:10736
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        390⤵
        Modifies registry class
        
        PID:10776
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        391⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        392⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        393⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        394⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        395⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        396⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        397⤵
        Modifies registry class
        
        PID:11068
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        398⤵
        Modifies registry class
        
        PID:11112
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        399⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        400⤵
        Modifies registry class
        
        PID:11192
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        401⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        402⤵
        Modifies registry class
        
        PID:10260
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        403⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        404⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        405⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10460
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        406⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        407⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        408⤵
        Drops file in System32 directory
        
        PID:10664
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        409⤵
        Drops file in System32 directory
        
        PID:10724
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10808
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        411⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        412⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        413⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11016
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        414⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        415⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        416⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        417⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        418⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        419⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        420⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        421⤵
        
        PID:412
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        422⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        423⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        424⤵
        Modifies registry class
        
        PID:10952
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        425⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        426⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        427⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11200
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        428⤵
        Drops file in System32 directory
        
        PID:10360
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        429⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        430⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        431⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        432⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        433⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        434⤵
        Modifies registry class
        
        PID:11060
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11188
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10436
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        437⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        438⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        439⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11184
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        440⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        441⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9264
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        442⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9792
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        444⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        445⤵
        Modifies registry class
        
        PID:3544
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        446⤵
        Drops file in System32 directory
        
        PID:11260
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        447⤵
        Modifies registry class
        
        PID:10244
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        448⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        449⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        450⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        451⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        452⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11468
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11516
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        454⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        455⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        456⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        457⤵
        Drops file in System32 directory
        
        PID:11676
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        458⤵
        Drops file in System32 directory
        
        PID:11708
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        459⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        460⤵
        Drops file in System32 directory
        
        PID:11792
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        461⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11832
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        462⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        463⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        464⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        465⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11980
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        466⤵
        Modifies registry class
        
        PID:12020
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        467⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        468⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        469⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        470⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        471⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        472⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        473⤵
        
        PID:12284
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        474⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        475⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        476⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        477⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        478⤵
        Drops file in System32 directory
        
        PID:11544
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        479⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        480⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        481⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        482⤵
        
        PID:11776
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        483⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        484⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        485⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11976 -s 408
        486⤵
        Program crash
        
        PID:12164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 11976 -ip 11976
1⤵
PID:12080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ahhblemi.exe

Filesize
72KB

MD5
b9dc230218d8956e3e577b9daff33012

SHA1
65247798788673061a5285652fac225438c68659

SHA256
9e7a42f197475dd3e50c8873e6e8ff3d001ea01e19abbfebc77a8bc1f26a502f

SHA512
65abf8d09658dbea7097212bed2472aead12b4931dd92de863fc058933b262cd69d6f0c7a47297e4058e05cc3c38973f77681971ce99a94f255a4745a55e79c8

Download Submit
C:\Windows\SysWOW64\Ajiknpjj.exe

Filesize
64KB

MD5
6e492c32071b28762f28214602c0b145

SHA1
1b50bde1ce7286f018a141305c5eed01f5bb6401

SHA256
b9140c4149a5c79ca6fdf3fa1df5e8aea5f1319570a7de57cf8aff66585d3c14

SHA512
c0aa5fa9f0e8defb0d82c44697c7f2918ee8ab518020fa41d834d5ebc05dd59521dd2f95d3eeddc08821b9ff312fae2b220615ad49918086e49a5ec8f6485d87

Download Submit
C:\Windows\SysWOW64\Bbifelba.exe

Filesize
72KB

MD5
aee74bcef622bc43f4a0f9ddf0f46da5

SHA1
0e597d0232b6401c9d4dc501ae56972f5c4b5a6d

SHA256
fb8071d46c890d661aedca742fb6ff228639eebcc1a5b429fd9855882d5c296c

SHA512
282632d98344717ad6c0961cdcbe82e55bc5033604063c46bf51b109c2b2bc326c811654240947e9776390e50b252f7e63d0a8cb1c3f523a45b18e68597dee55

Download Submit
C:\Windows\SysWOW64\Bmkjkd32.exe

Filesize
72KB

MD5
cfbb30301c1dc9bfc06f4c463038be3b

SHA1
02351ef79e784fddac5a73591b841ea6e71427ee

SHA256
d81b5357a92fe67a972ef7580025821022604ecdb6f30f6fa4602612405b2b1e

SHA512
aa153d27ca95a581e2b23d02f4c82a1bce77e7cd38675441d6716c4a86202d0e75ca3807352f8cb076270229de3c651c09e6e616d2cfd444ea2f1eee571d2ce6

Download Submit
C:\Windows\SysWOW64\Bobcpmfc.exe

Filesize
72KB

MD5
79ed277ea80f685380707294b3f80e6d

SHA1
26480ad2473ce9d2d91c5b7272a7ad25fb18c767

SHA256
c1e07a95fac3f90e7dbe0120a0867e44d7986adeabdd8042c808287c7ea42528

SHA512
d3caebf7f5e9a48e582022bbe16d68558ac7f06e46ba34a45c526e081090739e9837add93330e31619d2b55b92eb200822b940a9d0a0db0d71483200a72a5756

Download Submit
C:\Windows\SysWOW64\Chdkoa32.exe

Filesize
72KB

MD5
13d1f14bf732a1402a979d9dbbe5d4cd

SHA1
51b8a9ed90a1bb27228cbbeed15058ed6365783e

SHA256
1aa3b2e5401e94f617a6aa55126ffc3ceb6fd3b7029f450eb69cd0819de9a73b

SHA512
f389cf0bf6d51a3618126b2cb231ff829e3765169619fb132197675e9ce7a834d181c1390bd967061462634c0f2f3365eaf320daa22245e8c5a2f4ab71e116f7

Download Submit
C:\Windows\SysWOW64\Ckegia32.dll

Filesize
7KB

MD5
fecb1e4b7e5c3b4bc2025a59f7f5d29b

SHA1
41dabde4c3b957a4008bf54188767c33de027939

SHA256
b7b2bf4653e316941b25f167a14347df5d34e8f5ad8a0055071037dc4403baec

SHA512
df1bed0cdfec4e2e14d2a99183238ae8b97fecaa5959bb0c2a4807c5bb1f7c8970e4e71cce2a5a67d8eed8b1dd82c0c94518d3186d28ccebacf8b1b06d25c7fc

Download Submit
C:\Windows\SysWOW64\Cojjqlpk.exe

Filesize
72KB

MD5
11e5331aea8e448d4bb32da9751a22e1

SHA1
b8124f4fba32db28e212910133bfa2242a9624cc

SHA256
d12e055128fefab03250f7840b46e91dab419b334e1cd39b826859756ccff703

SHA512
210651f3e380b9e360c0fec04d9cca0318a320e68c60cfe1ec9be63334c9971af4931a022817305382e37e9e4e28a733c5c07ff6fc80735bea34d1d7486be693

Download Submit
C:\Windows\SysWOW64\Colffknh.exe

Filesize
64KB

MD5
92abe4e39e583f6a5140ff62705d85ca

SHA1
2e5f426d0abe17447307960df556d051cd923287

SHA256
468058932d5c179dd7636434126c8e4bca430a5243d1aa92903e208142ddc8fe

SHA512
f775488f4629ece5612f0b3069edb94aaf2a133782c4c00c446f9d8aeeee9c7288f2e14a0d276d2e4ee69680728ba511ecf2bb49e8de25e05d780684cdc92a78

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
72KB

MD5
1876b5c63cab62c329819add9674af9b

SHA1
3e37bc077ff42df5e49881887c0390fa77c15ef9

SHA256
f13170099748b39dfdf778f536b2269d3389a968d6e9c197ffbb5543efc2c5b2

SHA512
9e6418281027156300fe1599b497de88573ed510065cf42c5174ef838780b5663e64c27ff4102185859ea03841167ce24db0dd400307bea6919b91e1e43b1939

Download Submit
C:\Windows\SysWOW64\Dhidjpqc.exe

Filesize
72KB

MD5
4e64e6b1cd8b0f39d992e098c7cadb6a

SHA1
f8f87812eca77e47f2010fcc5bfef6111bf63200

SHA256
5025729100af586ee95ca1650b3b69faafc2ad6a50fcf45a687ea256700320d8

SHA512
e1b449fc2e658877b7d2171fa59e700a7a4df115f3a34e781cc6f468a0fd217f41b1ceb932393bb0044bffafd6b10c780fd52c673611ebe6a9c6e49b52eb1911

Download Submit
C:\Windows\SysWOW64\Dhocqigp.exe

Filesize
72KB

MD5
96747ad9b31cb963f2884b3675aa531a

SHA1
dbb6d794bbaf71dc792374fc4ebc3a28e2b0ab60

SHA256
4e1174d880f83a8570c1632061fcc85b0e45cb5918418a8ecc0b831b81157a3c

SHA512
544e6e89fc3d021ec24aa07449780c6ac4be6a9217e074c03c08cf5c8f424c36f09bb5e69d853e23f6206d338106a04b25fb9bd0e7d95837476e9e9aff571e2e

Download Submit
C:\Windows\SysWOW64\Doeiljfn.exe

Filesize
72KB

MD5
b514f5bc6d697baca7a563af355a293e

SHA1
04697ef586543b3b45076117b4578c42b58a5242

SHA256
4de8d8e12d3b031744d27787ac152d9732a7a2769540e04b1ec690f522cd0e1a

SHA512
9324f78798d85bcacc186598d8a425509c5eb8e0af0eb3b3cb6095eb444968dca4a4b8caf6b791b85d647b0b68b08e568f78114bd77631a902808e948a80f8ca

Download Submit
C:\Windows\SysWOW64\Ecoangbg.exe

Filesize
72KB

MD5
92f018c965670ac4fb1507d8a0fa0342

SHA1
da1d4bc051ea5ffcd478474fd396be25b638af61

SHA256
984ae584d286040b577cdb730c2b56a19cc0caa5f2534cb2176e4baf92d96e51

SHA512
3c9051c217522b2ca10bd886f4b652dd492ccdf8e6338642637bf4a35b092ac1055e33cbeb01653f25abfa60b2d1bf71e2190ea378582b2b2a2c8c21f846f353

Download Submit
C:\Windows\SysWOW64\Eefhjc32.exe

Filesize
72KB

MD5
1794a39af7ad3dd72b75dd91e758929e

SHA1
b491dec4ce592392d897bfd9cc4c0ee3398f6e1a

SHA256
af0c500e1dd22fc8566f38219b175363dd9c3ebda62bf7f6c45da203ab33296c

SHA512
0bcb2a6220070c484c0e2de420bf3859d697fe0653c442c07f02ac84613c0bd2f668af85f498e0831e4c51378647e98ca4a664ae4847c27a252a07fa6ac5c910

Download Submit
C:\Windows\SysWOW64\Ekemhj32.exe

Filesize
72KB

MD5
145a728e7e9d6bfa35b8f622d7f574be

SHA1
bbe48d20089a64082d86fa7afab903f94a96aef0

SHA256
18121cdb0d0e28309a4bc9c37834677607e05d90de445a1e4a71fea5d1a0c76a

SHA512
905bb37a73fb554c8840cdd2ac1919453a526c55445a64ffd0c645355344494b0727b930231841303c0ac4505e2a29aeb4f5e78c4fe1d7abea45a27d34a3e07b

Download Submit
C:\Windows\SysWOW64\Fojlngce.exe

Filesize
72KB

MD5
15ac0292130e7d6a7b7e5769e9387101

SHA1
810a5101e1131958282889bd25ad8e6bccce3593

SHA256
8b9ae4155d3d1992e1f0079026fdbb17cdbe85393f30d6b40a512a4b65f14c53

SHA512
6befe56ad182fbe3f197d511f896da5a397e17ad9d7bc449c4ab4bd78fc3051442672a60f7ada90a1a46e3759270de9a2d53ca71e568fd4a37a0e28b847c094d

Download Submit
C:\Windows\SysWOW64\Gdqgmmjb.exe

Filesize
72KB

MD5
671c0a62ef36aeca6667075e582c59e2

SHA1
fc6565ae57728d74756d2829e03a4647f48b3b40

SHA256
31890387c915fc636a54e0f00834ec3481290ef1e5e3dc70525f897298f928e0

SHA512
20854559eeeb332d178cec580b82371f5f784dbd951c576b2864a9749904b6bb1facf9a19d63955c53f52e66c76608175bb937ee637d6acaa6aa7aac3577204a

Download Submit
C:\Windows\SysWOW64\Hfnphn32.exe

Filesize
72KB

MD5
4e95fbf6933e1a9c84c072d0a577c2a3

SHA1
abd321160710526397f50382d8081101d2684037

SHA256
634033ccc4bcd55eb1d5978dec4abffd0e8e89ca7bf9cb1fc6e4d1d28e815277

SHA512
5437348d9826a16dfc46431ff07d9015d6d01b471691699b9c3ca389c44e17b3e3abcb6ee9865d8a50bfc5d19823d8265d0f6c0bbc592e35434bb6a1b44feb9f

Download Submit
C:\Windows\SysWOW64\Ifjodl32.exe

Filesize
72KB

MD5
117000331563c05eb95986b2a0d784f1

SHA1
00bc02459d63a50d3ff207d3d5db16941e134c7b

SHA256
8b35a53976a722d12bbb34318608ad264c821e666989192567e360007506a0af

SHA512
658e8448bc357d67c9854a09e6e316dc7007e97ad23e45f75a3fe0dd029ac5793aa211a0c58f23919b93b8151add8afcb5a3c8646de39ca105a67f8bb6729b80

Download Submit
C:\Windows\SysWOW64\Iiaephpc.exe

Filesize
72KB

MD5
c67117cab3da3a68a0af71214fe8548d

SHA1
4e96ab7c3bc338d3b0b00292037a81518af247ec

SHA256
c2ccc5f5da7e52908798fe5e4fb283fdf99ae7d3cd333d9d37ac33a9f7d17ee0

SHA512
1cf2d033812b1b83876931ffef99a3ef0453e386164ab0c35007924f21613c83a88aaa0c43223980c0cb976b0b6976ffafe410e12d1665a068c6ecc78b108409

Download Submit
C:\Windows\SysWOW64\Ikbnacmd.exe

Filesize
64KB

MD5
ae5a185e8667408006337e7e9a4b9955

SHA1
e166bd498b4758555426f7790b17da50c84e2496

SHA256
62e52f4dd39c9392acda63315b12c8fda38eb306d1afdf68a8ac0cedc955145b

SHA512
d25b6f3701875b72cba9705103f6fb3ffd25ad09128a047f29524812fe1432a6dcce32a7345eda661c955a5f85a9707908b164ca5626fec9e47f06f5b8d9f852

Download Submit
C:\Windows\SysWOW64\Ildkgc32.exe

Filesize
72KB

MD5
1212846c5ab9b48852eb6448ebcb895b

SHA1
cf72fec624a4c6e3cdca0ab6d728f1985b22396c

SHA256
df795b3aadca765da6d8faa3aa7c16674d639561a693948b1f4829378fdfa737

SHA512
3533a7e776d85e818fe95fb6ea91b08feb8af47e258e23106cf89c28ea892a3d04e85167b256c539bad05d97fb8ead80a38c190e4d3ead585cee6701812684ce

Download Submit
C:\Windows\SysWOW64\Imfdff32.exe

Filesize
72KB

MD5
7c434173be4bbbcdc1e81fea28960f5e

SHA1
28cdfcc000299439c58a449534f02f23a99994ef

SHA256
50c9a5de8dc0813c76fee8ae6088047e55e2b4161b4f2dbb0cdf9b8c3400d2a8

SHA512
b12e6438139e850a6d0ac29e150394ee8ad9f5a2711cdbf771a86a49b84bc83a85df41baa7d6ab14a4c33f15d3102f1b8b6ff82d59d32884483863fd1c4b7fb6

Download Submit
C:\Windows\SysWOW64\Jfeopj32.exe

Filesize
72KB

MD5
bf7660e7a5b67a640b140a2b2f515d97

SHA1
9dcd833759ef726a50dce8380864e530bab97c9c

SHA256
1885d01b9693386e81d7b007b5993e83f14cc1a8ba77a14b3d29254e334a6f0f

SHA512
3dae6b54a1dfd44ad3faa5c235156dd95eb28aebd6b7b226b7f6f4ad41ddb7da62b184ffdc3eab16a8c0a0aa14880591fd96a98a90eac7c977afbfe8955891a9

Download Submit
C:\Windows\SysWOW64\Jlednamo.exe

Filesize
72KB

MD5
d786729c7819e21037df0501992db217

SHA1
06f8d29d6e4716a30e7b462125674356c93c5381

SHA256
4189d8db7d45a9779c93eea19ca64abd51287eaba1e05e8763a7732d4aa4caea

SHA512
7508e2bf0d27559c283b10a566eae66b2e4fbe46e594558e93f2616b5336ab5fb3389d33ff81da4698dfc9c03890179a7ec463725a6345d51caa854aa012857e

Download Submit
C:\Windows\SysWOW64\Jpijnqkp.exe

Filesize
72KB

MD5
9c180fcddc5c024a7f06a1bfee6dcea7

SHA1
72a9071e970dcddd2d7e0078fc41d4a4bdf360f9

SHA256
3a306097dfc42dd0c050bb7d163eec2c6c6a9584f47275b96344d205ca19dd70

SHA512
a0cb951c45f59921aa0309c2af08a6c6ee42787235c7f577c6b6d62edb030e1ef18b23bf91d32f69256d2d476afc26a1fde6972ac5233664c67e45af08c12a58

Download Submit
C:\Windows\SysWOW64\Kbhoqj32.exe

Filesize
72KB

MD5
85e94863666d755365614fbddde4285d

SHA1
68dc9bc5721ede4882333951e4efea09f0f1f239

SHA256
2653a1cd8fe5c288e308f00abc3a74b7c7294624a0c64eaa963543f2e860a4fc

SHA512
15a681e72bced6eb193be9e61a0a30bd2c1a31733e25d290aa3ac4187899fc9527c0340cd8dd8f4a32e5797c36a4f754ba98c3d575ed73aab7f89792b4fcd348

Download Submit
C:\Windows\SysWOW64\Kepelfam.exe

Filesize
72KB

MD5
4bc60dc5f804079ada4d1fc3cd568098

SHA1
660f9bd9f483b6bf6086319e172049b9c182b993

SHA256
269f0146b247a1c8931220521b5510fc126730b58bd5e211e069284c38efcf45

SHA512
2f5934c3b694ece7de3483253fc638264f98b419e5ce651a6fe8818eb5c628917da2370710654b5fcb3a7cb54c5ae3eb6904964c48b6694ad63b0536acbcc241

Download Submit
C:\Windows\SysWOW64\Kfjhkjle.exe

Filesize
72KB

MD5
270a1981742e4de8dc548898c7ce608f

SHA1
a1acf520078c5f8af95b284826c8ab98984ed8ce

SHA256
f3068b76ad631e816a46c917210d600fd891892db136d4a06a5b5611331ffa0b

SHA512
9e94e9057c50d8d217bc66ec0b7c91015a7ab3ac108e4cabe45821a6bce8356c220d87520022e538061e66c574a3000b6c2119a0075aed7b9651e10e156d89d1

Download Submit
C:\Windows\SysWOW64\Kipkhdeq.exe

Filesize
72KB

MD5
1201763aca013af8011da1cadfd3d29d

SHA1
6afd3119d891644d50cae13384c7f33189742892

SHA256
b5cbc6850f2b0e4cf4d9f3cc1bc912329349088d390adf10e052a297ecc3f853

SHA512
64291ddcf47d2dade23ecd13afdac34dd2401ec723470c5cc2cad8abb0a5209ebba3a1ca2db3c87f67ea9ca5f64b6cf29f68e40731f4f2711c51cf45476d33e0

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
72KB

MD5
a9eeb28c4279eec3aab61f5008626382

SHA1
e8368274f7c1788f9877d023d66f6ba57dc1dd41

SHA256
646f4e60b51999a51405510e21f394058a0893b0c1c95811d9d257ec6d655975

SHA512
5987a5ca51f02f05c1223987d18ae2b2200056d624cfae5b502bc1e701890071752f821826e742560f618e7f199394817c73b23f85fd2dee8e6343d673d2f9e4

Download Submit
C:\Windows\SysWOW64\Ldaeka32.exe

Filesize
72KB

MD5
a7c6ac2f4bc839448e4d3bf859a6bb35

SHA1
d999328d5270227ce1d8b8c805bfd36aae34025a

SHA256
a2eb142f65f5b00d032fc406f3a719ab68d2d7db9bd4694305e4a3ceabf2732c

SHA512
0001843a378e82c7b831f5ee7feb9860c4a236a9d92efb7f3b9aeca1e43cda876c6943e72edadc7264f8abb7cbd34e9e40b87893286bf3970510d68af434da4e

Download Submit
C:\Windows\SysWOW64\Ldjhpl32.exe

Filesize
72KB

MD5
01ee7daddebb0d0e78e95024c99deabd

SHA1
018dee1a94efeafea054466335af758767eb8f52

SHA256
8a0caa449d6dda0835c0195a84e0a23bc9c267bb2ab8d532d0c3bcd19a1f34b3

SHA512
0ee74f71937449a6e2e92dcb91396fe89c855db6ff7b857be08064742f0fd8991597c900c3ece3e34eb9dfbba4c81ab25864ef965bcaf2069a211269794c5703

Download Submit
C:\Windows\SysWOW64\Ldohebqh.exe

Filesize
72KB

MD5
753ca2e4853b07ca478be073afa51c3c

SHA1
58fb08e0ec16d0b7a607321cdc15c556ef074d05

SHA256
917ab9baf81178e8f6dc407289837254a7e110fef49572e00f79106037445e98

SHA512
3f463fa10123ba599dad9a86e12afe2515b3053f3cda919be24ab17521a3c6894434eb1270c9c10215cfa6b898497a7c9c558f364bc19e66c738c979de855e27

Download Submit
C:\Windows\SysWOW64\Lepncd32.exe

Filesize
72KB

MD5
0a94695981bb969711973f80e1e06cb2

SHA1
e77ab18090d76e297f99a7ac5c70126d157ad0c4

SHA256
d909dd53570c6612518eba53f5682e94dda2e5c3fe1ae3bc024d74aeff21bdc2

SHA512
3d7a42e33bf50479ad3eb70ecf6a0b480f7e41aebfd916c86fe69f4d8846f4c3e53bd2b6d25ef0fe5a4548714dffb2c3d46f3a02408ea07153b3f5f2ccddee61

Download Submit
C:\Windows\SysWOW64\Lgbnmm32.exe

Filesize
72KB

MD5
734b8bc82daa723a54bf1d29adb1bce5

SHA1
e0662f376f00dd125e9889f3e48b4fccb543859b

SHA256
1e366ca4b96629d5855b015940163c8cdf6e651297f0b6b381a3751cb3052c98

SHA512
d700a1d674c1de97d134c323c7feff2398b5011bfcf13f6a2cde472643e11fe0f20a76f190be416f59377ec7521bd1fc085afef4fb808fa387f49166628194ad

Download Submit
C:\Windows\SysWOW64\Ljnnch32.exe

Filesize
72KB

MD5
09c904ac5c854c858112c8cf0e5ea4bd

SHA1
c5e0ed7760a1899c7f6ce31e885a6e8f0c6268d2

SHA256
a650fc94d74905a9ddb211f12a6b1e8ff5b84c412c0ee74d4e58bfe2446d1e4c

SHA512
ed93cf83a28c951f5a85fa447b96391dde4d3f89eb55b82d9957af8e810176eb6aacb74c91c5c80571b5d48281e57a097b75e80b3f6a6ebd38d1e994be135074

Download Submit
C:\Windows\SysWOW64\Lkiqbl32.exe

Filesize
72KB

MD5
1908f1be4728502a5ca9317c0b254612

SHA1
28d48e23a1a2b74a6c86b916ff52c5fe1efa58ae

SHA256
6ef96bff9427e229557004d37e72fcaf8f7ab33d0af9c63bd19d155db56c485e

SHA512
5c0bf6e4a3dccd70dd4ed49737cdd89dcfe5ba8559430f8952b6c7498b38c2986114e57b28bb3c5092489c085e3dbe4c3f24fefc94f451d9157764c42fd1da76

Download Submit
C:\Windows\SysWOW64\Lnhmng32.exe

Filesize
72KB

MD5
6aceb3de7b47d58d45216aac09bb7716

SHA1
9ee6a093687f5fc29a724a6342480f15d8f337e3

SHA256
c57841c71900bd936c0b18189a007633c7dcf6a99a36bbf78125213b5ed23cf1

SHA512
86a85328b363c068a16f9eba9c438f69d5829ee2b7c340102a9e1cf2c7af3fa14fa3c3d81dbdcbe845d4731423d1ae15abec13f35febf793408f6bb6b6a001c1

Download Submit
C:\Windows\SysWOW64\Lpfijcfl.exe

Filesize
72KB

MD5
9485f29f2c88f1d6453fc543220e410a

SHA1
d91a35ec51dce40542d20d1561b89cd98207a0e5

SHA256
02e4ee2d37576b4baa519556d5430a1c9d3acf9a93cb24c9c3bb265dc4defe7b

SHA512
3b861f8137f7f3fd737bc80303391f50317790c4b36a204d7c82b692d2ed60a1973975fb9a5e532137d49fb402c9e400af010b3be5a2430be5ccf2b9b493f0e8

Download Submit
C:\Windows\SysWOW64\Lphfpbdi.exe

Filesize
72KB

MD5
aedf11a91491dbc4b368ac0aada5c4b1

SHA1
2ade0901d0ff561c72fc13a7d945723d770a0007

SHA256
97d64b74d11cf72519b29c04691713ab03836f75ab62fb80623c9e736594bc9d

SHA512
485b084447d09b030462b9d3f82e829fe9a5787ac959a427f06420611cd3096e1960719a2035e9d2ba2e4d4eb66f1763087e0576d1bdcff58cc59ac4a54b24e9

Download Submit
C:\Windows\SysWOW64\Maohkd32.exe

Filesize
72KB

MD5
4caded1cb5f3fbe7407e29513f5b3310

SHA1
bba724ce914163a8a38e464a13896acbc304c700

SHA256
076d6365666a2725dad59661ac27a4c8877d71440966bc005cbfaa0171b54b77

SHA512
e835ad2bca245c542708314bfc2a534046abad5b4b9e9c2689cf2606170be89045e21831918b3143165613cd681e5e116d7bfd324b93e98faada5077a8c55f25

Download Submit
C:\Windows\SysWOW64\Mcnhmm32.exe

Filesize
72KB

MD5
3779321ecc59acadef2630c43b1b285b

SHA1
8f9aeb227ca81f59e18453cecba8c9301c105eab

SHA256
534657d347b8f9db5c9f027c7cf1b25a154338776ce52ae59f46800181c5b579

SHA512
e122128745fa51029f0d14466b3ddf0b579e7e55d030b21187b259fd338c3699173cb92bc2fe170c3d8b096b5152d39eb7c478fd0f36d1d959ddd4df79d395f1

Download Submit
C:\Windows\SysWOW64\Mdfofakp.exe

Filesize
72KB

MD5
89284a75c8d9ef81d955b3d874679536

SHA1
777696d5086eb5d81b175260c2d2f23b1e6093a0

SHA256
1346569ac70d2d08c7e7a8c51d0337e24d9d7fe9d3020ed9fe1f3efb899ea51b

SHA512
8574bb6fc1987ebb60ce155c888848a121be62f58dc7b336ca94953657bfd319f3d5b2d8d2b0d93bf00dd3668c93307de7e7ae1bbe45e593ea45225f127cef72

Download Submit
C:\Windows\SysWOW64\Mdiklqhm.exe

Filesize
72KB

MD5
25e17e14fa9fd219159b7b6299674e09

SHA1
dc01a530bd5154bf87f68b7993fc46b0ef4d43dc

SHA256
52b54ddcf68c05fa0190cb05647741dd239f86530239ced9f6009f22f59e0c99

SHA512
8affe58d3b8e09f53c753d38929ea46b6496fff788816a082edac7377229e6ab71ba52b3c8b80d4371fc718d03ac6b26fc7302ceab17219068a1e7bc427764a3

Download Submit
C:\Windows\SysWOW64\Mglack32.exe

Filesize
72KB

MD5
2578050d2b51372affb68683380b0a2c

SHA1
5f19e8880a87de3146502c35f6f514bea965de77

SHA256
253dfeebb7d12ff44246aa2cf38380fb4c4039dc3985260c6470ec4af526d6e7

SHA512
dd192ee508763123f5bcde505cddb9f9e348591569b351b520115d0a4741a3e8823f34b1bb08da7727e87c762f0a8394d363b0968ce4bf321205d0aa455d1a6c

Download Submit
C:\Windows\SysWOW64\Mgnnhk32.exe

Filesize
72KB

MD5
15a5f01f66ffdcc4062d258587263e29

SHA1
e41e9246a86373942f232fbdab01962c4e783745

SHA256
349b7830c1eef28bc67231a52a0f50933401450676d4f676e488dd3c84de2e70

SHA512
f8f9a9fc78c96e2cb942b37e9c247a7dbda585a43d028b21f8e42c4157f023583f4124f9d88eb720d203fc73f1cd1838161e5101facb00d30628efdd7ab8006b

Download Submit
C:\Windows\SysWOW64\Mjhqjg32.exe

Filesize
72KB

MD5
2750f743e3062b346933eba5bd8f7c07

SHA1
e5f0033c93a959f07c2f2088f24f44361d3dd842

SHA256
809349262c704d1d40c91af8d89b1b2d8c6e6b15056c8ef020eafed9b17b6020

SHA512
1f8eb778e92f525f394fe0689f49b9999664a16c87d37070868382fe110be435ef523ff59bf5cc0bfa6958ace0d817e9dae59dc3dbfced55b95a79c9ae4afadc

Download Submit
C:\Windows\SysWOW64\Mkbchk32.exe

Filesize
72KB

MD5
0e080dd3e2d1aab3c40c9cdc4b30798c

SHA1
f08b93c217efb9b19353a1aec14ff842a8528654

SHA256
c6392163888e1d731522311d840a66522a28334827e27f5a46fc8ec3539ca8a3

SHA512
7b335ff55c81b8be85cee5d6a279e9186249ac0b98b22be3903b1d481e6e9f1313a0eb4bb20ad1e1d098c0b62b3b709c4e11148306612f44ff74b50a1d3a4f24

Download Submit
C:\Windows\SysWOW64\Mkpgck32.exe

Filesize
72KB

MD5
8b5180952d031e018ad16653f48fba57

SHA1
6dd0e26f0586159c7c87fb179640d53ebab1971e

SHA256
f01ecbbcd6a00c26a2361543a959692cfb77f2236f176e4d79d3fb98ce9a2d54

SHA512
833f9e21212fd50e120310b77bfa2e489e7a6e4b6f7fa1c63812fbeffead622b8b93546407f109f8db5fb6df204a65dc452b889f086a7d45b102f5c7d1c80ada

Download Submit
C:\Windows\SysWOW64\Mnfipekh.exe

Filesize
72KB

MD5
e10bc2c6b8aa4d88f8abb7d050cc3f7b

SHA1
c0d4145d657f6f79a6a6ab960d6ebd94447b968e

SHA256
8b6f10a3eb0004932501becd5a875f6c61cc3caa6fe7ca9ef32ebdde112f8de7

SHA512
70402e69d1c9026d016087117b21f6a81f0e26b37b80c2a07ca42ce0631545511f28ee99784f15bf43c2c20f9f8f1be8dfe33dcd271058adb64bd573a30031b0

Download Submit
C:\Windows\SysWOW64\Mnlfigcc.exe

Filesize
72KB

MD5
2fb47ed8b387c499a33c007ff158e5cf

SHA1
86b30ee7b88be761de229c385a1c13551e96b930

SHA256
48bc534aebb8c25c663e1b7ac577a6ee79f7083c75719fb0fc68d7fb7f5056c8

SHA512
18057a4f158cd0f834c9ca9cd48b0aedd96fecfd55e54e6c1bed73b2d0d3f705714db3490601bd543e59e95c724735ddc425ee6589f265fe29b8f155c59a513f

Download Submit
C:\Windows\SysWOW64\Mnocof32.exe

Filesize
72KB

MD5
ef0a0005c184681484c4b7537726d665

SHA1
49547de15479223effd22dba0aa491472fd12d98

SHA256
b9efdbd742892e9ced06f41c34d6f857c9d309876e3a3b2b79cb546a165df2e9

SHA512
243e2f933015572f7bcc8cdfcc96278bd78d2c83e75c8b8c0b8565e6c4ac1f8d78bf0a013a7080afde7bee63239561e6ce491f9ede574905993d6f2ca52332f1

Download Submit
C:\Windows\SysWOW64\Mpaifalo.exe

Filesize
72KB

MD5
fd06e327406b00b3769fc57766694f25

SHA1
76a949ce73899aa2bcb0aec7851b9833e486a0c9

SHA256
921b65fc9f3d68f002af82aeaa95a1c7e949104e548b69e0e6a3edae0c0d0c3a

SHA512
78467bf85eb0cd044a4cf7d498c6f6fde3db93a33e57d111be11bdbd4f240b36ef046c7497dc410b50ea74e203924b0680b2444b22ddde831fd5ecc7d7af1d66

Download Submit
C:\Windows\SysWOW64\Mpdelajl.exe

Filesize
72KB

MD5
a8330c4b4110ea3f5d57c0dfeb3950b9

SHA1
3fe39affff1f89cde2d582db0b9cf1adad4be7d6

SHA256
b43d4cf4ca5c3577fcd7088ab0645f67a5181b2cbe6049075d65d03a0121512e

SHA512
45c8c5bb2705cd920415b9523a613858b4f99f698946f9e9c9920e2a58cbe5b649dded18d4b616e9b883b331a95b11a65da8525e83d4fd7987a052dbe57092ac

Download Submit
C:\Windows\SysWOW64\Mpolqa32.exe

Filesize
72KB

MD5
f088c57582e11384f1d47410fde108e1

SHA1
69755161abe37c4c0e760c924943d5b3beb979bc

SHA256
04eb2e6577c777ff5e833e9c9c2bd03d053ae55fd00947bf51e4369974dd9f24

SHA512
e472fa08bfe52903bbbfc43829c3908b1e64f768bac3e30620403881037cd38b38be5316430084b735ffdf62c194b09ac128a7f053fd927ffb57926520976d17

Download Submit
C:\Windows\SysWOW64\Nacbfdao.exe

Filesize
72KB

MD5
f0b864ca35594906ce622803160a40ed

SHA1
ce624cf911e01c97285b1025fe46d1d049b33610

SHA256
b135f2b2ebf00f30c96abf0d6c1146b5be86363c6dd90f03ccfa955491591d8e

SHA512
4da7d3eedae52c29b83da9d89771529f211a01efecef4be903a14318dd3a09cf4a7369352ce102f38abdaef1c72a788b16e9a8b2a8e6f882f3775d09a24a4fa8

Download Submit
C:\Windows\SysWOW64\Nafokcol.exe

Filesize
72KB

MD5
1b8266ca6e433408d1f9724e9e29c2cb

SHA1
07197c346fc4c13f595c0e3253c5d46a21632f7d

SHA256
a0bf1648cf20fcfbfda548e68eb07de03ed0b595aa6e8d742f0b2207d5cc1987

SHA512
bddce786a7f229d6b26d668fad89c513200b8d364b3e690ed9226160d4f8f6670d69a358cf3982895592aa704046d6065accb9834c9be0a5b0ff79f72cf32e41

Download Submit
C:\Windows\SysWOW64\Nceonl32.exe

Filesize
72KB

MD5
4654e11a09a22d66226094e8adff9081

SHA1
38530007e7c4784e8eff67cb08e1a56b8bac0e30

SHA256
9365fb7d92eda3b34ce951d9640cf5c6bc809d988b626683d917a142106ee00e

SHA512
1864360773e13da08eed82adb3c7bd30f8bcdbb5cf7082a9827ad1b738cde720da367aba699df4cc4b702e9eac5b9436267cde1d037d864aba66a5ca9319b371

Download Submit
C:\Windows\SysWOW64\Ndghmo32.exe

Filesize
72KB

MD5
27d94841d01b272f90d876938cb2bda1

SHA1
eb1b7aa1c1f8affa8c178b07d27f3cad1b4bebe8

SHA256
74128d78a1662e43781f88c5c5f5a08943f930e2539254286968eb6817ed7170

SHA512
cbe3f11469a0ba9849a8fda82f1cbaf8742ca3d996589bc5d25618a2503efd6e08214e2052439e0197e814200b611c9f727fff78cd95f17e341e9d38164c7067

Download Submit
C:\Windows\SysWOW64\Ngcgcjnc.exe

Filesize
72KB

MD5
0cf6b69c827318764149a75b3b79c5d2

SHA1
761f0c651ca87a5e7ab3cfd83a30b2006d6b8bb5

SHA256
61ba77b3d52b361b97f96185d4dd46ae602be0005f9b3f0bb4e6d4c366cd0e73

SHA512
fc290aaabdaae26956f80865685b2ba707906acac3c6e77bf42be4566d6b3977d07cdb228dd91d41ef990b123cc6395e94b9480adbf0269ba9d43b3da7eea948

Download Submit
C:\Windows\SysWOW64\Njljefql.exe

Filesize
72KB

MD5
30bdc8aca422df2ee705458efb92be72

SHA1
8814319f28345a0245eb32fbfb1f09f70470d7c2

SHA256
800f5e1f12999ae6d3c70b8b8f2c9528dd552fe17e574f95e2d71f450a2b6791

SHA512
f358dde16f43b62bcb7caab07523efb85b70e47a708a5e57457e1927540d09e98c958be4a12d8648d9b028bf1920775ea25c13ce504a91e2f197e998e5a0bcc8

Download Submit
C:\Windows\SysWOW64\Nklfoi32.exe

Filesize
72KB

MD5
eb8f16b76d1ce25f8468f357c37d59d5

SHA1
cadb3c779d8b691dece114f7fa333a0f5bed827f

SHA256
96e440903f188c049dabb00c707f81cc75c33742e1f61880eeb6228a26065c54

SHA512
85cf4a65bc51c7bb6aba4bbd6db29b3bd426ec138d345b3abb05bd5bff22865d2e99b72d0e9cd12104f5c9e06d2088fb7b04617862c4a1f062ea374caa74ffc2

Download Submit
C:\Windows\SysWOW64\Nkqpjidj.exe

Filesize
72KB

MD5
11199482481aa02c8c7516cba7aa58a7

SHA1
b2beab7b4f05dc76e20d8d8d456ef8f601ef3b54

SHA256
a4fde62a9c180caf2e16428a43d99d43e0889a3dcf333917d621866c0299c6ae

SHA512
efcd39f76f174e47728cb34e581a18cd589d8d54f3a99d0ee827831e3497da004802e2db3fcdb1f6ae70a0020c0766e750f2a12058d31a957f3bfef128cea8d8

Download Submit
C:\Windows\SysWOW64\Nnmopdep.exe

Filesize
72KB

MD5
67009ab54d4a871e170f80e5736f823a

SHA1
902549370185f69bc9f87d9d11e830840ae48611

SHA256
6872312fcb7af0cd5dfad688c56b78cfbefd2f5ba619d9bfd9f9d265f03987ba

SHA512
30a742cb8de064cbecfa13c2df96f708ea950d791b60444b0be885c53beb8bb8bba08d5d9f809a6af745007d49f6e3fe6a4387f4af4636188f1dce5e3d434369

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
72KB

MD5
0b580006e9390a0ddcb86d6d851be12b

SHA1
0bf1ad2f22deadab308a44b30b781ee04f0348e1

SHA256
836f303690ab84e91c199d709f0df6624e650755608e187e04adca72b7fe7f6f

SHA512
d57025180d8251ae67378d054babd60ba1aa3af741650f9a36055a7866955c6f1f13777cb2eac64344b8c21971930612806a8760119299e5b48bdf9592d95937

Download Submit
C:\Windows\SysWOW64\Ojaelm32.exe

Filesize
72KB

MD5
ca1efa1fd30ebfa17b362eedd3aef3ce

SHA1
a9c849555838d953dc6f45a2176fcffdfb4901b4

SHA256
287a11cb3ee490a17b71c8a79576bead90a8718ad0f5cc02a5e575d192b2480f

SHA512
98464c1b37e835d1144c5ba4db40d0be41271603365960422f820057179e917e329f59a176d53548dcbbdfd0fa6b8509f472c357a926ccf6b83bade8dab7fa1b

Download Submit
C:\Windows\SysWOW64\Onhhamgg.exe

Filesize
72KB

MD5
141c73e439569c007ce41bfb79a2de77

SHA1
3be236a69049260a37850327cbefd5823cdc9d43

SHA256
4556ae00e35aa99f00547dbdb91320bdc83cd3d3cbae972998997c0539377848

SHA512
20ee285ceea8edbf83fafb09ba1ac035c89b6abad3616fb969d7ec090a625ff3a61bb157e9265ef43dee742fff2b532d3dce9027268093a709f08c1a711122e4

Download Submit
C:\Windows\SysWOW64\Pfhfan32.exe

Filesize
72KB

MD5
b7ed50614a39962f5ae183611b2d53f0

SHA1
d3e18513f74dd67ee901ff618ec6b9980f03f762

SHA256
4fac669924d37024bb4fe03977c90454927594d18d078be6178a66dc870547bf

SHA512
8c96af3198049227ed08fa895e88ae46e0ec075de69bdc0960ba17bfa8b94646ee278bac0cfee22806a2873c710fa1f8a7f1b6faf84b7ab26eca18f3c6aa5e23

Download Submit
C:\Windows\SysWOW64\Pjffbc32.exe

Filesize
72KB

MD5
23c44a88c6ddb5d3a1c85630d375ffa2

SHA1
f1b073c0bc3695375bdc01d6643c8366f5ed2afa

SHA256
a44edd573bea3fbac2d50aece8825f4fda8317efac2449a17872601dcdd2edba

SHA512
692b0ca411983d437980d4f72868c44b208cea2841944e7602b80597c25739f6d7477e7c19975ab4a94775405e5ffd5ca1b495c5cb6c5dadae11e6b4f60c59a9

Download Submit
C:\Windows\SysWOW64\Pmidog32.exe

Filesize
72KB

MD5
7153adb461e4765da24d5156138e2430

SHA1
b975e7d951561a26dc7a79103da4608fb03e7e6d

SHA256
6bf83808080ce0f77a715d43ce88f781d0c08901744670737d16c4e2a000d375

SHA512
fb73bd82b0ebb755ed45c4a408a6d7cfdbc71e5868ebb0918d8879539aca65209f6b2431017733c19b6f4fdc094208d8477eaf9985bd096153eefec3251e2f1a

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
72KB

MD5
0bd8de793a95218be7f5141bf9e3c6f9

SHA1
51da8aca756ed7fc7a802c3b846cc93caa62f2cc

SHA256
ffc02a6614fa67851f4471d60967256a6666788885e99a59ef52980405edd2e1

SHA512
9a8fd601751ba3b3eac0bb0db22b8abee8b6315769f41838737802c1cc7a024959bdeb8089728416d676795db0f0a128569191cd58417e0153b08600c61ba0cd

Download Submit
C:\Windows\SysWOW64\Qceiaa32.exe

Filesize
72KB

MD5
07d385e1cc0258f1f1fcd8c0bb22d6fb

SHA1
af96470537cf8545e18218f4b61d4203c8f28019

SHA256
fc3bf6d594aa3217a8ef9428cef62fa8cf46526e2e3900e9a69e9ede6d516e73

SHA512
e5b1d180b06759ec62cb8acb78777772517e72865f8f0cc78aae525e595312b76f6db6c0ba33e9c8a35c199a48a5ce7698d4814806408f8ec15fd1351ded008e

Download Submit
memory/212-547-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/212-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/380-329-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/448-299-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/612-321-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/656-579-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/656-48-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/708-152-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/712-128-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/840-413-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/912-509-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1168-240-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1204-136-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1212-96-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1328-401-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1388-564-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1420-455-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1460-436-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1572-305-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1628-544-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1740-287-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1784-64-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1784-593-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1792-188-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1796-247-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1900-119-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1912-479-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1960-40-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1960-572-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1988-200-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1992-473-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2120-577-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2124-146-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2184-93-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2196-389-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2204-467-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2264-236-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2356-590-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2416-423-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2420-584-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2524-111-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2528-407-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2588-341-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2732-485-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2752-281-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2760-353-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2844-533-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2944-377-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2952-275-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2980-443-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3044-497-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3112-551-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3116-262-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3168-461-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3184-23-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3252-175-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3344-311-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3380-347-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3448-79-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3484-586-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3484-56-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3504-340-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3520-103-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3524-552-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3524-12-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3716-491-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3728-323-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3736-503-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3760-168-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3864-521-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3900-454-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3928-399-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3980-260-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4064-425-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4088-383-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4140-71-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4140-594-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4180-213-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4276-553-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4396-159-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4500-515-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4564-365-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4624-266-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4636-359-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4644-274-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4724-566-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4728-531-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4740-293-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4764-36-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4804-371-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4824-437-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4964-559-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4964-28-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4972-216-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4984-192-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5092-229-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads