19f4a89a8cbd72b6eeed0ab4a3fb6baf326c00d23ad0acce876e385e8fc1068e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 23:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19f4a89a8cbd72b6eeed0ab4a3fb6baf326c00d23ad0acce876e385e8fc1068e_NeikiAnalytics.exe
Size

96KB
MD5

71e4f423251cf6defe1a9f4b9b460350
SHA1

3fb367e0477792256861b277973355f7549ae957
SHA256

19f4a89a8cbd72b6eeed0ab4a3fb6baf326c00d23ad0acce876e385e8fc1068e
SHA512

04af82a8bd82c0bc3bc5e33de9d6988a0b3588d8a4020c352f2359a6699b3179b9cf9ccc87560f43f440fe7fa10f8cc35b08204e2e206155a264bd033f5df618
SSDEEP

1536:48APgKWBlcxVvvWsLmprQVoXOCV22Lk18VJPXuhiTMuZXGTIVefVDkryyAyqX:48APgKcyVNmVQmda8PXuhuXGQmVDeCyW

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmjqmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnpemb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnlnon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnakhkol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbddcoei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckpjfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icnpmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kibnhjgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qgallfcq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daolnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iemppiab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Danecp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qecppkdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Elppfmoo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doqpak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edbklofb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Menjdbgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekhjmiad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkhbdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Helfik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkfoeega.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Deoaid32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghaliknf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnlhfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdolhc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dldpkoil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cehkhecb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmgfda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mchhggno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceaehfjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoiafcic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnebeogl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afoeiklb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdainc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edkdkplj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Neeqea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olcbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogogoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abpcon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icnpmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlmllkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cliaoq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olhlhjpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpmfddnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcjapi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdgdgnbm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbapjafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmkfhc32.exe

Executes dropped EXE 64 IoCs

pid	Process
5000	Kaqcbi32.exe
3968	Kbapjafe.exe
1404	Kkihknfg.exe
2012	Kmgdgjek.exe
1684	Kpepcedo.exe
540	Kbdmpqcb.exe
4984	Kkkdan32.exe
1728	Kmjqmi32.exe
2768	Kbfiep32.exe
764	Kmlnbi32.exe
740	Kcifkp32.exe
1372	Kibnhjgj.exe
2624	Kpmfddnf.exe
2852	Kkbkamnl.exe
4776	Lalcng32.exe
3012	Lcmofolg.exe
2244	Lmccchkn.exe
1920	Lcpllo32.exe
2892	Lkgdml32.exe
2192	Laalifad.exe
2816	Lgneampk.exe
3716	Lilanioo.exe
4200	Lpfijcfl.exe
4848	Lgpagm32.exe
2876	Ljnnch32.exe
1012	Lphfpbdi.exe
5096	Lgbnmm32.exe
2092	Mjqjih32.exe
968	Mahbje32.exe
1320	Mciobn32.exe
2412	Mkpgck32.exe
1592	Majopeii.exe
1468	Mdiklqhm.exe
392	Mamleegg.exe
4344	Mdkhapfj.exe
3116	Mgidml32.exe
4112	Mjhqjg32.exe
396	Mpaifalo.exe
3672	Mdmegp32.exe
2804	Mkgmcjld.exe
4320	Mnfipekh.exe
916	Maaepd32.exe
1548	Mdpalp32.exe
1288	Mgnnhk32.exe
1048	Njljefql.exe
4620	Nqfbaq32.exe
1560	Nceonl32.exe
5048	Njogjfoj.exe
1216	Nafokcol.exe
3940	Nddkgonp.exe
5060	Ngcgcjnc.exe
4832	Njacpf32.exe
2020	Nbhkac32.exe
1996	Nqklmpdd.exe
2032	Ncihikcg.exe
3608	Njcpee32.exe
4100	Nnolfdcn.exe
4584	Ndidbn32.exe
4104	Nggqoj32.exe
3408	Njfmke32.exe
3724	Nbmelbid.exe
3496	Ncnadk32.exe
2652	Okeieh32.exe
4328	Oqbamo32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Njacpf32.exe	Ngcgcjnc.exe
File opened for modification	C:\Windows\SysWOW64\Bblckl32.exe	Bdkcmdhp.exe
File created	C:\Windows\SysWOW64\Pfolbmje.exe	Pgllfp32.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Codhke32.dll	Mkgmcjld.exe
File opened for modification	C:\Windows\SysWOW64\Mnebeogl.exe	Menjdbgj.exe
File opened for modification	C:\Windows\SysWOW64\Nnlhfn32.exe	Neeqea32.exe
File created	C:\Windows\SysWOW64\Gfnphnen.dll	Aclpap32.exe
File created	C:\Windows\SysWOW64\Bahmfj32.exe	Aniajnnn.exe
File opened for modification	C:\Windows\SysWOW64\Kbhoqj32.exe	Kdeoemeg.exe
File opened for modification	C:\Windows\SysWOW64\Ncnadk32.exe	Nbmelbid.exe
File opened for modification	C:\Windows\SysWOW64\Ojopad32.exe	Okloegjl.exe
File created	C:\Windows\SysWOW64\Hoiafcic.exe	Hmjdjgjo.exe
File opened for modification	C:\Windows\SysWOW64\Jmbdbd32.exe	Jeklag32.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Ncihikcg.exe	Nqklmpdd.exe
File opened for modification	C:\Windows\SysWOW64\Cajcbgml.exe	Ckpjfm32.exe
File opened for modification	C:\Windows\SysWOW64\Dldpkoil.exe	Daolnf32.exe
File opened for modification	C:\Windows\SysWOW64\Hecmijim.exe	Hkkhqd32.exe
File created	C:\Windows\SysWOW64\Lmgfda32.exe	Likjcbkc.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Aeopki32.exe	Abpcon32.exe
File created	C:\Windows\SysWOW64\Acmflf32.exe	Aanjpk32.exe
File created	C:\Windows\SysWOW64\Jehokgge.exe	Jcgbco32.exe
File opened for modification	C:\Windows\SysWOW64\Dedkdcie.exe	Dahode32.exe
File created	C:\Windows\SysWOW64\Ghopckpi.exe	Gfpcgpae.exe
File opened for modification	C:\Windows\SysWOW64\Hoiafcic.exe	Hmjdjgjo.exe
File opened for modification	C:\Windows\SysWOW64\Oqdoboli.exe	Ojjffddl.exe
File opened for modification	C:\Windows\SysWOW64\Obfhba32.exe	Ojopad32.exe
File created	C:\Windows\SysWOW64\Balfaiil.exe	Bnnjen32.exe
File opened for modification	C:\Windows\SysWOW64\Lmgfda32.exe	Likjcbkc.exe
File created	C:\Windows\SysWOW64\Ehaaclak.dll	Pdkcde32.exe
File created	C:\Windows\SysWOW64\Knkkfojb.dll	Npcoakfp.exe
File created	C:\Windows\SysWOW64\Agoabn32.exe	Anfmjhmd.exe
File opened for modification	C:\Windows\SysWOW64\Okloegjl.exe	Ogaceh32.exe
File created	C:\Windows\SysWOW64\Dikngm32.dll	Pnpemb32.exe
File opened for modification	C:\Windows\SysWOW64\Aelcfilb.exe	Abngjnmo.exe
File opened for modification	C:\Windows\SysWOW64\Alkdnboj.exe	Adcmmeog.exe
File created	C:\Windows\SysWOW64\Bgdpie32.dll	Bajjli32.exe
File created	C:\Windows\SysWOW64\Pgefeajb.exe	Pdfjifjo.exe
File created	C:\Windows\SysWOW64\Ibhblqpo.dll	Mjqjih32.exe
File created	C:\Windows\SysWOW64\Kcbibebo.dll	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Cpnfbohh.dll	Pabkdmpi.exe
File created	C:\Windows\SysWOW64\Odmkog32.dll	Eoaihhlp.exe
File opened for modification	C:\Windows\SysWOW64\Hckjacjg.exe	Hkdbpe32.exe
File created	C:\Windows\SysWOW64\Ogogoi32.exe	Oqdoboli.exe
File opened for modification	C:\Windows\SysWOW64\Imakkfdg.exe	Iblfnn32.exe
File created	C:\Windows\SysWOW64\Klimip32.exe	Kepelfam.exe
File opened for modification	C:\Windows\SysWOW64\Ldoaklml.exe	Lmdina32.exe
File created	C:\Windows\SysWOW64\Neeqea32.exe	Ngbpidjh.exe
File opened for modification	C:\Windows\SysWOW64\Kbapjafe.exe	Kaqcbi32.exe
File created	C:\Windows\SysWOW64\Lalcng32.exe	Kkbkamnl.exe
File opened for modification	C:\Windows\SysWOW64\Balfaiil.exe	Bnnjen32.exe
File opened for modification	C:\Windows\SysWOW64\Cknnpm32.exe	Chpada32.exe
File created	C:\Windows\SysWOW64\Elppfmoo.exe	Edihepnm.exe
File created	C:\Windows\SysWOW64\Fkopnh32.exe	Fdegandp.exe
File created	C:\Windows\SysWOW64\Pnlaml32.exe	Ofeilobp.exe
File created	C:\Windows\SysWOW64\Cehkhecb.exe	Conclk32.exe
File opened for modification	C:\Windows\SysWOW64\Dadeieea.exe	Dkjmlk32.exe
File created	C:\Windows\SysWOW64\Gkoiefmj.exe	Ghaliknf.exe
File created	C:\Windows\SysWOW64\Cbcilkjg.exe	Cklaknjd.exe
File created	C:\Windows\SysWOW64\Hmjehihl.dll	Deoaid32.exe
File opened for modification	C:\Windows\SysWOW64\Dahode32.exe	Dllfkn32.exe
File opened for modification	C:\Windows\SysWOW64\Heocnk32.exe	Hbpgbo32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10440	10360	WerFault.exe	498

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkihknfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbdmpqcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkfoeega.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejckel32.dll"	Jmknaell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfckahdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjhilj32.dll"	Gbbkaako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmbdbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjiccacq.dll"	Migjoaaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pbddcoei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Habmmpbg.dll"	Ajneip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cecbmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gebgohck.dll"	Lffhfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naekcf32.dll"	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlaqpipg.dll"	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pndohaqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehimanbq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifjigbdo.dll"	Hkkhqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kedoge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aomaga32.dll"	Lmgfda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpjlklok.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Balfaiil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chdkoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpflfc32.dll"	Anpncp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkkhqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojhnmh32.dll"	Klljnp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lalcng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgpagm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Addjcmqn.dll"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oepgml32.dll"	Bdfibe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbjiol32.dll"	Mibpda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hoiafcic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjqkei32.dll"	Ikbnacmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anbkio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aniajnnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfbcpl32.dll"	Cecbmf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flceckoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmjlcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klljnp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpgfooop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kedoge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfggmg32.dll"	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlcifmbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeiakn32.dll"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgopffec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdmlkkap.dll"	Pbddcoei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgdpie32.dll"	Bajjli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghaliknf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmppcbjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lifenaok.dll"	Mahbje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojopad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Elppfmoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edbklofb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjlogcip.dll"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddpeoafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hoiafcic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojleohnl.dll"	Kbfbkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhgaocmg.dll"	Kfckahdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncbknfed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfnphn32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 5000	4656	19f4a89a8cbd72b6eeed0ab4a3fb6baf326c00d23ad0acce876e385e8fc1068e_NeikiAnalytics.exe	81
PID 4656 wrote to memory of 5000	4656	19f4a89a8cbd72b6eeed0ab4a3fb6baf326c00d23ad0acce876e385e8fc1068e_NeikiAnalytics.exe	81
PID 4656 wrote to memory of 5000	4656	19f4a89a8cbd72b6eeed0ab4a3fb6baf326c00d23ad0acce876e385e8fc1068e_NeikiAnalytics.exe	81
PID 5000 wrote to memory of 3968	5000	Kaqcbi32.exe	82
PID 5000 wrote to memory of 3968	5000	Kaqcbi32.exe	82
PID 5000 wrote to memory of 3968	5000	Kaqcbi32.exe	82
PID 3968 wrote to memory of 1404	3968	Kbapjafe.exe	83
PID 3968 wrote to memory of 1404	3968	Kbapjafe.exe	83
PID 3968 wrote to memory of 1404	3968	Kbapjafe.exe	83
PID 1404 wrote to memory of 2012	1404	Kkihknfg.exe	84
PID 1404 wrote to memory of 2012	1404	Kkihknfg.exe	84
PID 1404 wrote to memory of 2012	1404	Kkihknfg.exe	84
PID 2012 wrote to memory of 1684	2012	Kmgdgjek.exe	85
PID 2012 wrote to memory of 1684	2012	Kmgdgjek.exe	85
PID 2012 wrote to memory of 1684	2012	Kmgdgjek.exe	85
PID 1684 wrote to memory of 540	1684	Kpepcedo.exe	86
PID 1684 wrote to memory of 540	1684	Kpepcedo.exe	86
PID 1684 wrote to memory of 540	1684	Kpepcedo.exe	86
PID 540 wrote to memory of 4984	540	Kbdmpqcb.exe	87
PID 540 wrote to memory of 4984	540	Kbdmpqcb.exe	87
PID 540 wrote to memory of 4984	540	Kbdmpqcb.exe	87
PID 4984 wrote to memory of 1728	4984	Kkkdan32.exe	88
PID 4984 wrote to memory of 1728	4984	Kkkdan32.exe	88
PID 4984 wrote to memory of 1728	4984	Kkkdan32.exe	88
PID 1728 wrote to memory of 2768	1728	Kmjqmi32.exe	89
PID 1728 wrote to memory of 2768	1728	Kmjqmi32.exe	89
PID 1728 wrote to memory of 2768	1728	Kmjqmi32.exe	89
PID 2768 wrote to memory of 764	2768	Kbfiep32.exe	90
PID 2768 wrote to memory of 764	2768	Kbfiep32.exe	90
PID 2768 wrote to memory of 764	2768	Kbfiep32.exe	90
PID 764 wrote to memory of 740	764	Kmlnbi32.exe	92
PID 764 wrote to memory of 740	764	Kmlnbi32.exe	92
PID 764 wrote to memory of 740	764	Kmlnbi32.exe	92
PID 740 wrote to memory of 1372	740	Kcifkp32.exe	94
PID 740 wrote to memory of 1372	740	Kcifkp32.exe	94
PID 740 wrote to memory of 1372	740	Kcifkp32.exe	94
PID 1372 wrote to memory of 2624	1372	Kibnhjgj.exe	95
PID 1372 wrote to memory of 2624	1372	Kibnhjgj.exe	95
PID 1372 wrote to memory of 2624	1372	Kibnhjgj.exe	95
PID 2624 wrote to memory of 2852	2624	Kpmfddnf.exe	96
PID 2624 wrote to memory of 2852	2624	Kpmfddnf.exe	96
PID 2624 wrote to memory of 2852	2624	Kpmfddnf.exe	96
PID 2852 wrote to memory of 4776	2852	Kkbkamnl.exe	97
PID 2852 wrote to memory of 4776	2852	Kkbkamnl.exe	97
PID 2852 wrote to memory of 4776	2852	Kkbkamnl.exe	97
PID 4776 wrote to memory of 3012	4776	Lalcng32.exe	98
PID 4776 wrote to memory of 3012	4776	Lalcng32.exe	98
PID 4776 wrote to memory of 3012	4776	Lalcng32.exe	98
PID 3012 wrote to memory of 2244	3012	Lcmofolg.exe	99
PID 3012 wrote to memory of 2244	3012	Lcmofolg.exe	99
PID 3012 wrote to memory of 2244	3012	Lcmofolg.exe	99
PID 2244 wrote to memory of 1920	2244	Lmccchkn.exe	100
PID 2244 wrote to memory of 1920	2244	Lmccchkn.exe	100
PID 2244 wrote to memory of 1920	2244	Lmccchkn.exe	100
PID 1920 wrote to memory of 2892	1920	Lcpllo32.exe	102
PID 1920 wrote to memory of 2892	1920	Lcpllo32.exe	102
PID 1920 wrote to memory of 2892	1920	Lcpllo32.exe	102
PID 2892 wrote to memory of 2192	2892	Lkgdml32.exe	103
PID 2892 wrote to memory of 2192	2892	Lkgdml32.exe	103
PID 2892 wrote to memory of 2192	2892	Lkgdml32.exe	103
PID 2192 wrote to memory of 2816	2192	Laalifad.exe	104
PID 2192 wrote to memory of 2816	2192	Laalifad.exe	104
PID 2192 wrote to memory of 2816	2192	Laalifad.exe	104
PID 2816 wrote to memory of 3716	2816	Lgneampk.exe	105

C:\Users\Admin\AppData\Local\Temp\19f4a89a8cbd72b6eeed0ab4a3fb6baf326c00d23ad0acce876e385e8fc1068e_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\19f4a89a8cbd72b6eeed0ab4a3fb6baf326c00d23ad0acce876e385e8fc1068e_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Windows\SysWOW64\Kaqcbi32.exe
  C:\Windows\system32\Kaqcbi32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\SysWOW64\Kbapjafe.exe
    C:\Windows\system32\Kbapjafe.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3968
  - - C:\Windows\SysWOW64\Kkihknfg.exe
      C:\Windows\system32\Kkihknfg.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1404
    - - C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2012
      - C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1728
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2768
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:764
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1372
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2892
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2816
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        23⤵
        Executes dropped EXE
        
        PID:3716
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        24⤵
        Executes dropped EXE
        
        PID:4200
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4848
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        26⤵
        Executes dropped EXE
        
        PID:2876
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        27⤵
        Executes dropped EXE
        
        PID:1012
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        28⤵
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2092
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:968
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        31⤵
        Executes dropped EXE
        
        PID:1320
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        32⤵
        Executes dropped EXE
        
        PID:2412
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        33⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1468
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        35⤵
        Executes dropped EXE
        
        PID:392
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        36⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3116
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4112
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        39⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        40⤵
        Executes dropped EXE
        
        PID:3672
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2804
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        42⤵
        Executes dropped EXE
        
        PID:4320
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        43⤵
        Executes dropped EXE
        
        PID:916
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        44⤵
        Executes dropped EXE
        
        PID:1548
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1288
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        46⤵
        Executes dropped EXE
        
        PID:1048
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        47⤵
        Executes dropped EXE
        
        PID:4620
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        48⤵
        Executes dropped EXE
        
        PID:1560
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        49⤵
        Executes dropped EXE
        
        PID:5048
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1216
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        51⤵
        Executes dropped EXE
        
        PID:3940
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5060
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        53⤵
        Executes dropped EXE
        
        PID:4832
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        54⤵
        Executes dropped EXE
        
        PID:2020
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1996
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        56⤵
        Executes dropped EXE
        
        PID:2032
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        57⤵
        Executes dropped EXE
        
        PID:3608
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        58⤵
        Executes dropped EXE
        
        PID:4100
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4584
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4104
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        61⤵
        Executes dropped EXE
        
        PID:3408
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3724
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        63⤵
        Executes dropped EXE
        
        PID:3496
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        64⤵
        Executes dropped EXE
        
        PID:2652
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        65⤵
        Executes dropped EXE
        
        PID:4328
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        66⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        67⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        68⤵
        Drops file in System32 directory
        
        PID:4868
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        69⤵
        Drops file in System32 directory
        
        PID:3556
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:816
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        71⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        72⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        73⤵
        Drops file in System32 directory
        
        PID:920
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        74⤵
        Drops file in System32 directory
        
        PID:4572
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        75⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2512
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        76⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        77⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        78⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        79⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2696
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        81⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1640
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        83⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        84⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        85⤵
        
        PID:884
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        86⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        87⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        88⤵
        Modifies registry class
        
        PID:1428
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        89⤵
        Drops file in System32 directory
        
        PID:3416
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        90⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        91⤵
        
        PID:952
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        92⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        93⤵
        Modifies registry class
        
        PID:3552
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2916
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2100
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2988
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        97⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        98⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        99⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        100⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        101⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        102⤵
        Modifies registry class
        
        PID:4304
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        103⤵
        Drops file in System32 directory
        
        PID:1712
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        104⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        105⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        106⤵
        Modifies registry class
        
        PID:5136
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        107⤵
        Drops file in System32 directory
        
        PID:5200
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        108⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        109⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        110⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5396
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        112⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        113⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        114⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        115⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        116⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        117⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        118⤵
        Drops file in System32 directory
        
        PID:5804
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        119⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        120⤵
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        121⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        122⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        123⤵
        Modifies registry class
        
        PID:6048
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        124⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6132
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        126⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        127⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        128⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        129⤵
        Drops file in System32 directory
        
        PID:5380
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        130⤵
        Modifies registry class
        
        PID:5512
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        131⤵
        Drops file in System32 directory
        
        PID:5580
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        132⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        133⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5856
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        135⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        136⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6084
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5144
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        139⤵
        Drops file in System32 directory
        
        PID:5276
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        140⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5540
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        142⤵
        Drops file in System32 directory
        
        PID:5704
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        143⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        144⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        145⤵
        Modifies registry class
        
        PID:6072
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5172
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        147⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        148⤵
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        149⤵
        Drops file in System32 directory
        
        PID:5916
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5168
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        151⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5872
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2424
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5716
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        155⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        156⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        157⤵
        Modifies registry class
        
        PID:6152
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        158⤵
        Drops file in System32 directory
        
        PID:6192
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        159⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6276
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        161⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        162⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        163⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        164⤵
        Drops file in System32 directory
        
        PID:6448
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        165⤵
        Drops file in System32 directory
        
        PID:6488
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        166⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        167⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        168⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        169⤵
        Drops file in System32 directory
        
        PID:6656
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6696
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        171⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        172⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6824
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        174⤵
        Drops file in System32 directory
        
        PID:6868
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        175⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        176⤵
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6992
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        178⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        179⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        180⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        181⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6216
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        183⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        184⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        185⤵
        Drops file in System32 directory
        
        PID:6444
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        186⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        187⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6636
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        189⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        190⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        191⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        192⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        193⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        194⤵
        Modifies registry class
        
        PID:7096
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        195⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        196⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6208
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        198⤵
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        199⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        200⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        201⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        202⤵
        Drops file in System32 directory
        
        PID:6732
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        203⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        204⤵
        Modifies registry class
        
        PID:7016
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        205⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7164
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        207⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        208⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        209⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        210⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        211⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        212⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        213⤵
        Drops file in System32 directory
        
        PID:6484
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        214⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6980
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        217⤵
        Drops file in System32 directory
        
        PID:6860
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        218⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        219⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        220⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        221⤵
        Modifies registry class
        
        PID:7212
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        222⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        223⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        224⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7336
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        225⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        226⤵
        Drops file in System32 directory
        
        PID:7440
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7484
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        228⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        229⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        230⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        231⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        232⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        233⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        234⤵
        Modifies registry class
        
        PID:7788
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        235⤵
        Drops file in System32 directory
        
        PID:7828
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        236⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        237⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        238⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8004
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8048
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        241⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        242⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        243⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        244⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        245⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        246⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        247⤵
        Modifies registry class
        
        PID:7408
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        248⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        249⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        250⤵
        Drops file in System32 directory
        
        PID:7604
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        251⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        252⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        253⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        254⤵
        Drops file in System32 directory
        
        PID:7884
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        255⤵
        Modifies registry class
        
        PID:7956
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        256⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        257⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        258⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        259⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        260⤵
        Drops file in System32 directory
        
        PID:7276
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        261⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        262⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        263⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        264⤵
        Modifies registry class
        
        PID:7836
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        265⤵
        Modifies registry class
        
        PID:8012
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        266⤵
        Modifies registry class
        
        PID:8156
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        267⤵
        Modifies registry class
        
        PID:7288
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7600
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        269⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        270⤵
        Drops file in System32 directory
        
        PID:7332
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        271⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        272⤵
        Modifies registry class
        
        PID:7984
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        273⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        274⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        275⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        276⤵
        Modifies registry class
        
        PID:8216
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        277⤵
        Modifies registry class
        
        PID:8260
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        278⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        279⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        280⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        281⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        282⤵
        Drops file in System32 directory
        
        PID:8484
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        283⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        284⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        285⤵
        Drops file in System32 directory
        
        PID:8616
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8652
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        287⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8748
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        289⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        290⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        291⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        292⤵
        Modifies registry class
        
        PID:8916
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8956
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        294⤵
        Modifies registry class
        
        PID:9004
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        295⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        296⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        297⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        298⤵
        Modifies registry class
        
        PID:9176
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        299⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        300⤵
        Modifies registry class
        
        PID:8248
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        301⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        302⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8480
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8536
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        305⤵
        Drops file in System32 directory
        
        PID:8608
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8672
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        307⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        308⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8884
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        310⤵
        Drops file in System32 directory
        
        PID:8964
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8980
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9068
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        313⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        314⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        315⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        316⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        317⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        318⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        319⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8836
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        321⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        322⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        323⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        324⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8432
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        326⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        327⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        328⤵
        Modifies registry class
        
        PID:9024
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        329⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        330⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        331⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8944
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        333⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        334⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        335⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        336⤵
        Drops file in System32 directory
        
        PID:8408
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        337⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        338⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        339⤵
        Drops file in System32 directory
        
        PID:9296
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        340⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        341⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        342⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9464
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        344⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9552
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9596
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        347⤵
        Drops file in System32 directory
        
        PID:9636
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        348⤵
        Modifies registry class
        
        PID:9676
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        349⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        350⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        351⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        352⤵
        Drops file in System32 directory
        
        PID:9856
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        353⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        354⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        355⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        356⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        357⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        358⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        359⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        360⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        361⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        362⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        363⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        364⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        365⤵
        Drops file in System32 directory
        
        PID:9508
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        366⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        367⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9696
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        369⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9816
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        371⤵
        Drops file in System32 directory
        
        PID:9840
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        372⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10052
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:860
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        375⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        376⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        377⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        378⤵
        Modifies registry class
        
        PID:9240
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        379⤵
        Modifies registry class
        
        PID:9372
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        380⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        381⤵
        Modifies registry class
        
        PID:9572
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        382⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        383⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        384⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        385⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        386⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        387⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        388⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        389⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        390⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        391⤵
        Modifies registry class
        
        PID:9760
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        392⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        393⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        394⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9288
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        396⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9800
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        398⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        399⤵
        Drops file in System32 directory
        
        PID:9236
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9704
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        401⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        402⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        403⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        404⤵
        Drops file in System32 directory
        
        PID:9968
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        405⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        406⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        407⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        408⤵
        Modifies registry class
        
        PID:10324
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        409⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10360 -s 420
        410⤵
        Program crash
        
        PID:10440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 10360 -ip 10360
1⤵
PID:10416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acmflf32.exe

Filesize
96KB

MD5
66219fef49b6c294fb2530f551608241

SHA1
2d369b2d9d26800322c459fdec35a18509aedf6e

SHA256
d777cc4c5f584e37ab6d17a1e34bfe962f563dee3cd4d6400fdc3f26aa4a66cb

SHA512
0d4f8ddfab213ddae191ba2705ce43f56de6727239b193706246f9bf1520c740c2a7b4bc3dd5c0d9796a5d1ad4bf92489a554590c8eaef248ca3f4f09d4260c3

Download Submit
C:\Windows\SysWOW64\Agoabn32.exe

Filesize
96KB

MD5
6bd5905527b9ba64ee5d913c5a19081a

SHA1
b3dd34cc0c048e706dcf300ede816c140efefc7c

SHA256
88fb908b6af05fde333ab32d404324059553dafd668d818a50c3d129965c11b8

SHA512
7e26bb4f6cb25d27e42e9698eebfefe2a4e46bcfe94052ed8a6f1ef0bfdc46ae196d02a82eb69863082c382a3e166f94450a269c6b80000f23a2c1a18472ad40

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
96KB

MD5
ca162651db70b05f35d30c9130b19bc6

SHA1
bce14f77d124ac096c4e05ff6bb55a15a1c89358

SHA256
8fefb85467d588e2f64c785c0ca864ebccfff53ec7b7f6fe1dd89f125ac0e08f

SHA512
c89045ac3a5acca472142239dd7f6cec0ebbf3de182e1f616cdd2ea8cb6a76eeb42bc37601272449cbf4af5dd0a716b8ebcf3b72200c67ea596108ce63219713

Download Submit
C:\Windows\SysWOW64\Alabgd32.exe

Filesize
96KB

MD5
6a36c66b11842338e1ca9b8f0233ff45

SHA1
d94c9a2abe385609e714843d592bd683d5829d08

SHA256
510b1b07947b3b0b5087f718c08035abeeca1138faa0adc9cc7634657257b65b

SHA512
9c8bd660db7ee9fad5b46d102238c5e7c8a7f2d5a0292e2bc217685fe3df06358afcac43c46fd2d724fcad494ece30f490a9b95fd9ee5bfecc03c3ace80521e3

Download Submit
C:\Windows\SysWOW64\Baicac32.exe

Filesize
96KB

MD5
37cab9039e9a55ae8633dc8a7e955c27

SHA1
f7eff84c0657a93ae788651ab693c995f8e5ac1c

SHA256
7f8b207ec687ddbc7622fb062bf64af74dda6bfa7ee4f5479b1ab391f4913828

SHA512
2bf5e6c3f0f23f77210c45b1878e93751cfce552ba95a3a454bbceec254e1454b98c701ccce04da7687c4bda30cb8728c3dc8c154c5018fc05d61531d91b5148

Download Submit
C:\Windows\SysWOW64\Bajjli32.exe

Filesize
96KB

MD5
9aa829cbe11d34403d07616367dfa8af

SHA1
5d86868477e7f5f2dbbd9eeeaaf78a621f31b3ec

SHA256
b66b11ded9b11dac7d27b8f2e588da16db25a0cfc4a4e3c52b6df9ba0783f053

SHA512
f33a36adc4b3b15cbe772f0b029a8af85a4466e0010b09da741f337c7020ef6a90f143b8f3c4ea5e68666f801c3e0a36f45df63312d7a9e51ee6873885a3dafc

Download Submit
C:\Windows\SysWOW64\Bblckl32.exe

Filesize
96KB

MD5
3547df211618119425451632d4cd9345

SHA1
347a44484d40354b286cd9d0219ba6e6d2f787cc

SHA256
6659a62c7f4893adb28c32248b2b6bf5d968dccd7a6137b479fe39e7fde99801

SHA512
6c72ef12a2499bce02822e00ab3f86733cfa3b77d637e85ce7b19e4cf1e400986285afd59c9aa615c8778434706f02d2715adf1f20f698d84d7308dcc8801499

Download Submit
C:\Windows\SysWOW64\Bclhhnca.exe

Filesize
96KB

MD5
0aee2044120f367db97fda4f2f4e4880

SHA1
3aaaead08603e0c8ca3f8a2378696bbf90cad7ec

SHA256
e4a56b01f2b5442c312ac924f30eb5f2708e187461c18dbff0eedf0a6de72092

SHA512
ddabe66cd0f3da90023cbc9bb88e7e31fff855179c6e1a2e6826819fddba910fa21c57ff0fe3a79f23dada6b665eb1eed3a558388bb8fef04e03dd5ca4e39336

Download Submit
C:\Windows\SysWOW64\Bdolhc32.exe

Filesize
96KB

MD5
5fada12dd8aaddf003898d1ad3b62dec

SHA1
f5f4bb22cfdf83f8c90885962e1eb1ce1749a2c3

SHA256
11022f16944e8c84d04edbae3dffef53e5cbf86e264a2aa2128f81389ceb8a88

SHA512
dc8ec68076cf6be97c812c9c4a1c7683c0e671338520d1efaaae304d9b6f3fe3d0e69d43c43b841da20daab1ec27493171a89a11187accde8e228fef460ee1c2

Download Submit
C:\Windows\SysWOW64\Bhaebcen.exe

Filesize
96KB

MD5
e03882f65f94ef40b74407dab7fccbcc

SHA1
23b943665c78c68581fa292a51f5d49ba3941374

SHA256
2ce527dca0eecb6eeb373cc38c7e6bf6b1224dce154d481bbf6dd9a3f850a9da

SHA512
f8ce59eb3653049979f6f9a368aaa93a44264b68dcc55cac6dbb3c045291298b3c70e4c28662282b6560af3e866cddb255f63ff546283f772273e8da551a911c

Download Submit
C:\Windows\SysWOW64\Bnmcjg32.exe

Filesize
96KB

MD5
41438e366458873fdec0e936d912cdab

SHA1
56f19125bb7059f0ba6d79497d5591a98268b2c5

SHA256
df23ad61e58e77b7ea789ac248f3a317d6971391ef317392ac17e7387a3d3e49

SHA512
24283b895d16bea7f63238bcdf90802c42fe7037b6a6b1f0545489b4a8e6252e1bfeb95a7677e5f38457b1cdb037cc8bf31bf3706a8cfe943006f5e65309b685

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
96KB

MD5
0b1dd00c3d5deddf4f3b4441a900b85f

SHA1
d5f72524eedef1fba196575a5e6a7e94fe45f068

SHA256
6728b9fe7d191426c77d6a4ea186079096036f5c7c2efc9bcb26a47295d2fe81

SHA512
54b59d0073ff14e82c4052ec30519dbb9482a9b16572c64b70f444e7888e2045de538d5dd861d366e4cb9d69fb2e3dadd57d003835421903aa504982b41e6af6

Download Submit
C:\Windows\SysWOW64\Cecbmf32.exe

Filesize
96KB

MD5
0c610447a48ca719cdcaea36c8ac52a0

SHA1
cedb1e6858ce3d1da746fcc9a854f0deee2d186e

SHA256
bab6269844c2d5f1145dcb26abe4d6ae2c219d76473b6fdbe1304edda29cb36f

SHA512
7468212b8ae6d14d5998c22b7a4d9f8cc6003debee3cd474d4b0a4963ec598b4b2f42674b1ac5e1b9cdfe5473e1b72bc18ec1d93885a74ed5da2bfc57987ce89

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
96KB

MD5
1d559399aa996bfbaf7c3616d41b6986

SHA1
834061a3645c4b3744d5c5f4a31cafbbc9da2ff2

SHA256
795a46be1d3bd9c0b666f4e2d203b8b24976179ad7f0d6d1b13309e6afc31133

SHA512
5ffe3ca73fa033399e6c3634d29ecd166db6e87276a85fda71f36112fdd079c0ca7ff6baeb462afe0c65f74078eb86e03850d981c78dcff2db273903232d702c

Download Submit
C:\Windows\SysWOW64\Daolnf32.exe

Filesize
96KB

MD5
e6f24a47a7671d86d8a41c8487908b9f

SHA1
9cc63df156c8b3a8f50a4a8c80a3d4970ba34b51

SHA256
72f0709729556990751ab225d885173eb20b5730d1c80c77699c79fc15b98f45

SHA512
001df2f53bab3d5c0d52d713a9a4975dcd4cc7ecc0a588efd450324665f8e4e625172b7de0bfe3a5956c8ef1df9fbb4b57f1645b198283167388ee70269a324a

Download Submit
C:\Windows\SysWOW64\Deoaid32.exe

Filesize
96KB

MD5
be1b645f7b50791adf6c1472fbe7dfd4

SHA1
436060196b2f3ba8bc1058e77bff4cf716bc825a

SHA256
209ba904c98e81b4eb8d8829091ef8cad28093c3ba1f00bd2a6a804f2ad62021

SHA512
f32130588845dd9eb9fb8ae5176119c58be88f478036e2fc1d66a7cd8609006b4dbd96579554204f9181fd9f172bf2edd443a307ab0cc523e3ef94b06191238e

Download Submit
C:\Windows\SysWOW64\Dllfkn32.exe

Filesize
96KB

MD5
83a9a2d4d0cd2021855419c0f4e103d5

SHA1
14ad1bef7618ec63f7f4782c682ec94d3f977c1b

SHA256
aef760ebdea1d18f455ec74dcad706ae3b30ce7655adaf227cf551ae0a8a7e00

SHA512
67bdeed0d627d0df24588388770d04cd21bc9c5b4f9206161748901fbc80c5efcbcd921379178058f0a4497b84c6a0857f83ce7c7f7ea765d900a3a8e4b28ce2

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
96KB

MD5
e5a0330a02cd9484f2f5656707bee9d3

SHA1
b3b0a6007b6e03a13f85a6ca87e596149526be01

SHA256
e4c6043d255b54de47812722752ce00099b59bee296738557b0e6fc5f8d0d895

SHA512
deee2315c0df261a3c39e0166168526505a9b027224bd1df9a2abfa31b5778eaa6c8945fc1b6f160d8ddb5ee018546ce21b60fb90ea911d819dfce664693a64e

Download Submit
C:\Windows\SysWOW64\Eamhodmf.exe

Filesize
96KB

MD5
367b35b69b6eaad8a01030ba357af925

SHA1
c048025a7e67f1a3b0cd6491a1b5670efcfb7cec

SHA256
107ad5d40f9945440bd84d2610386b9fc12147b3b89d7af5b3a1b67bc3ec8c64

SHA512
5da807d9069610297df46931e62fe2339c443e63b131ed658f6590c6c88fe20c0fb8c033dad59b507d363331c7aa35b2eb37558d1fe563fe0af75c4afa810ca1

Download Submit
C:\Windows\SysWOW64\Eemnjbaj.exe

Filesize
96KB

MD5
c26dc28974d38648104ac9265ab0f28c

SHA1
38d879f6396dcb2d8b06120190333357c174d521

SHA256
c5370636ed909b2569efd0908097bd7b05865cf29345a8b5dfb5b35b2abb694c

SHA512
d5589bcb57b3ea6a91fe6e08d49d8e84bcf99355b8030685fd65169ff5e1dc01c657ed8becd1b34f1f47f45163178dada404602a3430ee34fc02a23c50e2532f

Download Submit
C:\Windows\SysWOW64\Ehimanbq.exe

Filesize
96KB

MD5
f2ddfe4c27f1f7ce9b12746958729587

SHA1
88cdff384cf01e44329fcb4be8c364f22a741334

SHA256
8813c5340d62fd01b90570e510794c696b13da04008bd571c93f8425a868a7ee

SHA512
b4704e2b2952c76eb5537c8419f90244920de34228e99a0b48a060395471db0013d334715509010fc3da4b27e047432f9e87d55d60c3c8ea0cfa46bbfb04c84b

Download Submit
C:\Windows\SysWOW64\Fcckif32.exe

Filesize
96KB

MD5
b5940febf8058d37753954815531f578

SHA1
099963acb0ea56485fe7fdcf9a2e834e19873d0b

SHA256
dee69da2919d106bc5854045e438f33959a012bc2830ec5e3044bdfed13b4926

SHA512
502ee318ae6619054500cb332cf87e2fcebd46628042a06544bab0ad36635c44da510b9f8df24456f955ac848ba1723d2cd1f17145123f6bd3e042e53435e2f0

Download Submit
C:\Windows\SysWOW64\Gcimkc32.exe

Filesize
96KB

MD5
6bacd15c2b842f5c93bef718e3bdafd4

SHA1
78b090772f5314d6ab2432eae96813e9c5a3214d

SHA256
d325b2107dfb314546d7f6d98da2c998d408f288e49a95990bf6132b30b6f5ed

SHA512
fa76e15c3f8f45f170a359202915bf42ebc2851b4890a402f4e50628cfc0c22e88b82a1eb433f154dac72bb4111340d52a135ad02a60a309292d8b6d9015d9f2

Download Submit
C:\Windows\SysWOW64\Ghaliknf.exe

Filesize
96KB

MD5
6aa30c08cad6974ba0c505fc00f52caa

SHA1
5a098e2d731426ff9d7567499aacc3f5d6ddcd0d

SHA256
b904ee33ff1311a38903ed01ac05d0cd9c398d5e54c5aa90622140b45bd0592b

SHA512
5e6469741b853f0780de0c567dd5d827f7f52756d9b05c9bc033cb245c23e7042fdcafac82c34df6b5ee97248fac539c4521de54a43159886765481d6985a972

Download Submit
C:\Windows\SysWOW64\Gmjlcj32.exe

Filesize
96KB

MD5
f8de1666f9db0f267cd93ea19a94cf13

SHA1
42930d78451221b4d9d19824378766c100281e3c

SHA256
9de68953756037eeab9ca669ce3a44e36b13aaaec635cd701faf84d5bd4fabab

SHA512
eb6ced24a3419c19d90fb0d719ebd55cf31e93316e8d3e70828641e948047badb07a6eefd1a178e2d0ba8ee06906e565a42d18aa428642eb788c69f4099d14aa

Download Submit
C:\Windows\SysWOW64\Hecmijim.exe

Filesize
96KB

MD5
250338a03ae82bc860b681dbd5bd4f96

SHA1
fef792750552cfed5e1b9459890f79eaed59780e

SHA256
0cf8a0ea58fed91d5552b4fbee7ba9eaa147be5857f0092e982a9dfe26fefbe7

SHA512
c2aae63a690cbef4256db3b5f098da7e24dd396647b274253e7ee67463a12af322e4f4d1d088a339506d9943cc4531e4fe6f63bffdf3cf0f85d43b00b8bd7331

Download Submit
C:\Windows\SysWOW64\Heocnk32.exe

Filesize
96KB

MD5
2fdbfec3d6a98b89989e281e6429703e

SHA1
a2581e79cf8c7dc338238705559ff95849b51503

SHA256
8f689700d18225bf4de68d1bc26800f6ba7f51fb6363ba53cd64cc04610bc33f

SHA512
9760b3f75cb531e5aaff57384d2b62915a557eacf4034cdb7f0ca11b9b132bf1af2093d15241182780d703968c243266aca48f2ad2091c12acea612055e0e3b8

Download Submit
C:\Windows\SysWOW64\Hfnphn32.exe

Filesize
96KB

MD5
cda3d21c5af15c5c112f4d2a7f12b9a3

SHA1
dba0e025402c7e207526afb712e82cdaecb81b51

SHA256
f558ef94c9486a44228244e07ec7145d28849dd92f960d520b73464818f3a390

SHA512
0d18db43db9904c06167c4e9944f467c7f3c7293af4a700065cf8b83f152166011e1b33f79044ac3f293b648f253ec839df830c33fc6e9bae426f77f39f7a494

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
96KB

MD5
69fa7b662ade88b3d3045ba7a2140780

SHA1
43244e58ac8b0b8f6b3232e321fa86d6e641dfd9

SHA256
ac68cb66f2f4f0a0de093b21e17105c9af31ddc58a5ed8235c425cef8aff03b7

SHA512
6617800c15e0d011be1c95a2e3815174f4c5c6f430eaff2dbb36da8448d9b7aa8c0ae2433055e4a0e236969a455107897b2541ec4de623e0d561b484324b4cdc

Download Submit
C:\Windows\SysWOW64\Hmhhehlb.exe

Filesize
96KB

MD5
afcb66c96bf10d91640b797b9ada625b

SHA1
81ac76f545f4df5a4eed15fa3f53c49c522702b9

SHA256
3e6757361ce2a6282a21436584e9d25cbe51763ed063a8b5f00364d0846728ec

SHA512
54ade86076587f38d9b705c396cea1d2d267e0476799028722ed3b66d2de369173c3119e06ae7ac6f32c1aba155a4ce4ba76d487a5dfc0563a22684aa7605c7a

Download Submit
C:\Windows\SysWOW64\Iemppiab.exe

Filesize
96KB

MD5
018c6ba8d2e0ee036507007e306b73fd

SHA1
a72bb5f58921a6404c03d0d7a16fc7460d4bbd64

SHA256
feec6be31a98403725e2a22639da48e331acd3fd47287d0de62293db5e8729bc

SHA512
cd8b494f7ba63730f90736db0406c05e92b81525e110fdb316f57aa821079999acea7ce61ca5b7064b3aadada07faaf99722b39671117b1be9d25a01a22e8b0c

Download Submit
C:\Windows\SysWOW64\Ifllil32.exe

Filesize
96KB

MD5
a85e91608c071e18cdbf3a80643f4189

SHA1
ba4dbfe7415a2df21c6ebc94af837e1eab00cd35

SHA256
e519f9e090a60f798b63775cccece3bcc9afac0ab81530e804157d2ffb8e157d

SHA512
433775556c59254b890aace386ab5814b8eca9cdfc5a188b1627cfcf89d8c0f02b97eebb6c7ca96c67a097c6bace7d7eb665642c0dcc63066e2341c82649e2bc

Download Submit
C:\Windows\SysWOW64\Jcgbco32.exe

Filesize
96KB

MD5
14624f0fa2c18debb84c940da74d66a1

SHA1
3c1ca82eacaa628a046ad51655f7aa1f6d72a00b

SHA256
e5596952c5c41477e489ca8a9f8e0fe89626c1ae37de5805ebd319ce07692f4f

SHA512
37a7f00358b062ec64b2f03b683d1ac14eb668f2fd9c33aca995a18d1be14e26c91e2d31ed64306c556295899e829c394a842c91401513babef9d918dcd01555

Download Submit
C:\Windows\SysWOW64\Jimekgff.exe

Filesize
96KB

MD5
bcb2b1f604c070cf52d501c138b00af8

SHA1
c2bca17ac7f2282ab7b82cd92019d1fbfa9fc35b

SHA256
be992b77da276bfc03a0260dee63b13dce9aad135f72f75f5b2baf336618d9aa

SHA512
3ebc5301223a7f4e346a14fae3217ff3ae3015cde0ef4c2475daf18456cf42c47310fed7684905b8b2002d8b13b079ad15bd232aa570755a5edccbc620a7e489

Download Submit
C:\Windows\SysWOW64\Jlbgha32.exe

Filesize
96KB

MD5
8bb17a8d611c4af10f1232e2792bfa40

SHA1
55db8b5a78fb336ea03d877bca7fff4871f7833d

SHA256
dbaf11f834adc70b3fb8adf9913120b25392696e2bafb92a431cd693f8fd113c

SHA512
08b9cbdae16ac19da7e97039981dcdb14e8014f5e080ba4cb89ab366fc9b60ac0fcbd88bdc1dfb0a679240ff18c1bb18d4be65d10c41254aedd7d58f876a2f86

Download Submit
C:\Windows\SysWOW64\Jmknaell.exe

Filesize
96KB

MD5
64e0682f0165de52b5b9b992d4723629

SHA1
d0ae901c1303bb96f728a912f65798fabb601734

SHA256
f679dba575daaa523d347c2ca8c683ea2c8bc646829e982a6d81a2bda2f4bb0e

SHA512
8200eca231b3ff64726b71fef6bbfc3090aec75143a6d40cdbb68774e597222f94d74a6e69e68c8b4fc8e0fad14a47b2599ff9d588d310df0cdd62912694ea0d

Download Submit
C:\Windows\SysWOW64\Kaqcbi32.exe

Filesize
96KB

MD5
d0f6a065aa8570fa6ccf6efa5d41969e

SHA1
2e806079cbaa7edea2617f9e940f689a0543b288

SHA256
b0f20dbb3427fd0ac4559bcdf55b82ae132e08fd5dd506fed17a84764402bf85

SHA512
bad3e7d6e3e3a3dfa695f5501d80d080b110254a9f65f2915c03ed2474d959b072a91fbcb89fc443cc8213436b95db80a214497d69f2c62062c4cad5d242c75d

Download Submit
C:\Windows\SysWOW64\Kbapjafe.exe

Filesize
96KB

MD5
79342811e469c7b9794c5add56f86c7b

SHA1
b6129ca3ddf9c743f20bfc0e7515ebe10c24ecb3

SHA256
895cef59b42d781771c18be28b3143ab3b0a4e33efca64100e7aff35d613cf1f

SHA512
117045c1812f34f577abcb7cb1ef3ce12370d2759c7d4b327d522870258f63e95809ad3ccdabcc6effdefa43e4455a001dffabc325e8aaf2cc5788a89ce5f3bf

Download Submit
C:\Windows\SysWOW64\Kbdmpqcb.exe

Filesize
96KB

MD5
e3d2b56281e31b5448d8eb36c6cd54ff

SHA1
0ef12d5af4e31d95157d26abef0d20cf434a37ae

SHA256
abb80fa577f8a4d500d541e4b28143b9bce5fb7d81404ae4c223daede85866ef

SHA512
8dacb95e6bb35b1c4b656b6d217a789f9d2056008a7181ff822a09c8cf2e7f8a7fdf81cd75d15704393e65535a2952d80e871c38aa359b957a6c8ebfce23379c

Download Submit
C:\Windows\SysWOW64\Kbfiep32.exe

Filesize
96KB

MD5
edcd08da93a0e4ebbcf07243a82610f1

SHA1
6f38a1c07809d00a95a7d6ef926033a59899172b

SHA256
e3bc8b9ad3f05d61cc9652e40ec47bf49d4d39ea55eeb511229b8b0c5df678cb

SHA512
ef4ea448542ec2afcbf6c02b70f9fcd29da5b4d086da29a2f45ad3dc77e1f103b39c04dd805a174c4d0182937e51c15435cd7a2676f7e13621962d1d5f5c92da

Download Submit
C:\Windows\SysWOW64\Kcifkp32.exe

Filesize
96KB

MD5
c25e296fff69d9f8e9c7f284f20c6c63

SHA1
62f44bd695b51e01f34c1167a654024e474a186d

SHA256
1512189fb3d4e8926bd00707b64e105c5879933713758c26a118ce3553dc5ece

SHA512
7bf5b5ee24b07b225e40eb1ffb8f562d8e7cb390e92231c254047a5b3524704ad5004aedeba69a7689023ab18013e59e4b4ae430e3c03c34ba09fe629ed49957

Download Submit
C:\Windows\SysWOW64\Kemhff32.exe

Filesize
96KB

MD5
b2425f88937897d7f9014f2acb6271d3

SHA1
a59860e7a05aa9d4f12f904265311cd58c1cf8c9

SHA256
837198bf992f86fb38c314694345fa73be2bbce879a958e771d0b929f4215e66

SHA512
7ec77fa2318521dac0f8bd3da0ab1c53e45cf92cb6fd5b316ab205e636a316a609b64d9696463e4bbef753dae895ccda61dd21409aae34af7c70ae3420d7aaa9

Download Submit
C:\Windows\SysWOW64\Kibnhjgj.exe

Filesize
96KB

MD5
2369cedb2edcdcf2d3a86dc9512f14f8

SHA1
ce6fc10f728845cd17f9d4595ce82e25a428a5a3

SHA256
f177143851058f62ee2f0009b96912c72e3889c23927b9f6efd64af8860b8da8

SHA512
899f229ad6cda4507f3acee26f3217b8ce8149d6e483b32f9005ec8d9d6acc5f5b65c48df651ec84b5ffa4d6fdbbc213c44ded3e093d42285c39ffcf95263cb5

Download Submit
C:\Windows\SysWOW64\Kkbkamnl.exe

Filesize
96KB

MD5
eb9044880079361e523f7630a961b979

SHA1
b1015b7640c4e54700af73b96d5c61da3e8eac1e

SHA256
f806f5dcc58c4f8067b00fb5f4ac6d37075aa11e920940707643868a40815f18

SHA512
d64d924cfda4d038766529cecf3d0e4a5bbdda74cf245f454f513790b3e478b86a80cc9e8b51d05569efe9a1c6a01de2c8f76888be773ee117598069377f75f2

Download Submit
C:\Windows\SysWOW64\Kkihknfg.exe

Filesize
96KB

MD5
6b0030b0fcc24e366c937448d7c3e024

SHA1
c5ccdb33e6e9c79d6991d6c36230ecdbde119696

SHA256
195e3ede4a02afe38e8065ea12c541259bb83e17a6b4bc593994d3ffc445982e

SHA512
1dfaa6bd19916b0276bcd12570d06fd8dde026bae941a95de411202f8d4e2ef4c9515319ca332cb64c8010d28db2daaa918409f00afcb4c509ee4ffb6326569e

Download Submit
C:\Windows\SysWOW64\Kkkdan32.exe

Filesize
96KB

MD5
556749e4f2a624841d0884d738b75242

SHA1
39c09a924b01e19b4d1132c65743fa9fffc71105

SHA256
e379982894081ed07b369980a31195372fedde58ccf754fe1a72024d5a94976b

SHA512
307630c95aa9a3b76192c621e9e2e045b2efe4b6238fe5c993a6f6647207dd9a648b2064730d3cbe252c4a7f4c674b35e46a1794ed012734523f9b653eb8da54

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
96KB

MD5
c164d2ef5398a843dc9dda8282fa4be6

SHA1
7a8521a87fe278ba1902f56f8e052f359ddc78cf

SHA256
d3f2e2f0ebb36c17d3b27cfdcc0fb03db7f0b5983a8fe06b255db563245af7fe

SHA512
7fd01dabb251db78c7591c4b377252092463bd9943c9da1db0758b4da17adf211be9f90d132d74c96e4d6dea2493482dcc6448faa9b4f47bb6a638626d3ad0aa

Download Submit
C:\Windows\SysWOW64\Kmgdgjek.exe

Filesize
96KB

MD5
0d0a8b6c104891b725347ade4f4c78e5

SHA1
b0c637ade09634763aa340f5d8e80b38a8b4b9e3

SHA256
baefe577c114aa9c7558356787b9afbfe32c70d2d87b07d977ace023fabe7523

SHA512
ae54bdb539c1b021f6651be042be42e18d36943658b575e128e03239615798751b941e4f8763931dbdd0a033dcf5cbe136b542bf78a680127f96aa47d3a6be16

Download Submit
C:\Windows\SysWOW64\Kmjqmi32.exe

Filesize
96KB

MD5
5132153070bf6ad6ad5db97e21feb1b3

SHA1
218cc62da49d58209712e1ce7bd7b3303386aef7

SHA256
d9544043b26f079785b7968ec58a3aceb43740cda449e612b70ce9c7f3a82239

SHA512
d9c2226d6cc2eaa4e4d6c0e267bed5d32a8afc6a5c961209a5c4dd1cebfa18212e9a78f63f072b3eea10ab8359b06fea23e6d5730b7ad39a66f4b3909408c269

Download Submit
C:\Windows\SysWOW64\Kmlnbi32.exe

Filesize
96KB

MD5
9577e0796e67b2c250f9a283f5eff962

SHA1
6efbcffe3a42cffab0012e6d0eb94057bbea08e3

SHA256
d700d71e6094df288a2b6a98a71974af49eef48f0fcda5dc7ed7dc2ed3a9a9bb

SHA512
26746132acfc905cc0ed15727a048e00cc25423bf02102068ef56235bb223b5b810d0a580fcf705d884f8d0856900affad818a07e176a5ae7b09c155e3102ba2

Download Submit
C:\Windows\SysWOW64\Kpepcedo.exe

Filesize
96KB

MD5
4c9b038a239c0d77e6f5906804efa35f

SHA1
1501a7b22f0b4f13187b74cd7ecbdeb1724aa000

SHA256
ba3f4903b19293801583ea5a3143cf8ecb8d7aa69877aba071fed44cccfd0241

SHA512
1992017cfd679d0ebaeb1a2259916ad83ea80cada5456274622116d76482222bbada00a796b25c88b37c5fa105b36366db4895e85e049cb68ce56ff421e2b80d

Download Submit
C:\Windows\SysWOW64\Kpmfddnf.exe

Filesize
96KB

MD5
1afc906c88ec5067232438d5e0c89e0c

SHA1
792b8fe25e5267e9e2dcdcb30dfcd7b29b3440c8

SHA256
9f5de11f8bb88b88ef38bc0575dfb2fba579bcd45d09fb42de25038f9b5ee1e3

SHA512
3d0a9509f18d90942029809ecaf97be12b833c20c1e219feaeba8c269d1667cd913ec912083dcebb60aa962b82d59159634e68fccd12239f16ac72fd7b8b4484

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
96KB

MD5
0c1f25d9d557418e50da79ec0226a953

SHA1
feffb4a1165c5c11cda37986a78a16eaa591cab2

SHA256
925e220b1bb7ffbc23a2a57ae44abc447fa2a291590bf3125243e9375b1bba33

SHA512
a967d02e257782e881d4dc9c0ccf4f3b4489f3b47426597abd387807c4f1c5063a88e876e70f0abd8426f0996b4fe1611c005a938fd9bbf6542a0ef939d37c3c

Download Submit
C:\Windows\SysWOW64\Lalcng32.exe

Filesize
96KB

MD5
4bd508ad51952e4fdcf82da057af9fc7

SHA1
be755323d6c79270b2fa4ea2d9cc024ffb5d2150

SHA256
07090f029915410b3203238d579b5d75a8ce4d723d03b5db08064986a875400b

SHA512
fd95a216ea49ba8afe814e60a9e4cda7140830ff7ca8cd78b89639e6b40fbfc8e40163a37ae4d8aec028bfe1ee6af409b44b19ab0b4d512a5b150099f5d33d39

Download Submit
C:\Windows\SysWOW64\Lcmofolg.exe

Filesize
96KB

MD5
2a12a4abe43424bb3d9e8cc5c8974b58

SHA1
585c8ec60bf3b61d96226831b38bf1829405abaf

SHA256
a97ec002b1fc74ed11551f82a4e691489d3f269e81620cfc4faf8a723a37faca

SHA512
04e65c0af64fa3473b8897b0b6f914ebc35ef4a9c2db652de1255e72a69bf38967816ce4d382c6465227474b511a09fb4f542da294740d53f2d8ea0cacb1fbfc

Download Submit
C:\Windows\SysWOW64\Lcpllo32.exe

Filesize
96KB

MD5
b621c928e98745ecb743333597fe7f84

SHA1
2ff6a2496fed209b83e2d551c08fcfe3369c6a0d

SHA256
8df2c0675018389f2df38b7d2f18e833b3fc8b5406edbf907d07dbaf6af092ec

SHA512
b0390a166e77eb41b2b3c4efcfbcaedfd580dfab2e0403912e2c80f8fd08b33408c6c04501d22b02469fff75de275110b05155adb0305938767de64c99a75c29

Download Submit
C:\Windows\SysWOW64\Lffhfh32.exe

Filesize
96KB

MD5
d387e70e4603284909375beb53ef79ae

SHA1
e8b4cfe579bdd7a014b2c86e283abe81cf9771c0

SHA256
0bf8ed61ce9a5a9316a7352877cef5876e65349445a2c03d43cfa56396e89e32

SHA512
186bccb533220cd3bf02adbcee1890d6135a4c9041ee3e9e3130560f1883faff92b995e8c926de7d2315941858f412b936426e6e51655f12f4fcc8f48eefced6

Download Submit
C:\Windows\SysWOW64\Lgbnmm32.exe

Filesize
96KB

MD5
27a3295baf541b13acfc3e1e738effb7

SHA1
0cd5fe37056e8c9c19f1e540063bdd57506288e2

SHA256
ce7125255762be2dbe2e3c2c5d604a91e0036638ba2d6ed8f3e96077b60fcdcd

SHA512
ebee2abe6f7b4a14049f92facf46410ba14be9f0b25fe830ad5bd85ad83698d99f4607efdd1066ca3e72446cc597e7fd706c8787f9cc489ed4044662a53169af

Download Submit
C:\Windows\SysWOW64\Lgneampk.exe

Filesize
96KB

MD5
26281634ae467255a41bc5373d62804c

SHA1
941d0f4ace0400688ef3a8f6d7588d158f6fbf44

SHA256
0313da924e0a4f1571a7b255d38cd4feb40337f3c63044036ae137cd5d316cc4

SHA512
fe0bea75c34fcb95572e46941ccc8886e91bd50e5eaad3493c555a8aaff36d1ccf4c2e4f252d4a86a987c1d565f71c02d95e1ff050f478f18e312aac4d4a9f35

Download Submit
C:\Windows\SysWOW64\Lgpagm32.exe

Filesize
96KB

MD5
2694a392efefbc9b6e066426b59e315e

SHA1
1e24097f316c40347bcf77b6f3f47735e9a221a0

SHA256
56015d6eb0645242bb1c111e86532071a65abc9995236c9017c7b5caf6e54fb2

SHA512
40f7ffa8ed89cd8b4b997cdda15cbde4c2f01705d5c431618a46fa59f42be3e018eae940b258029deb96bfe18dc87fe33c89e2cec186272d85e6901804a86edb

Download Submit
C:\Windows\SysWOW64\Lilanioo.exe

Filesize
96KB

MD5
9d3a7e62718d455e58c25a52ec78dbae

SHA1
f9d96cb70ad1a591a7f61343bdabe1109f53cc05

SHA256
7bb8dcd6bf0ec590853c3b9392bd33cd95b6a3b77721e1bea2e270ecbaad1abe

SHA512
0912d834c2b08aff4d2165639828381a84810e2e056538276468eceafd4d31b563ef928897d5d000ddfa7421a625ebbc20459885855da3ce7070476e79ca281d

Download Submit
C:\Windows\SysWOW64\Ljnnch32.exe

Filesize
96KB

MD5
bfecb30b7a74ea11277b8abeef728310

SHA1
b99050e5f45f2d0d21d28507082fc866e9e6a2e4

SHA256
bcd87c8d3a19c8754c579f2bc40f1865df87af0e35e5c8ffe53549d82a408a49

SHA512
89507b529e0f38377cecac3ff25904be90e5a389c8a0c4dd40c55ec4881d12f974b8a72027d5542f3fa7e9c29bf88512f1f5bbd3755e377b1b552a12185ef325

Download Submit
C:\Windows\SysWOW64\Lkgdml32.exe

Filesize
96KB

MD5
34692a8e89de73401275e4bc7a932c0c

SHA1
a47caa66c673eaa7ddb2f001dcdad239554f3a4e

SHA256
3b19540974b36eeeba999a18929775cb24f66824ebd1e494f4cc332856a940c2

SHA512
0deb9789783f294e3b3bd17f8ce468b757b6d4821fe6d893e561361dd292e611c761c2ad1632aa1170b957583a2293fc2170cfcfac69ce7ec1b091586d0acb9f

Download Submit
C:\Windows\SysWOW64\Lmccchkn.exe

Filesize
96KB

MD5
5f9a85ca589d57ca26258467cfdcbd0e

SHA1
64ddaa22f744883f156493b72dea147c56668a7c

SHA256
46a803d03eba3881a82073739e573d434a3eab6498554ee97052d6171d9a6484

SHA512
62564981a435d74352906f1e9930d6c6340291e3c09cb17d8994b60a8d00946c276d65b245064706adcdde006ab264d798be5129d1e7ad3c95fd80b0ea3035c8

Download Submit
C:\Windows\SysWOW64\Lmgfda32.exe

Filesize
96KB

MD5
1919c4b7dfcceba7d61cded1a79647e6

SHA1
521046968d6be7dc2de6e44d283fa3f8cb97f3b1

SHA256
dce5ea0607c35b459dac6d29155547ca82b0e0027bfe0308e4294893e5c6d481

SHA512
8af04e30e09f22a0cbfac80bfe9f608c09ed6e7a5e9122be6f4e49ed4a5719733b562c3bdc47a82c8c4205629cb81e4b16b697e2badb4b147a9376bb80e960e2

Download Submit
C:\Windows\SysWOW64\Lpfijcfl.exe

Filesize
96KB

MD5
080f864edbfe07af272554e42e45ab9e

SHA1
8db94be5ea7d0601df099f9d50aab7bfeba49567

SHA256
17c17452a244f3d9dcc269b2726e0b4db36b945db1c016e9f7ced9002ef7a083

SHA512
1138c663e299f996e6eef841dbe05f5fc4cc09b97567d09b7998c91685a26b2211172c5b4f762de632ec4cc53fdf7a242d05c8036b8792fe6c409051fc0dfdfb

Download Submit
C:\Windows\SysWOW64\Lphfpbdi.exe

Filesize
96KB

MD5
f0d5125a7b6a9003b16762dd5051dfe1

SHA1
2e5b333bbe62184bc23a6941af00bfdd2c875515

SHA256
0c0447dfcfb2e4ed26ee3ca2babc4d15f8e4afc067383a51c9c38950059717dd

SHA512
be5144e33384a6b25844842813cfd81b5af7b39e59945765b2ac1ff9c3d9118e0763393850f801b8adbddd9843b73682ea7e0037d025b9e3a09194a892073153

Download Submit
C:\Windows\SysWOW64\Lphoelqn.exe

Filesize
96KB

MD5
701feaeaf2b5168631b0ab1aecaccae8

SHA1
321b0f339a39efd0c7387c1c7652cbf6649ccbdf

SHA256
a6c2e5a95bf67b7bcd6407fadfd2fbcb5a3370f1169b6e9b67b47436cbdff4f6

SHA512
27f40af685aef0910ebe6253bf0272004c542f8276fdbc5837c530a848cb10c8181d7e95cc60eaf1b904dc86298b076ae07442be723b8c1382a1f8d5c97369bc

Download Submit
C:\Windows\SysWOW64\Mahbje32.exe

Filesize
96KB

MD5
4c8931a7764a8a9e58f52125fcc01d88

SHA1
1c9ae32e9b5518e2f3b12c5408f638b2fc693659

SHA256
015c97bcae346d69fb0c70065ef3274039e19e6f074b4f24600800fca3d85469

SHA512
e746e085893187798edb706a464bbf6d79bace2db36102cc3b5653cc6efbb1ea1e035fcac6ef092c329e6ce7098ac247defcba095056334921cc33e14fac7257

Download Submit
C:\Windows\SysWOW64\Majopeii.exe

Filesize
96KB

MD5
1eced4550e258c1f6071111e8d80d386

SHA1
a69999bd0f382ed9554d5b4765eb43041d5ab585

SHA256
adf9393181149ef85a08e774c0fb8cf745288657a66488d927567e02cb79f481

SHA512
51f60ec1eb964ad3e3524088fdc0a1ae08f7d40fa573c03f62fbac1b77d9a60d84636cedb7d7f0ebe95d9c9718a299bf9d837fe27a08e1f4bd1f24f92058ee46

Download Submit
C:\Windows\SysWOW64\Mchhggno.exe

Filesize
96KB

MD5
f4a054b73f020a912b1b5907413e5d7f

SHA1
c2eb2c92f6add42c06c3fe8214914123c4e840ef

SHA256
192d5beb0a43ce35d0443bf41c240a0ad8a2edd6a47d8bdb68353fa7d49db1f0

SHA512
55ba4844c3e06470ce1b3db84386510e3c7bf565d84559e04b04fa75807248ab872b1e4f78fd76174a2524edc171f78c4e4fbfe09f21a7444f218d2f46767a76

Download Submit
C:\Windows\SysWOW64\Mciobn32.exe

Filesize
96KB

MD5
3561c385133344609a853b24010a09ec

SHA1
dcbe2cb3c256f4d48810b7120d84c1f6721c1d48

SHA256
10f6673935e8a8bbb15176a60655a95c4d24104c3ac4a9b20d045eb0c408d726

SHA512
90d6528301a66bbd062232f63a842dcbef6dd89743cc9ffc025f47c9f9c75209aa710462cf54bfaee3948899f922a53d9cc0cf1363b92f8c6f4d5621c77eda0f

Download Submit
C:\Windows\SysWOW64\Mjhqjg32.exe

Filesize
96KB

MD5
084586ec510feaef7d43a2bcc321cfb3

SHA1
3a698e8da2d547ee0bb38d4f2f43c90da25beabd

SHA256
bb54e4b941ff86a89e3a234145f54670e2016900b4a309bd4c727e3655004113

SHA512
dc2609643e1a6f7589f69bfc0ae1d4e7e376785f7bf16717f206f2baf7a773b310910b17fa4421431ca8ca082b3f105984eae92513f3660d98db5a1c65dde884

Download Submit
C:\Windows\SysWOW64\Mjqjih32.exe

Filesize
96KB

MD5
727c16f0d2f0d4a1f423934064fde8d2

SHA1
e325e638e419299c81524db6eefac5c4749ce3b5

SHA256
92d0f4e4d8a75afd08e7ac2c52bfc30eaa10ce89a69fb409d9f0c8431d4f5dd3

SHA512
2dc3276810e94f03f890f22a18bceea127c2f48e237da7a5ba040c779bb4cf39ba50067a891a381cdb26ed9de9bb6e71b8a51e672eaad06d12b123c2e96527be

Download Submit
C:\Windows\SysWOW64\Mkpgck32.exe

Filesize
96KB

MD5
8ac987dacf46f9a7834d67b08c9e2223

SHA1
41bd84eda4fe49171d5488d557a28e8217d3d29b

SHA256
456d13176a2dbdf3d986cbbad16a1f2551a055e30547bfc969405eb65d317693

SHA512
49f361921cef20ae97c2cba36451e09493154372127ccb88c984637bcdfdd90939f937204ad811068cdcd07b108f5b69c908a73945fae61df284623149ccf08a

Download Submit
C:\Windows\SysWOW64\Ncbknfed.exe

Filesize
96KB

MD5
05eea2922e2ba35763e79e6433701453

SHA1
7024535dc6f2a97860dd99caf93f26777ca0c773

SHA256
01e3498f39a082f308b78c1c7af4047bf0077760998f1262f5ff3a48b465cd67

SHA512
43844bcb1f5f9a63fb590d889d4373dbe10630dfe7cfac748810d526cc6b23baf9b8c9a07d83059ebb26c81545581c860c88998d87c488608b404c05fe74a4d4

Download Submit
C:\Windows\SysWOW64\Ncihikcg.exe

Filesize
96KB

MD5
7dc63cc2045c0b1cf7882b81626225c8

SHA1
1687c3a0dc4f7a33e8082b9c00178eb7ddb82301

SHA256
b1d0a38a1591dc2ae628491c881a5d88ba5d956ee2109c209992fd6a318c611e

SHA512
eba284b04395ae5749b3779b72f58a948b02e1f9e610c9c21d7dd8c43fd53a059696651963c720e90f4c84afb662394a82a9f5ac25221cc2c347fa502c9387b5

Download Submit
C:\Windows\SysWOW64\Ndidbn32.exe

Filesize
96KB

MD5
edef0ef753b530a48a8b11eb5e501c10

SHA1
4ea64decd5a41c50ae7621787daaaa9a664bd2b4

SHA256
0c4c4b586a30d99fa6801918b38dcfb5f06af2f84152fbba9e17296546b20ed2

SHA512
7f9d1036a68ac5804c64690c2131df3bb43dd1a14bd10ef8346c6257227bbee2ff583e3858ddaa18ba77b5df42abe67359e07e338f3c554dc8068402779253d8

Download Submit
C:\Windows\SysWOW64\Nlmllkja.exe

Filesize
96KB

MD5
7372234fa2294f36c1f946203c78c24d

SHA1
ca6a4ca9c9181dd224084defad4f04ed62027783

SHA256
bd0aff9525e874c0555afb7259fbd5af3d9332473b52b1d379395e127bb3521a

SHA512
f6f2676c581505759ae954e1f30c43f63731bd20fe0500d40aee01b506a4cf116d7cb82b01a9a88f69185d9505c39140ce3f4be7d6476bdb373a478cb6890e14

Download Submit
C:\Windows\SysWOW64\Ofeilobp.exe

Filesize
96KB

MD5
f529a996734d4a532533eb48a050aef3

SHA1
4a66c899caebe09001dbd9a945f34f3a6ac83002

SHA256
930ad6d700119580feb82f117cd278a867494b84db3ea9f1904170be49b1853b

SHA512
9dd5d7d49f3571ec7bec429e1d333d47821af61178f033c12876a83377b852482f23f9e1f4a4ab13f3e3aabb837e07d99ac4a22de606d9f16b64ab3404ed4abc

Download Submit
C:\Windows\SysWOW64\Oflgep32.exe

Filesize
96KB

MD5
5897078ebe4f01040dae24149eef8516

SHA1
f1c0e91b16c2b211bc9bb1ddcbb3abbada9c5bba

SHA256
2779c2e1e4e2794332229d151a88523454b0f957c280acaa2dff07272951aad1

SHA512
e282e5be9a7db4524aeae587b3e3cc616afc34b8915826e520b30a0e98faf95b68b1df251707fec54487477875dcf288bf39410c69a20479cd1e034aab71385a

Download Submit
C:\Windows\SysWOW64\Olcbmj32.exe

Filesize
96KB

MD5
3c3495ab3ee20d880b93eff4198b3366

SHA1
1fa74865898733dbdb96bab6171167e62eec7410

SHA256
6513d3136ae7730aba530867a546c5e17a1505dcb1d2f0ae9d588d37856179af

SHA512
b17d1fde478e26b63d213166aef7fc6c7b9ca0e5d9ae77691a96614415123723ee8da19b7653860124750781007151d9387f417a3b253610c8871712e2d4e928

Download Submit
C:\Windows\SysWOW64\Olhlhjpd.exe

Filesize
96KB

MD5
24a7208eee3567ad7cc433ddd428a404

SHA1
bc90de3d44b51b833e208b71a6d419e4d665fadc

SHA256
565ade2b0a395101beccdfcc23eb958cd8a7f29aee0d9afb9640db46d1f76d3b

SHA512
723001072aad050f8839b72c29b29b49cb2e4393c2b7410268541ca95c41126f23cf3eab27e6c050e16b6649d888c00856764b59bb9d1afeea88372aeb3d6f19

Download Submit
C:\Windows\SysWOW64\Pbddcoei.exe

Filesize
96KB

MD5
9ce481d29d8febef74ce11f319272df2

SHA1
493f70f4110db2d08caf5b5d77b06e54c8eceb1b

SHA256
cb5c97d357275d5f0889be75274eed0e15c6798fd7924579bd9f7710de6c5b93

SHA512
fd641bf6151e633dda001a4f76f1c0e19207635d9dc62351b9a69b4bef81056227c3fe0e07e16586d91081738fb7f17313b3a7c1527ced450bc9bf82c9d5e82d

Download Submit
C:\Windows\SysWOW64\Pcjapi32.exe

Filesize
96KB

MD5
61c95d206954e1da3810bdfe3f000493

SHA1
c61666c6f9e7a48d304ea9e92e257cc4b7029bff

SHA256
4636e2626086d9391ee416be03921ee3c2d70608b12029cbfaa1a87358e47cea

SHA512
fff5939ed100ed8d422ae8268f1feffd9bca868949cfd0e4a60254788b6abc32e656480318279a286858cbe652023fe692244a1598e04c67a090840c16066d4c

Download Submit
C:\Windows\SysWOW64\Pdfjifjo.exe

Filesize
96KB

MD5
00070e558c73a0b4427ebc85f0134e5a

SHA1
95e01ed644dc3b2dd705d22dec4e4b64fbb41345

SHA256
b564fc2dd106b27c36d6590ae85901d4b9b0daebe5537b6086b636b9555ec5ae

SHA512
80a83bcc2a5891e2c050a798ef3e26050f9749586641bdd76b5483bcbb3197a2400fabb738e11c05972c2de9baec2d9b183d31c7eb33268c547f69d44bf88aa6

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
96KB

MD5
28d30a906c98a6b7d0ffae11c738580f

SHA1
1c2dc700d9d62993aa69bc2f4ea03c07fda5b595

SHA256
9365c7d91debae0fbfbceb29b600902466ab242b18acddcf14244c746816e37c

SHA512
bf85125fddd50d826391858b248b4e24e54f60214f863c055e4460c8b258a2fce0737f93656218b3581875e421f25f19ef2de2388ca01d932c81dd942a528190

Download Submit
C:\Windows\SysWOW64\Pmannhhj.exe

Filesize
96KB

MD5
ecf341c4c6717a9288d28f813ee77a6d

SHA1
3a6c8606216b56d4923d0806acfb0271165d5c29

SHA256
03b19aff3703d16045647ca44f963159f9955985edc053c467380d04102a700f

SHA512
4e4eb39cc4297e102a439063160aef0705ec811a80dfc4015906d4c9c3e9e61f2a6750872ab6665d08775e90ba1785650c3a59ea1759cd42f0d718abe4171f1a

Download Submit
C:\Windows\SysWOW64\Qchmagie.exe

Filesize
96KB

MD5
1486ae226837a2bd77b63c7562c624c9

SHA1
4938df8cae0a4d12203c0b44c3cc68b5506d6b3f

SHA256
a658539b94d91dfb20f78639a147579b0dde8477b9408157bf6386f4721e65ec

SHA512
d1e1b553b3786a7b2b5f1ab5297647c885944c87eeb3fa83be85530c42aaf227d5b0df19531e4fd34b171cf830c06359ab90206b2ffafc973b6a14d9312b83b3

Download Submit
memory/392-273-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/396-297-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/540-596-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/540-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/740-88-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/764-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/816-483-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/884-571-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/916-321-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/920-506-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/968-232-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1012-209-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1048-335-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1088-533-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1216-364-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1280-587-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1288-333-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1320-240-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1364-546-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1372-97-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1404-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1428-595-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1468-263-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1544-569-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1548-327-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1560-347-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1592-261-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1620-495-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1640-552-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1684-40-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1684-593-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1728-69-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1920-144-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1996-389-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2012-37-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2020-383-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2032-399-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2092-225-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2192-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2244-137-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2412-260-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2512-509-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2532-532-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2624-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2652-447-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2696-539-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2768-73-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2804-305-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2816-169-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2852-113-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2876-201-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2892-152-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2896-577-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3012-128-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3116-281-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3408-429-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3416-601-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3496-441-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3556-477-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3600-604-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3608-405-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3672-299-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3688-485-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3716-177-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3724-435-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3808-464-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3836-525-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3940-365-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3968-21-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4100-407-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4104-423-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4112-287-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4200-190-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4320-311-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4328-451-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4344-275-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4368-455-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4572-507-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4584-418-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4620-345-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4656-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4656-545-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4656-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/4776-121-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4832-377-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4848-194-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4868-467-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4900-515-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4936-563-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4984-603-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4984-57-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5000-564-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5000-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5048-353-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5060-371-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5096-221-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads