2b414300df31cc49a63eb3eef4364c9c69e94eeb9b865202890780d159f6198b

Analysis

max time kernel
52s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 02:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b414300df31cc49a63eb3eef4364c9c69e94eeb9b865202890780d159f6198b_NeikiAnalytics.exe
Size

199KB
MD5

261c498caf9f192db86e229dcffbeea0
SHA1

eb3abaed8a7c4a712bf54516d4814a0ce6730049
SHA256

2b414300df31cc49a63eb3eef4364c9c69e94eeb9b865202890780d159f6198b
SHA512

4e59c1f349e71fc464a0c9dfb0b80309a367a0ea3ef374847c10a7e7f14444546965587346377675de56560ccdf0bd93bb700ee4fdd91368873a565853d6ecaf
SSDEEP

6144:J9DQ3swrQSZSCZj81+jq4peBK034YOmFz1h:s3lZSCG1+jheBbOmFxh

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mamleegg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onklabip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lepncd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcpnhfhf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okhfjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hecmijim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kibgmdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opdghh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jplmmfmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jagqlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bobcpmfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcbihpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfhdlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njnpppkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcklgm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqpego32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Echknh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjkjpgfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kibnhjgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lffhfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qddfkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgopffec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eapedd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogpmjb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbimoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmfhig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aacckjaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpijnqkp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alhhhcal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmabdibj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocpgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chjaol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Liddbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdfjifjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdjjckag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qbimoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbnafb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdjjckag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojllan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdcijcke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbgbgj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqdoboli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahkobekf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbaemi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpjcdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdjfcecp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbapjafe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lijdhiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bahmfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldohebqh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blmacb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnakhkol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajhddjfn.exe

Executes dropped EXE 64 IoCs

pid	Process
1984	Jagqlj32.exe
1728	Jdemhe32.exe
2692	Jmnaakne.exe
2804	Jplmmfmi.exe
4180	Jidbflcj.exe
536	Jdjfcecp.exe
2672	Jkdnpo32.exe
4696	Jpaghf32.exe
372	Jfkoeppq.exe
4620	Kaqcbi32.exe
3036	Kbapjafe.exe
3160	Kgmlkp32.exe
2068	Kilhgk32.exe
3724	Kbdmpqcb.exe
1920	Kinemkko.exe
1616	Kaemnhla.exe
4748	Kdcijcke.exe
3428	Kipabjil.exe
1244	Kagichjo.exe
2324	Kgdbkohf.exe
3328	Kibnhjgj.exe
4412	Kajfig32.exe
2392	Kkbkamnl.exe
1240	Lpocjdld.exe
3980	Lgikfn32.exe
3924	Laopdgcg.exe
780	Lcpllo32.exe
740	Lijdhiaa.exe
776	Laalifad.exe
4176	Ldohebqh.exe
4136	Lnhmng32.exe
4108	Ldaeka32.exe
5060	Lcdegnep.exe
940	Laefdf32.exe
1172	Lddbqa32.exe
1332	Lgbnmm32.exe
1656	Lknjmkdo.exe
2204	Mahbje32.exe
3624	Mdfofakp.exe
2232	Mgekbljc.exe
392	Mkpgck32.exe
2984	Majopeii.exe
4860	Mpmokb32.exe
2440	Mcklgm32.exe
3180	Mgghhlhq.exe
2220	Mnapdf32.exe
2536	Mamleegg.exe
4744	Mdkhapfj.exe
2892	Mkepnjng.exe
3560	Maohkd32.exe
3780	Mdmegp32.exe
1228	Mjjmog32.exe
4688	Mdpalp32.exe
3784	Nkjjij32.exe
3856	Nnhfee32.exe
4048	Nqfbaq32.exe
1988	Ngpjnkpf.exe
60	Nddkgonp.exe
4472	Nkncdifl.exe
3452	Nqklmpdd.exe
1032	Ncihikcg.exe
3768	Nnolfdcn.exe
4872	Ndidbn32.exe
3552	Ncldnkae.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Jkdnpo32.exe	Jdjfcecp.exe
File created	C:\Windows\SysWOW64\Eocqqdjh.dll	Daaicfgd.exe
File opened for modification	C:\Windows\SysWOW64\Dkoggkjo.exe	Dhpjkojk.exe
File created	C:\Windows\SysWOW64\Jkeang32.dll	Nddkgonp.exe
File created	C:\Windows\SysWOW64\Ifjigbdo.dll	Hofdacke.exe
File opened for modification	C:\Windows\SysWOW64\Lingibiq.exe	Lbdolh32.exe
File created	C:\Windows\SysWOW64\Mchhggno.exe	Mpjlklok.exe
File created	C:\Windows\SysWOW64\Ochpdn32.dll	Pnfdcjkg.exe
File created	C:\Windows\SysWOW64\Iphkfg32.dll	Blmacb32.exe
File created	C:\Windows\SysWOW64\Bhfonc32.exe	Bjbndobo.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Fgcqbd32.dll	Peljol32.exe
File opened for modification	C:\Windows\SysWOW64\Cmiflbel.exe	Cjkjpgfi.exe
File created	C:\Windows\SysWOW64\Kbhoqj32.exe	Kpjcdn32.exe
File opened for modification	C:\Windows\SysWOW64\Lmdina32.exe	Lenamdem.exe
File opened for modification	C:\Windows\SysWOW64\Lpocjdld.exe	Kkbkamnl.exe
File created	C:\Windows\SysWOW64\Mpmokb32.exe	Majopeii.exe
File created	C:\Windows\SysWOW64\Njkoaebi.dll	Obdkma32.exe
File opened for modification	C:\Windows\SysWOW64\Dkgqfl32.exe	Dhidjpqc.exe
File created	C:\Windows\SysWOW64\Gomakdcp.exe	Gicinj32.exe
File opened for modification	C:\Windows\SysWOW64\Hmhhehlb.exe	Hbbdholl.exe
File created	C:\Windows\SysWOW64\Pdfjifjo.exe	Pnlaml32.exe
File opened for modification	C:\Windows\SysWOW64\Kgmlkp32.exe	Kbapjafe.exe
File opened for modification	C:\Windows\SysWOW64\Ojhiqefo.exe	Ogjmdigk.exe
File opened for modification	C:\Windows\SysWOW64\Eofbch32.exe	Edpnfo32.exe
File opened for modification	C:\Windows\SysWOW64\Pjhlml32.exe	Pcncpbmd.exe
File opened for modification	C:\Windows\SysWOW64\Aeniabfd.exe	Ajhddjfn.exe
File opened for modification	C:\Windows\SysWOW64\Ndidbn32.exe	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Ojmcld32.exe	Oqdoboli.exe
File created	C:\Windows\SysWOW64\Hofdacke.exe	Hmhhehlb.exe
File opened for modification	C:\Windows\SysWOW64\Icifbang.exe	Ikbnacmd.exe
File created	C:\Windows\SysWOW64\Ckijjqka.dll	Mdckfk32.exe
File created	C:\Windows\SysWOW64\Oflgep32.exe	Ocnjidkf.exe
File created	C:\Windows\SysWOW64\Bbbjnidp.dll	Jmnaakne.exe
File created	C:\Windows\SysWOW64\Kkbkamnl.exe	Kajfig32.exe
File created	C:\Windows\SysWOW64\Ncihikcg.exe	Nqklmpdd.exe
File created	C:\Windows\SysWOW64\Ndidbn32.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Pgmcqggf.exe	Pabkdmpi.exe
File created	C:\Windows\SysWOW64\Jfoiokfb.exe	Icplcpgo.exe
File created	C:\Windows\SysWOW64\Gfnphnen.dll	Agglboim.exe
File created	C:\Windows\SysWOW64\Olkhmi32.exe	Ojllan32.exe
File created	C:\Windows\SysWOW64\Pjngmo32.dll	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Kbapjafe.exe	Kaqcbi32.exe
File opened for modification	C:\Windows\SysWOW64\Kinemkko.exe	Kbdmpqcb.exe
File created	C:\Windows\SysWOW64\Kibnhjgj.exe	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Pkaiqf32.exe	Obidhaog.exe
File created	C:\Windows\SysWOW64\Eamhodmf.exe	Eoolbinc.exe
File created	C:\Windows\SysWOW64\Gcagkdba.exe	Gkkojgao.exe
File created	C:\Windows\SysWOW64\Mahbje32.exe	Lknjmkdo.exe
File created	C:\Windows\SysWOW64\Agkbbg32.dll	Daolnf32.exe
File created	C:\Windows\SysWOW64\Iddoeojd.dll	Dhbgqohi.exe
File created	C:\Windows\SysWOW64\Dchfiejc.dll	Cdhhdlid.exe
File created	C:\Windows\SysWOW64\Mkepnjng.exe	Mdkhapfj.exe
File created	C:\Windows\SysWOW64\Nqpego32.exe	Njfmke32.exe
File opened for modification	C:\Windows\SysWOW64\Mgfqmfde.exe	Mdhdajea.exe
File created	C:\Windows\SysWOW64\Ffcnippo.dll	Aeklkchg.exe
File created	C:\Windows\SysWOW64\Lbdolh32.exe	Lpebpm32.exe
File created	C:\Windows\SysWOW64\Dnhqigge.dll	Pbbgnpgl.exe
File created	C:\Windows\SysWOW64\Kjhonjco.dll	Pjmlbbdg.exe
File created	C:\Windows\SysWOW64\Alhhhcal.exe	Ahmlgd32.exe
File created	C:\Windows\SysWOW64\Camphf32.exe	Cdiooblp.exe
File created	C:\Windows\SysWOW64\Doeiljfn.exe	Dlgmpogj.exe
File opened for modification	C:\Windows\SysWOW64\Iiaephpc.exe	Hfcicmqp.exe
File created	C:\Windows\SysWOW64\Ogcpjhoq.exe	Onklabip.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10264	9756	WerFault.exe	504

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Genaegmo.dll"	Dhpjkojk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fojlngce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ingbah32.dll"	Lingibiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beapme32.dll"	Odocigqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddpeoafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjjgia32.dll"	Acjjfggb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daolnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhidjpqc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffddka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jblpek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmnldp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Laefdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aacckjaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbcbgk32.dll"	Eamhodmf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmfkoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifjigbdo.dll"	Hofdacke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Laalifad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cafigg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flqimk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fooeif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbgdlq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbhoqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpkknm32.dll"	Ndfqbhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njkoaebi.dll"	Obdkma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpamgn32.dll"	Okhfjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibjjhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojjolnaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leqcid32.dll"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljnnch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlddhggk.dll"	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dlijfneg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfngap32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgmcqggf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpablkhc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Elppfmoo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgllfjld.dll"	Pgmcqggf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qajadlja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acjjfggb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Alabgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gcagkdba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nckndeni.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqdoboli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iehfdi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmfkoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olcjhi32.dll"	Mcpnhfhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jilkmnni.dll"	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifhkeje.dll"	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hipegc32.dll"	Pghieg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmhhehlb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngpjnkpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Docjlc32.dll"	Iiaephpc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 1984	2264	2b414300df31cc49a63eb3eef4364c9c69e94eeb9b865202890780d159f6198b_NeikiAnalytics.exe	82
PID 2264 wrote to memory of 1984	2264	2b414300df31cc49a63eb3eef4364c9c69e94eeb9b865202890780d159f6198b_NeikiAnalytics.exe	82
PID 2264 wrote to memory of 1984	2264	2b414300df31cc49a63eb3eef4364c9c69e94eeb9b865202890780d159f6198b_NeikiAnalytics.exe	82
PID 1984 wrote to memory of 1728	1984	Jagqlj32.exe	83
PID 1984 wrote to memory of 1728	1984	Jagqlj32.exe	83
PID 1984 wrote to memory of 1728	1984	Jagqlj32.exe	83
PID 1728 wrote to memory of 2692	1728	Jdemhe32.exe	84
PID 1728 wrote to memory of 2692	1728	Jdemhe32.exe	84
PID 1728 wrote to memory of 2692	1728	Jdemhe32.exe	84
PID 2692 wrote to memory of 2804	2692	Jmnaakne.exe	86
PID 2692 wrote to memory of 2804	2692	Jmnaakne.exe	86
PID 2692 wrote to memory of 2804	2692	Jmnaakne.exe	86
PID 2804 wrote to memory of 4180	2804	Jplmmfmi.exe	87
PID 2804 wrote to memory of 4180	2804	Jplmmfmi.exe	87
PID 2804 wrote to memory of 4180	2804	Jplmmfmi.exe	87
PID 4180 wrote to memory of 536	4180	Jidbflcj.exe	89
PID 4180 wrote to memory of 536	4180	Jidbflcj.exe	89
PID 4180 wrote to memory of 536	4180	Jidbflcj.exe	89
PID 536 wrote to memory of 2672	536	Jdjfcecp.exe	90
PID 536 wrote to memory of 2672	536	Jdjfcecp.exe	90
PID 536 wrote to memory of 2672	536	Jdjfcecp.exe	90
PID 2672 wrote to memory of 4696	2672	Jkdnpo32.exe	91
PID 2672 wrote to memory of 4696	2672	Jkdnpo32.exe	91
PID 2672 wrote to memory of 4696	2672	Jkdnpo32.exe	91
PID 4696 wrote to memory of 372	4696	Jpaghf32.exe	92
PID 4696 wrote to memory of 372	4696	Jpaghf32.exe	92
PID 4696 wrote to memory of 372	4696	Jpaghf32.exe	92
PID 372 wrote to memory of 4620	372	Jfkoeppq.exe	93
PID 372 wrote to memory of 4620	372	Jfkoeppq.exe	93
PID 372 wrote to memory of 4620	372	Jfkoeppq.exe	93
PID 4620 wrote to memory of 3036	4620	Kaqcbi32.exe	95
PID 4620 wrote to memory of 3036	4620	Kaqcbi32.exe	95
PID 4620 wrote to memory of 3036	4620	Kaqcbi32.exe	95
PID 3036 wrote to memory of 3160	3036	Kbapjafe.exe	96
PID 3036 wrote to memory of 3160	3036	Kbapjafe.exe	96
PID 3036 wrote to memory of 3160	3036	Kbapjafe.exe	96
PID 3160 wrote to memory of 2068	3160	Kgmlkp32.exe	97
PID 3160 wrote to memory of 2068	3160	Kgmlkp32.exe	97
PID 3160 wrote to memory of 2068	3160	Kgmlkp32.exe	97
PID 2068 wrote to memory of 3724	2068	Kilhgk32.exe	98
PID 2068 wrote to memory of 3724	2068	Kilhgk32.exe	98
PID 2068 wrote to memory of 3724	2068	Kilhgk32.exe	98
PID 3724 wrote to memory of 1920	3724	Kbdmpqcb.exe	99
PID 3724 wrote to memory of 1920	3724	Kbdmpqcb.exe	99
PID 3724 wrote to memory of 1920	3724	Kbdmpqcb.exe	99
PID 1920 wrote to memory of 1616	1920	Kinemkko.exe	100
PID 1920 wrote to memory of 1616	1920	Kinemkko.exe	100
PID 1920 wrote to memory of 1616	1920	Kinemkko.exe	100
PID 1616 wrote to memory of 4748	1616	Kaemnhla.exe	101
PID 1616 wrote to memory of 4748	1616	Kaemnhla.exe	101
PID 1616 wrote to memory of 4748	1616	Kaemnhla.exe	101
PID 4748 wrote to memory of 3428	4748	Kdcijcke.exe	102
PID 4748 wrote to memory of 3428	4748	Kdcijcke.exe	102
PID 4748 wrote to memory of 3428	4748	Kdcijcke.exe	102
PID 3428 wrote to memory of 1244	3428	Kipabjil.exe	103
PID 3428 wrote to memory of 1244	3428	Kipabjil.exe	103
PID 3428 wrote to memory of 1244	3428	Kipabjil.exe	103
PID 1244 wrote to memory of 2324	1244	Kagichjo.exe	104
PID 1244 wrote to memory of 2324	1244	Kagichjo.exe	104
PID 1244 wrote to memory of 2324	1244	Kagichjo.exe	104
PID 2324 wrote to memory of 3328	2324	Kgdbkohf.exe	105
PID 2324 wrote to memory of 3328	2324	Kgdbkohf.exe	105
PID 2324 wrote to memory of 3328	2324	Kgdbkohf.exe	105
PID 3328 wrote to memory of 4412	3328	Kibnhjgj.exe	106

C:\Users\Admin\AppData\Local\Temp\2b414300df31cc49a63eb3eef4364c9c69e94eeb9b865202890780d159f6198b_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\2b414300df31cc49a63eb3eef4364c9c69e94eeb9b865202890780d159f6198b_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\Jagqlj32.exe
  C:\Windows\system32\Jagqlj32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\Jdemhe32.exe
    C:\Windows\system32\Jdemhe32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Windows\SysWOW64\Jmnaakne.exe
      C:\Windows\system32\Jmnaakne.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2804
      - C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4180
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2672
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4696
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3160
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1244
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4412
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2392
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        25⤵
        Executes dropped EXE
        
        PID:1240
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        26⤵
        Executes dropped EXE
        
        PID:3980
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        27⤵
        Executes dropped EXE
        
        PID:3924
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        28⤵
        Executes dropped EXE
        
        PID:780
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:740
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:776
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4176
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        32⤵
        Executes dropped EXE
        
        PID:4136
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        33⤵
        Executes dropped EXE
        
        PID:4108
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        34⤵
        Executes dropped EXE
        
        PID:5060
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        35⤵
        Modifies registry class
        
        PID:4616
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:940
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1172
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1332
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1656
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        40⤵
        Executes dropped EXE
        
        PID:2204
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        41⤵
        Executes dropped EXE
        
        PID:3624
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        42⤵
        Executes dropped EXE
        
        PID:2232
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        43⤵
        Executes dropped EXE
        
        PID:392
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2984
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4860
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2440
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        47⤵
        Executes dropped EXE
        
        PID:3180
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        48⤵
        Executes dropped EXE
        
        PID:2220
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2536
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4744
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        51⤵
        Executes dropped EXE
        
        PID:2892
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3560
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        53⤵
        Executes dropped EXE
        
        PID:3780
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1228
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        55⤵
        Executes dropped EXE
        
        PID:4688
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        56⤵
        Executes dropped EXE
        
        PID:3784
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        57⤵
        Executes dropped EXE
        
        PID:3856
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        58⤵
        Executes dropped EXE
        
        PID:4048
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1988
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:60
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        61⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3452
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        63⤵
        Executes dropped EXE
        
        PID:1032
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3768
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4872
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        66⤵
        Executes dropped EXE
        
        PID:3552
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        67⤵
        Drops file in System32 directory
        
        PID:1580
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2596
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        69⤵
        Drops file in System32 directory
        
        PID:4532
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        70⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        71⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3524
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        73⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4880
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        75⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        76⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4948
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        77⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4280
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        79⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        80⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        81⤵
        Drops file in System32 directory
        
        PID:5084
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        82⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        83⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        84⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        85⤵
        Modifies registry class
        
        PID:5004
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        86⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        87⤵
        Drops file in System32 directory
        
        PID:3976
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        88⤵
        Drops file in System32 directory
        
        PID:4088
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        89⤵
        Modifies registry class
        
        PID:1624
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        90⤵
        Drops file in System32 directory
        
        PID:1612
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4952
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        92⤵
        Drops file in System32 directory
        
        PID:2788
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        93⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        94⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        95⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        96⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        97⤵
        Modifies registry class
        
        PID:3108
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        98⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        99⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2484
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        101⤵
        Modifies registry class
        
        PID:2420
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        102⤵
        Modifies registry class
        
        PID:1892
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        103⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        104⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        105⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        106⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5176
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        108⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        110⤵
        Drops file in System32 directory
        
        PID:5304
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5348
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        112⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        113⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        114⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5524
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5568
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        117⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        118⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        119⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        120⤵
        Drops file in System32 directory
        
        PID:5740
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        121⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        122⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5864
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        124⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        125⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        126⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        127⤵
        Modifies registry class
        
        PID:6036
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        128⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        129⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5148
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        131⤵
        Drops file in System32 directory
        
        PID:5212
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        132⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        133⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        134⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        135⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2148
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        136⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        137⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        138⤵
        Drops file in System32 directory
        
        PID:5620
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        139⤵
        Modifies registry class
        
        PID:5684
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        140⤵
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        141⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5896
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        143⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        144⤵
        Modifies registry class
        
        PID:6044
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        145⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        146⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        147⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4496
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        148⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        149⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        150⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        151⤵
        Drops file in System32 directory
        
        PID:5644
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        152⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5856
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        154⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        155⤵
        Modifies registry class
        
        PID:6092
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        156⤵
        Drops file in System32 directory
        
        PID:1452
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        157⤵
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        158⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        159⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5768
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        161⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        162⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        163⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        164⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        165⤵
        Drops file in System32 directory
        
        PID:5716
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        166⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        167⤵
        
        PID:932
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        168⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        169⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        170⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        171⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        172⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        173⤵
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        174⤵
        Modifies registry class
        
        PID:6232
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        175⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        176⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        177⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        178⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        179⤵
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        180⤵
        Modifies registry class
        
        PID:6492
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6536
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        182⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        183⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        184⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        185⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        186⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        187⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        188⤵
        Modifies registry class
        
        PID:6836
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        189⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        190⤵
        Drops file in System32 directory
        
        PID:6924
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        191⤵
        Modifies registry class
        
        PID:6972
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        192⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        193⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        194⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        195⤵
        Modifies registry class
        
        PID:7152
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        196⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        197⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        198⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        199⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        200⤵
        Drops file in System32 directory
        
        PID:6432
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        201⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        202⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6648
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6688
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        205⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        206⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        207⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        208⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        209⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        210⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        211⤵
        Modifies registry class
        
        PID:7136
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        212⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        213⤵
        Drops file in System32 directory
        
        PID:6392
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        214⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        215⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6488
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6716
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        217⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        218⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        219⤵
        Drops file in System32 directory
        
        PID:7008
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        220⤵
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        221⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        222⤵
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        223⤵
        Modifies registry class
        
        PID:6564
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        224⤵
        Drops file in System32 directory
        
        PID:6676
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        225⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        226⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        227⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        228⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        229⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        230⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        231⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        232⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        233⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        234⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        235⤵
        Drops file in System32 directory
        
        PID:7120
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        236⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        237⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7276
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        239⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        240⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7408
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        242⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        243⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        244⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        245⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        246⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        247⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        248⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        249⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        250⤵
        Modifies registry class
        
        PID:7800
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        251⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        252⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        253⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        254⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        255⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        256⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        257⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        258⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        259⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        260⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        261⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        262⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        263⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        264⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7624
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        266⤵
        Modifies registry class
        
        PID:7692
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7788
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        268⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7144
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7984
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8048
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        272⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        273⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        274⤵
        Drops file in System32 directory
        
        PID:7224
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        275⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        276⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7608
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        278⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        279⤵
        Drops file in System32 directory
        
        PID:7832
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        280⤵
        Drops file in System32 directory
        
        PID:7960
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        281⤵
        Modifies registry class
        
        PID:8056
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        282⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        283⤵
        Drops file in System32 directory
        
        PID:7356
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        284⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        285⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        286⤵
        Drops file in System32 directory
        
        PID:7900
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        287⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        288⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        289⤵
        Modifies registry class
        
        PID:7504
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        290⤵
        Drops file in System32 directory
        
        PID:7828
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        291⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        292⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        293⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        294⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        295⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        296⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        297⤵
        Modifies registry class
        
        PID:8248
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8292
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        299⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        300⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        301⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        302⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        303⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        304⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8576
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8632
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        307⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        308⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        309⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        310⤵
        Modifies registry class
        
        PID:8796
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        311⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        312⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        313⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        314⤵
        Modifies registry class
        
        PID:8980
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        315⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        316⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        317⤵
        Drops file in System32 directory
        
        PID:9108
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        318⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        319⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        320⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8268
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        322⤵
        Modifies registry class
        
        PID:8340
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8360
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        324⤵
        Modifies registry class
        
        PID:8468
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8540
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8596
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        327⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8744
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8804
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        330⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        331⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        332⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        333⤵
        Drops file in System32 directory
        
        PID:9072
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9136
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        335⤵
        Modifies registry class
        
        PID:9200
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        336⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        337⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        338⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        339⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8668
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        341⤵
        Drops file in System32 directory
        
        PID:8824
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        342⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9008
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        344⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8208
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        346⤵
        Drops file in System32 directory
        
        PID:8404
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        347⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        348⤵
        Modifies registry class
        
        PID:8712
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8868
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        350⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        351⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        352⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        353⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        354⤵
        Modifies registry class
        
        PID:9060
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8464
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        356⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        357⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        358⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        359⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        360⤵
        Modifies registry class
        
        PID:8740
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        361⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        362⤵
        Drops file in System32 directory
        
        PID:9300
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        363⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        364⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        365⤵
        Drops file in System32 directory
        
        PID:9432
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        366⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9516
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        368⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        369⤵
        Modifies registry class
        
        PID:9604
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        370⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        371⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        372⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        373⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        374⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        375⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        376⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        377⤵
        Modifies registry class
        
        PID:9932
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        378⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        379⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        380⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        381⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        382⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        383⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        384⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        385⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        386⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        387⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        388⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        389⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9628
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        391⤵
        Modifies registry class
        
        PID:9704
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        392⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        393⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9912
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        395⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        396⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10124
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        398⤵
        Modifies registry class
        
        PID:10192
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        399⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        400⤵
        Drops file in System32 directory
        
        PID:9352
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        401⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        402⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        403⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        404⤵
        Drops file in System32 directory
        
        PID:9796
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        405⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        406⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        407⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        408⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9308
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        410⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        411⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        412⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        413⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        414⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        415⤵
        Modifies registry class
        
        PID:9452
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        416⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        417⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        418⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        419⤵
        Drops file in System32 directory
        
        PID:9616
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        420⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        421⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9756 -s 416
        422⤵
        Program crash
        
        PID:10264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 9756 -ip 9756
1⤵
PID:10140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
199KB

MD5
53ceced5e2766f49d68784ef01c86be0

SHA1
e9fc08f5d23cc7038991c51f0a9bd3209880987b

SHA256
54cf5d0e9279252cdf43ed6ea83c873d5ddaade537b2de59c78a7ce7ac0b6ce0

SHA512
defbb594d1f443736081c303f24fbd0382c685274ef48053c41e11dc3d125ec3fe3c70470f67ffb3c324d6ecd39587c2816f0275553df665d857c8905b11663c

Download Submit
C:\Windows\SysWOW64\Aeniabfd.exe

Filesize
199KB

MD5
bb8deb15ee0a14b95e719ccba1807c61

SHA1
7826f53ac6c93b64d08d3d72b0c817184bb5da79

SHA256
582c1a3d18d1ccd060029df10a2ebcbb0560518830f45e5512c6326b6298bbfe

SHA512
3b4864bc4042d097378f493cb27be45a245d68836bc21567a2207d27178ccce35350a3768e0e392d69ce250db290c8dba640c2d907017012e0ea2c84bed15698

Download Submit
C:\Windows\SysWOW64\Agglboim.exe

Filesize
199KB

MD5
ab1591f460e3790f35c620b644747268

SHA1
8ed746c8655c291f77fe8c4362c133e330c41633

SHA256
ee530420e6740bac97a19a0dcb9153bbe23d0ed218f2228ce695432bbfe72250

SHA512
775150e1a0771f3aec1e3116764d2245dfce6dbbf51a2f9c0b847af11805151b4eab3091337ed1e49ed4e86eac5bc32a55de8b71d2e59d643d69fc5a0daceafa

Download Submit
C:\Windows\SysWOW64\Ahkobekf.exe

Filesize
199KB

MD5
19c15b41f2dbf1367ad06a29f4e1106d

SHA1
97ad5253bfeff779577f2436ae1d99d4f1eac74a

SHA256
479c554a0b778269241255571d1203779edbf8a81e64b9f815fae3f52c8ccf45

SHA512
5e273729c8c3a3d8364221afbd1e488b5f8dd3bf34daf47af99996f1d74f7dc885b8bbe91394d65f5c801d06899ed530096a743ab2da731148e5773f293bdec2

Download Submit
C:\Windows\SysWOW64\Ajckij32.exe

Filesize
199KB

MD5
16adf59e22180d922bf1cdbd4e6721ba

SHA1
9718b4f60ab43e238bca8363ca01a3c4b19630c6

SHA256
e8d7dffb9d04ea4b3b1073cfbf663ea2bc6b5245a2108bb13da9608dd80ffc93

SHA512
79bf4d84b75feeb04886250a30f2a614064088c5f6e798c38f57cd212a13a7555327e422fbff5b239b26720db10ee9097d2f3a6f24b7b356ed8e842811b8b322

Download Submit
C:\Windows\SysWOW64\Bahmfj32.exe

Filesize
199KB

MD5
3fa66d87f6cc754fb908c33717f1c137

SHA1
52b67fc7d1c2ed60bb4f973512305f214b2cdd9b

SHA256
45a2a98946852aecc39c2fdd34de1ba98f7a9d9bae5e7204b66125a99ffbe419

SHA512
bca14555849a52d20dbe30adbe19ee39bd4b64c19d17eff0e8987a36d48f0fa9f4da9b17d21e5e6cb914b822c65db2c6b6e294f197c474a9d158b3aa362165ed

Download Submit
C:\Windows\SysWOW64\Bclhhnca.exe

Filesize
199KB

MD5
cad6a6d5d4784b3a83ef0698b3fa12ad

SHA1
bdaa03853b6c58452102a144e052108b0500f669

SHA256
ab54b02a206de66de9d069397fe69eae2cf6a029104ebb36bc51c5bf2ede94cd

SHA512
b94a73288666fbfcde92de57bbd1c94e4be0370cdb1458cf772f2c48fb9917ff2028707d5700e351cbdf36f1cefc4d16e79c0ff10afebcbe493cdbcfcad662b0

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
199KB

MD5
20b24a03737754d59b284b01d82025b9

SHA1
5449b4411b2e4a84ec23a32cb18fed6715b9a2b2

SHA256
610d81d90a36248fe08829c9d8d7af9fc590817eba580aa0ed24dbe79c971e4a

SHA512
4f9855c1303a84df915c4b2205eba47095e1fc657dff92c7733a389425c22613df6180d0f606925f4daf05b706aa2337641cad1fe001a2d6d7536608799699a3

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
199KB

MD5
8f2410ad66771fa75f65c99c8dd44a75

SHA1
f2bb47efd89888f4c8317d2e0a08fbe1a7cf725c

SHA256
21733fa0074e65713f2ad5e5376efdc0f3c266c71938d942a2637a9bec8d99f2

SHA512
e0ff8bf2b60955edab4eea2f26e8718fe77772c83ae37e3a1dfb42fb5b8ab24baf32fe99b229288aa709b9e44ffe0abc9e36a58b18a9ed01dcd7265e16680a8b

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
199KB

MD5
3674d4c4b49356eee274a731c541753a

SHA1
e278c9c980b08b86b789ee242e5c08bac815ee5b

SHA256
c00b7d6dce38b0825a303919c96fa3db7de83ced5a136e6624da604e8ad53647

SHA512
101c6b0b5c9999957e013c739736b79e13cb7a45d88e0214c9a4eadaa83db5608444c913cb7ed6b1facf69b044e65703120eeef13e245c5ffc142757e3905af8

Download Submit
C:\Windows\SysWOW64\Bnlnon32.exe

Filesize
199KB

MD5
b3e338a14d9515500af1aea123cb9547

SHA1
b40a1593e12053e5db0f646c262e90264b1ac49c

SHA256
be12999b48b8adc67d2d5f90c1eacb5db30cc6908e74ae7fe9aad160bcd59d20

SHA512
202cdb760199af6278ba49906c2ba4da3868234d7085136d88a1ac7b1b7ed7a02eeb00914ba5418d28d17bd6a2bc047158145750f2fba7c99d49b232230e0c17

Download Submit
C:\Windows\SysWOW64\Cdcoim32.exe

Filesize
199KB

MD5
69bf5810f49b4b46b93de24cc00a6775

SHA1
5d646b1f19de9fb82a025c6d0035d3998405a957

SHA256
a99ea09166d1ffd6e9f09e9c143d245184eaabf61e144a85728eefd1249c692a

SHA512
3a26c0fe631a51ecb4162758b916c8ebc76868427b026f5901ebec1395e4348fbbc5797492ea8afa9a5ff6e3e2a6f49bea6f8894133ee6654cc398006aa88672

Download Submit
C:\Windows\SysWOW64\Cdfkolkf.exe

Filesize
199KB

MD5
42565dee3eef6f2b30ee856d5ad15a04

SHA1
cf5a0ecdb07bfded716b9580fd6c20ff193c9773

SHA256
983605ca01539d6174d5a1b142176281ae9760df40d8ea65a978794a8c7ca1e7

SHA512
7a59265fd303b4650e3da0317bcbff00ad214f3ae615d1f6966bd84f65814fa24f1ce4ea18498c41f5fd99354168b6a61a99db939c565ebd4d0299d173d1953a

Download Submit
C:\Windows\SysWOW64\Cdkldb32.exe

Filesize
199KB

MD5
a275c83365c91b95c1735858678eedf1

SHA1
dbd6888345f773f5a136426dd7eae08e7862e93e

SHA256
9edee9f8d556f393365d3b3937165a0c9f2c91c06c2640b537c437fa1b475a41

SHA512
75818a7e6e85c04b0b2ad92329fb659b72c46fe455358bea2e0c0600dea3f4e5fabeaa17b9a7c2c110a1a738b39b976b7a74c9f45b8b343887f3e75c15c0424c

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
199KB

MD5
e031852b0bb4f469587eb9a8d3f74489

SHA1
524b7416c768c5612d63482c85684ce8914e1f68

SHA256
dba574d5de712741683399214472f28bcc4366336f45cb0153e6c3bd985b320c

SHA512
f48dae69313427ffa7a2a88151e28a5beeaa3a866eddc98374e8a40e32be039379432b87619df8634439ab5ff9e9afa6c5a11e742ead055cb534df48ae1d6be3

Download Submit
C:\Windows\SysWOW64\Cmqmma32.exe

Filesize
199KB

MD5
0e065b23e5e7c78d4a04ac3bc375e9f8

SHA1
9279cebf9c7f3ccd84de269656a9b0906f2622ce

SHA256
c50ab1bdaab115ba2ed80aa3a05577bb315db60772b31793873bf67a640130c9

SHA512
9c86dd08903dd916ee6066b3806f005bc77144a7391551450db96546104df3a015e33f92dbb095a1533dcd140c3df6bd84370c1a0e863cb4a306cbf1ddbd9a1a

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
199KB

MD5
4009700017084e8a7ac5aa958d0d26e1

SHA1
7bd1f3fbfeec2ebce6fc85a770fde8159ed8ad2a

SHA256
4d2e67587cf2dfc3df37c8e1ff1fc4730a33ce773f9b50c92a02493ebe0f5e16

SHA512
51f4a90a1f23d00b8bf35d3303309f4b0e13d5244a09c7bb9d1ef29fc6681074c7f8e7fb7cdfcf55030469211c547f5db8f6355a4315795ecc92b5fcfef4cf60

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
199KB

MD5
ef0052c9c0f033b7645e3e265d0b954b

SHA1
078da276d6f567bcaafe846590e19891ceb5e72a

SHA256
4986851b8e205c376ddaaf77bfdfd6dbedd13b6c437f8a0722fc503259fcfd0b

SHA512
f015f428541022156ef30d110a300c70df8c709e4f1b45914480fbc2a5fa6fec87657f7f582ccc64b04ea5076f19fac29a1e0a4b3dcc36994f80c4d8a619e229

Download Submit
C:\Windows\SysWOW64\Deanodkh.exe

Filesize
199KB

MD5
8494e64d4ddeef6b9acfccb2a14cd7e6

SHA1
66e5c1200639b392ec4a57c7ccfc3b6274453b80

SHA256
e77a61f00fff8eb95bbdf0e77ffc4a55093c005f049936172fc636d62523ab0d

SHA512
6363bd0bbb14cbf7d72f222d3ef3a36d0c566e3308533333779bb201314a8d910e1bcfa8623bf45c4e059dc50b44fd423b5595a203ca28dab46e414e2345ef61

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
199KB

MD5
edb0b58381993ad787c04c6e3e1df518

SHA1
7d0d18f88ee764cb2ae0daa74d1a865e4b6b2fb8

SHA256
fc2bd4f9705d92e2379b80b0915c0699300a5d2fd0857025eab05469212526f2

SHA512
11357866f48f12a5ceafeb53205e083603983085a6b79c98c65db17c8f16ae770cfdeae6c0794b9c77bef5f3d6d6dd867f83ff2eeb25b28697e29c7f55b3d678

Download Submit
C:\Windows\SysWOW64\Dhmgki32.exe

Filesize
199KB

MD5
9a523ebd032ef535d846d613802bd266

SHA1
26ef6c5ee1b8f126f1870b9cb3949ad6b6384f14

SHA256
6fe6827d43235cec43e6bed0193fc7933761ec6c1bdd66db01306da866532401

SHA512
2f34e1283e1a687f88d82557f400058643561145e38332ea8f94b4320ff503085fd11785cd0d1a189142f199701ca1a3159d8af1407f8e08ed73ce5939cc2a09

Download Submit
C:\Windows\SysWOW64\Dlijfneg.exe

Filesize
199KB

MD5
0b48863a17bda4aac8c9a628c11ac617

SHA1
79f7499c9d14c7efb49aff5848431629b6d431e4

SHA256
f00332496fe091b6f38f129db5f920848a8bd34f7b10bd497fa58cf21dc318c4

SHA512
2ce116c71ad9f5c5f90a34926fb17cd1df25be120872042a88867d15a4ffb459ee8a506028c0e1d839ff2cfbbe5230a09c0bb9b28cfd4e0be2bea72caf2afbad

Download Submit
C:\Windows\SysWOW64\Ednaqo32.exe

Filesize
199KB

MD5
deeb663a767a08912cbccbdf7675d1ca

SHA1
0c86e1ac9ccc7eaf041ce6722a910f99d004ec10

SHA256
8c6dec7177e49908f8fb90b91b79db39247e0ee9ea5b47aa3032ba7e5562aebb

SHA512
0d1550d6afe3dfb61dae149cf0f11c58942785c842fd072a25a9d94134037ac64ee6c57ff1f98eeb7efc22b62e78727cbaccd6d5ba0a331c5445518c1101c9be

Download Submit
C:\Windows\SysWOW64\Edpnfo32.exe

Filesize
199KB

MD5
038ff2f65506c8a2d6b56d63e5464875

SHA1
03b95156339f1223c148db6a46736f83e485cabb

SHA256
839b70d4ed92de4ffbf1d15938fe04b6ba832d690dd983db2b51d1f38c16b157

SHA512
c1e72216f689d2e6af64a775a7f89f3a095edd313cebb1757b9c18b7a1d0a066c91c3bb842006fbfeb106a809167457d9645f716d46f055fbc316665cdfdc2dc

Download Submit
C:\Windows\SysWOW64\Fljcmlfd.exe

Filesize
199KB

MD5
bf21258f8e7c23524f462c96bd290c65

SHA1
aa911c5e9bb44355a78c90b7b8dd6d6cabe22d1f

SHA256
b588884a457017060d0c11d53609142f26866cf66346a731b295006103ef657b

SHA512
c1b57492d2614a4ca0774eccda1229fb8c13d11d0e4db65503fcfb6cf13583126d26d1ed001d476e561d3aa6860e743efdbe91bb886de01cdc89302ff9b99527

Download Submit
C:\Windows\SysWOW64\Fojlngce.exe

Filesize
199KB

MD5
a1c4cc1c6e42b6e07386422b3f981d9e

SHA1
b3139aa7f2d2ea7e1ce2c81b2b2a8aafc23721c2

SHA256
6dfaa51254c2f917e0a148a995d1172190f8be70cdea5195f21f3fc19380b902

SHA512
3344d7d66fd1b1689edb603bd0dd26a4a96f04aea77338080f159c862485166994e8e0c189545284a67d21e0239eb1d63e148ee7b9d2d80cb54192acf6e9bfb2

Download Submit
C:\Windows\SysWOW64\Fooeif32.exe

Filesize
199KB

MD5
a743441fbb3996d532b386ec1d72ae4e

SHA1
04f65b300f8d0ba461c860adbe58b74dd7364817

SHA256
b480e202ef5b7672c5815221005420db88ab32e8ca552d7aa2c8ef6b46649d33

SHA512
e7cf6039ca5f851992d09ac3a900c67e83dea6ad71d8fc77c94fb3fd794b351838d0b1c8e830d35a3de8e1ea282805c7a8003631e44be7f941c6dbdef9f52f5b

Download Submit
C:\Windows\SysWOW64\Gbgdlq32.exe

Filesize
199KB

MD5
9a35a59e9620997cbc7db08d63a881a5

SHA1
7a7c614f9395efcd825365f8b13bd381444ad8b5

SHA256
05e40290ec9a14fc6110ab49ad92cbb27ff7b752c2a42a21f0cc1b99cb41ae92

SHA512
4c701ff61338b8c17f56fc40c4e3700f573210a9856af5bd8e8601821eb59ce59fafe7a5715c0bd6ffe7ae0443e1fb9ad8402081e19b05c3ab58403171cae8ac

Download Submit
C:\Windows\SysWOW64\Glebhjlg.exe

Filesize
199KB

MD5
504987ea2f9689912ea9bb4297bdabb7

SHA1
457aa1d33c26724add76fa0eb313d4a1f7429617

SHA256
d2cd826395a4c22668bc3b510a18dd261d250a46bd8e229d4428ffb7dcd6cd90

SHA512
af42d8bbe802ee281e03d5df2793577e1b9d5548458dd4222491bb62d7c4fe00c0a7fe33d12a332deee348c6aa55fa93ff78b6bdd6840394b808b64d21464b3d

Download Submit
C:\Windows\SysWOW64\Gomakdcp.exe

Filesize
64KB

MD5
26b585331682b82816ab6b015932173d

SHA1
a62e845ec4e90ced15cee6968c18be5242efb7a0

SHA256
2d054b0571ace76bb1616b09b4f799ec373e9cbd6403ebb8ac86a544e1daf32d

SHA512
afb4e3c5886b42ef1c6f6f83887563800d2f7da87461ad4a14cfef0711c51923e369eaec5c427b63b68a454a27114c5272f39c98bbeceeab8ac3c0171635d391

Download Submit
C:\Windows\SysWOW64\Hbbdholl.exe

Filesize
199KB

MD5
dbc4918b7b7980c96441d27a426d2c15

SHA1
fc6a82dc4460e6fc0964347c00495c1fb2c253dd

SHA256
d854ee1183cb7b2b40749ad1df756efc60cbcbfd26e4e147eec0a85078bbbd3c

SHA512
39ec9c9839d1ab48895207d7451f6cf00d1f199e5817ccce96a6893a3d9ddb1fd1f8b5fb16a53bc806b1772716ea74c40872a58e142f3657e938129db8eed49b

Download Submit
C:\Windows\SysWOW64\Hcdmga32.exe

Filesize
199KB

MD5
043d4e8103c39b1d86ddaacf95eb9bad

SHA1
1a69963c85a7cade6856a067544addaf3c0dd4b2

SHA256
f134b0dac13afb87bd4aa02db0413ad674f6e322291e99c4c49ae93708236707

SHA512
6f05b42d85f11438327fdbc3d19d54cecd71b90e7d8906e80c44aece126c7da875c183c65e0d3823a0b8a8da19b95160aeae419c64c2bf0d3081a148b227a49f

Download Submit
C:\Windows\SysWOW64\Hcmgfbhd.exe

Filesize
199KB

MD5
3d24254fd588fa8c16fe85f2f33284f9

SHA1
1aefbe2f91a7e0e1b6058158d8ae5b3dfead030f

SHA256
20c6e29424226a4420f2c0b956d72b6d7d40adee42c833d7e4dc5ed4f9173058

SHA512
f218624b2208e2396fb2a34172ff56b03a9084be9a13504c85141e575ac12461bab672cc33cfc6522a465d81af587d0041cc1c27f80edf2f447dddc85bcfd232

Download Submit
C:\Windows\SysWOW64\Hopnqdan.exe

Filesize
199KB

MD5
11b13994f9b026965e4dc34eda031e61

SHA1
2ed49a4f143287bb24476af022234ee65d1d49df

SHA256
be378434a7b463ae3e1567d67b3ddb0abd832f49fbaa4a87e6f58ae126c39ce9

SHA512
5fbdd8c6614fad841d54d46cdc595b6be4b70cfa73d58338a303a711ca016398b592d4518b84403c3945b23bd09ac71e6adc47aabcc8cc76c81de8f12473d40b

Download Submit
C:\Windows\SysWOW64\Ibnccmbo.exe

Filesize
199KB

MD5
790b591e6bace7e457be0b5b51e78a98

SHA1
0ae8d8e13d47088f02082dd1583ea2e638982e9c

SHA256
59e1d332c572816379ecaffea766405afd0d1fb58d414979f325a87e43866bcd

SHA512
2166122d905dcbdbcfad7608567eacd7e59582c61e75774520be655972e49bd3862842d511869b12d155eb9280fdf41bcefb6ef04c31f08c35b5229d4cec4c09

Download Submit
C:\Windows\SysWOW64\Iehfdi32.exe

Filesize
199KB

MD5
2b2d6b11aafed0ac666d4c9bc7bde3cc

SHA1
14e5c3a3ad015c60d37c292e56c51b0846dfd291

SHA256
3a2104db3fda2baaf4f8076c9f906e2ae4b5388c2cc349fa1c4295752463decf

SHA512
a628dd29e6d13d9b41277c9041379b975c7e0e82fda5c4e27724a12807198c0cb9ec44dc8af8a782b47c33342935c3d0577f395a4157984ffb40c2b51e61dfbc

Download Submit
C:\Windows\SysWOW64\Iiaephpc.exe

Filesize
199KB

MD5
0aa4d6467537a7a0db40fada7fd2f44b

SHA1
21439dd6690d3c1f90c63f1f46aa8b8514076d8f

SHA256
f73f8b47a9387f01b52031cbd9aad51069a1e9121541ed0b5c784b8bfccde999

SHA512
8f3a53cef74ad32ff754dd45815f7ad69171b64bd19e30bd2713ea49ea3d5461d7b15cb131a3862649cb1d4884deb32cac314d355375ed75697d6a9b4d88a000

Download Submit
C:\Windows\SysWOW64\Ipbdmaah.exe

Filesize
199KB

MD5
53d546f8f9d48cac33afbef5fe93f580

SHA1
3a019319de6aa2b5d4f6fd97e7a10d5319ee27e8

SHA256
08410b71616f485540b0c5ee4e410134ba651c9fc9cb544494db99194a6f8024

SHA512
7512eb71cd4811da67f282ea8f2400dbd02f80f2a445795a32ccb8a85111c5424f19a1dd4b25004e9fee503006c0e93e93915cf6f8b18fb3291482f6a7e4d619

Download Submit
C:\Windows\SysWOW64\Jagqlj32.exe

Filesize
199KB

MD5
b5febe3d525fdf6f2bd55c6a4f980792

SHA1
2db845281dfe25f8c0dcee2824953513d78a3949

SHA256
94a9341ee2013071612be0f83a8f01bf75d0d6d7d203a446ddbe2ebfbd2f390a

SHA512
dadb0950e63b9880d706be7238271a5aede4245aa2c14fbb0b7122f6b0db16bb391caab043768ba1525a58526cd708723cf05a30df9982a38af472f8eb44bfd9

Download Submit
C:\Windows\SysWOW64\Jbeidl32.exe

Filesize
199KB

MD5
3e640c0a20272fee268cf96aedf454be

SHA1
5bcc394a59b3562895884f65d50707c1b2c1ca78

SHA256
114b17c40d378aa4fd98f216a66b4c5a18926b3b7b7215e14fa684deb670c413

SHA512
468ae1e59bebc39c9f13435526a2873421a53dc7229e07525ebbbcf05272cbdba6a89cb70589d80123b5858d196b1a3c1bc3dfa9ff69854fba5c2bc7d4531402

Download Submit
C:\Windows\SysWOW64\Jdemhe32.exe

Filesize
199KB

MD5
dd3089a9ac888f3a7238f279d1ccbc41

SHA1
baa19689b11083282de47810c17432c5b85dec53

SHA256
6d8ce1838ebf0842de528b86c8d042d17db7f5d9ca9220d9fa37227ec0b42396

SHA512
cbbb877a1f49c4167d209c6b67782b17b949cbe6e8378dde75b9be53e579dbfac3ea59eb1941b4ee6d694e1ef71c374f9a6b8d085318480bdccbaff10f8d39c6

Download Submit
C:\Windows\SysWOW64\Jdjfcecp.exe

Filesize
199KB

MD5
5bff00a2836c5a7a97158bae2eaecf80

SHA1
b709b355e71ff3581b2835a38fa2593108eeb4b0

SHA256
abc2a868384e559dee449f88fd4ae1470ed52ee47a7644d222d67edd03179c04

SHA512
876121d11ccf8bf1dcb7ee2803e3c1c67ccffbba3579e7bac76b2e5e9392879ed637a762ea38de07feb75cfe84c43c69f296c4b004352f281e92c9ee5c9d4048

Download Submit
C:\Windows\SysWOW64\Jfkoeppq.exe

Filesize
199KB

MD5
384f4c075f8965a2c2b42d0f2ba39a2e

SHA1
59200aba20ce6b6cf0122c8218747026ea1f9e15

SHA256
5226a7b01c8d5936a18851bad4ad6a4092346793c1db41a3802b0b1601d869db

SHA512
e95b9a70aadc1b58260c1c92641e30ef99cfa164f452981c13114e534b28a7db6305f8e36c841c977a1c8f845a16a5c7a77032bc8b9ef9c76f99aff09a617ff9

Download Submit
C:\Windows\SysWOW64\Jfoiokfb.exe

Filesize
199KB

MD5
5ab9a45c442d48c775dbd8622345626a

SHA1
0165149f57180a0a5f7129d5ed83dd7f51bdad2f

SHA256
be900b6fd23b1b8cf3792ede96b711af1810cd01cce1901c3e634efe006a902f

SHA512
4b5dd85c81c3369ab44798efdabb130a3463b87382ec1fa8d41b731d9e5e19399bf4cc49982def07343753bd60081a8cfecb026c45553d6521c094d2fd3d8da1

Download Submit
C:\Windows\SysWOW64\Jidbflcj.exe

Filesize
199KB

MD5
dde829057addb3fa3105890979944b25

SHA1
54758b7c927cd9106aefb6fc5609c44cb3300e73

SHA256
7e452415ad67572fd95dd5d933c4d3e6cac82263e093185e8cfee03f7fcd3981

SHA512
3573047237e6b3fae20dfbd47d187b6598ab84cff87ff808d9cbb6ab197f1fb31a67aafc49ee0df36dd0c54d46f0f316ff9b3cb888cfba3171119f2a2bfb0ac7

Download Submit
C:\Windows\SysWOW64\Jkdnpo32.exe

Filesize
199KB

MD5
f0134b29af8bfd79d3fa3a39c3208f29

SHA1
3530613c092063df77dc53c31e4cf866b45ed49b

SHA256
a9296a5a76cc23981334ee4c105304e07f8c2b3cbcd8aceba7525bc4dcb10850

SHA512
f79fd1c5a383d91abd335152e69bb296a061837e857c94a6ce15f959249850589be4d3bce2aecccd75208ea2badadf170ea2a7401e07751324cb41c3ee3fea0e

Download Submit
C:\Windows\SysWOW64\Jmnaakne.exe

Filesize
199KB

MD5
6acd038b3d2e22d3ffcad2b092aae69b

SHA1
6dff8baf7d709b733f5409d323ff29564baba71c

SHA256
54ab8a1d543a18c727d74ec2799fbc27cf006ab2c26e765667ff016a0a4244f3

SHA512
cf3aa3b63048f6f929dea4df8175a284e2f48abda7b8d9da3b42ee460fc846ed5b6ebce3ebb00ddb5cf56023750d64c9d51a2c3b3c9526aff8ca1ee3c99958d8

Download Submit
C:\Windows\SysWOW64\Jpaghf32.exe

Filesize
199KB

MD5
6041861197c85c118be2acdf724efe38

SHA1
bf5eb1a7328b0994533c3b2bc1fd6d310c055ec0

SHA256
378bbced2f89c2d4408d0fa88c7e6a009ad1263965b19ef663c780fd140aa36f

SHA512
871aee7e58ed12aa1939ed00028e95f16ce91b219900c8305a6eecb1341dc6cf309b1ac06b48747d3dbc7ec5eb12995b79c0b8e74769ff281b21f2205cea3112

Download Submit
C:\Windows\SysWOW64\Jplmmfmi.exe

Filesize
199KB

MD5
92732a8f391a90dd7e68efecd197c69c

SHA1
22e598fb466dbbe3f6aeb35ee2c86b056086f219

SHA256
02fc61fd47217c66107301f11757b910f3ce66b0f8a4902db158bfb17815d5b5

SHA512
b7e75137554944a9133e6db54fc882748bf6c15574c8cb6e9bf5dba64e8ef49a99cdfc862cad2943332eda7d74852e38b98cf80824936ee443ceb509e545fbf3

Download Submit
C:\Windows\SysWOW64\Jpnchp32.exe

Filesize
199KB

MD5
5617df0fce6f69dea7db87784940e897

SHA1
4e3be5f764619c598e9c2484769e745fb40f9617

SHA256
a8cf8dd56412641fce66346cde496090a5b3ad1e144328482cd8285d324762cb

SHA512
14cf2143485f90c5e6b359d1c55d6ce7bde8d0e14f759e3bb4aff4568c6c176932ace5b9e0db0247f92213c3228b1d3c240f854deac8f78797174d9958781705

Download Submit
C:\Windows\SysWOW64\Kaemnhla.exe

Filesize
199KB

MD5
ac586112509499acb570ae771f099bbe

SHA1
efbbf1824f19ed47f3a91984a7d8c671e1ee1ef6

SHA256
2144534eb6ec75063e6d9ff526cf22e5b32b97027fd4f3ecf37e30a2be902ae7

SHA512
22dba61469b58d605257747209f7b5a90ee399728b83be8b93c8ab947182d7a557a5a12eeb6d9e57451c509dc374edc76dfa86a5445522ad5c99dd6db5ebb6e4

Download Submit
C:\Windows\SysWOW64\Kagichjo.exe

Filesize
199KB

MD5
abf5e0b42cc2488a61e981c30089d511

SHA1
95c4e7fe825fa6878faf54d73da539801b84aeb4

SHA256
3fd070e40eb0c957d7b0adbdcc71bb0f6795b0920efebee116ffe699da9d1620

SHA512
e88dbe574ec5077117da39827e493ad7d2fa97012c400f3c334facb553199315a54e4aac4a0efb101792a673fcd26a4c7e519b0a480e683777abdb0b6ce90770

Download Submit
C:\Windows\SysWOW64\Kajfig32.exe

Filesize
199KB

MD5
348f2ff351dc76d6626dd26b20a654ed

SHA1
0a88b4e45b1e064797f37833d5aff525aab5f15c

SHA256
493ce9eef4ff6d99b6309d145d09462d4ea4431332134c7cd681fca5e75e9c04

SHA512
a3791a9758de0b2c9d95d16861349235e415cedd956a24cc2347d2f38d311a0e0729e905042a0b8babace93a3ed2462cf21af13ea3d0b380cd51dd455008d8d1

Download Submit
C:\Windows\SysWOW64\Kaqcbi32.exe

Filesize
199KB

MD5
7dd45ef0153ec98b3620b4c352a13201

SHA1
87841f5678edbea258f3662f4c1525c9f1c0d7d8

SHA256
0e6ffcc5d6a04cafdc6376051b709ffaddaaddcb7af12c5bbf4f5178cf60f013

SHA512
34f396b6ce74afb604cbe9ad1917e58e71ac0b8c74c70f22050a597109721b0de8a750b4e006bcf21d6a92502e617ffb545ec166df085f0b0af0c9a578842f6d

Download Submit
C:\Windows\SysWOW64\Kbapjafe.exe

Filesize
199KB

MD5
8e52351685bd2a939d1aa749d5f6c4b7

SHA1
ee1b994b45d6ac0a6ae184f77ad6989c000a4226

SHA256
a010f655c875236a52c44a72d8c0bd0be70bf50ce68aeb1c7a02f3d5f3602839

SHA512
d8d987ff66237d0def5cc47beb7d59ead230e322fa4eb500fde964c961066619d4ce6e72d309e6eeec4c7f4acfd49434c5c3ba08d7fd5d0c014d0db5b363c800

Download Submit
C:\Windows\SysWOW64\Kbdmpqcb.exe

Filesize
199KB

MD5
dcec5ed4fd50c32eaefc208ab3fed844

SHA1
e80b58238212be31dec6f6273fc2ee7d65c6c56c

SHA256
5451f16b5ccd82ecf9f420124c7af22b6d93a2acc02bcd054cc75f472ee38d29

SHA512
9719b4b80bed6160aebf4cb8f2df33c305ce72b9f23b0a1752c2d35c16d8ff6040187afca076ff6425a379b8148b8febf79d7b9a50c72f7f91e6b3863bf0f792

Download Submit
C:\Windows\SysWOW64\Kdcbom32.exe

Filesize
199KB

MD5
df317b360245811200f69c5cf8f818dd

SHA1
456aace2ed2b3149117d8ea91ba7d600176bdd59

SHA256
2a6a09fdf02d72e94de59d97bded77106deb97ba4a108136489fc0db29b1d5c8

SHA512
ef45a0276c9ebfa60e6e187dbc4de89db6f7b142dc7de8699cffc3a42ddf817e1df2b2875b78be824342909f8b18b3eca95b5cc07e47da00a234a68e2708e4a0

Download Submit
C:\Windows\SysWOW64\Kdcijcke.exe

Filesize
199KB

MD5
3dbd6dd9d93c94a376ca7d4ed8682685

SHA1
fcdc172ffaacd024340d8458b88f2abd55853b05

SHA256
c785effdd6c9bfcfe8b57a718267e2fad90e14179dd2d9e694c11c84e68da544

SHA512
739fd3c9d776db71a62f266eda0ab7871b75fd8efdd0fa9334b4a8973f5083d6cd07955f31d969de2655907633e54f33f77945fe354db808832f9fb0ebb21e28

Download Submit
C:\Windows\SysWOW64\Kgdbkohf.exe

Filesize
199KB

MD5
b40604dfa1ff0df664c3d0e4adcb2f17

SHA1
9ede0d29bf810ae26364af28bbec8f7655a61bae

SHA256
604751049ab18285369bb5bbae93c0d812f63f3da4b22287edb41aa53c73b5b1

SHA512
5797acde981e23dc620dfbf39b096d0829b658d5c398f6a9d741390a52ba48d17036717935896f1cbe2e8cba8c8fb8b79f9dfbe40e65d3c2c7b7341da7210c32

Download Submit
C:\Windows\SysWOW64\Kgmlkp32.exe

Filesize
199KB

MD5
a57bca8328a5bab2b69b9e0fc1f28bfc

SHA1
30269096766969caa0670a2c19449169b0f69a0a

SHA256
aad6ec22b02d8792a83f1aad1b5857f4e7641620b9c67d16599d0ea569af3109

SHA512
404cb43be0dcc67791bfa53f4a34c8c607bc49a1d2ac00e65808c9b7a8988c618d39e41a23c974752c7eec5e9496b8fcb6f55621b2d85f24321919c0df9ec4de

Download Submit
C:\Windows\SysWOW64\Kibgmdcn.exe

Filesize
199KB

MD5
4f0e4ad1bd0827b90e34e06a54f55b74

SHA1
0d9d0dfcd98f702725d4932f8336b3a8c1d2fa1e

SHA256
92cf5ca121d7202fa47177e8942a809dbc1924e3860050cd01ee5d0024a919f8

SHA512
62cd45d487ba468fe2a86c68f862fcee63e706bf78fdb83c074422997ce7d74926cc6fb32a51e942a3f3740237099e516d09290aa4fdd62ceb3f051cbd4f2205

Download Submit
C:\Windows\SysWOW64\Kibnhjgj.exe

Filesize
199KB

MD5
77a62848acb0044cf24131ae1b76e250

SHA1
8b3952ba380f8d954d94c69881394417c6b46972

SHA256
d29f34f1459f4881c57f29af7d81a9bacc7e34e69f27021668982527a064ea71

SHA512
5855f1429fc3017b29499fa245154d2f9f09054783e5037166b23302fe1d458d37015763b4e70384ab35d679681cdc89405c41e40c3753bf9f1eb6bf4cd9ce9a

Download Submit
C:\Windows\SysWOW64\Kilhgk32.exe

Filesize
199KB

MD5
21c73159c1fdb46504f96b1f5f92c7a6

SHA1
b1394600a8a2e0af5359353af949726a1b810cd8

SHA256
f3e54020be5e57f9dc88db9469e7dacc59c3a537fdac84ef0983d0c16d0a558d

SHA512
d0b8f5cb3a3511b90587bc3397fcf4932bb4407953fec977eb0e5277df165601ddd2b6b1e48aea6ffa44a472376af4cffc1b8b84da1ba54c8dfca989c44fcaeb

Download Submit
C:\Windows\SysWOW64\Kinemkko.exe

Filesize
199KB

MD5
45250e80b404b7c507a3ae1589d0171b

SHA1
bc85ee4b03b6916345bf35cf2b9483ca7925cc16

SHA256
99e283db5e95d7d723af283d3a0748a98510c5b5ea2f5502d0e1a6e681f15314

SHA512
812bb41ed55eaba5133d01c789776e2d89dff54418b908327961b4afce28a568c50a50dae11c1e888ecc1d441ca9d05f1a5f4d5d11203f2122f725fb83a9237c

Download Submit
C:\Windows\SysWOW64\Kipabjil.exe

Filesize
199KB

MD5
ce208b0cc1e93dbe7a4ab7d07ee35528

SHA1
cab7de2083ae30c786b7588c39423e166f9b5c44

SHA256
56cd7936acc83ff98433027312e3d8352e023687624e9a997628f1dccc5cf0de

SHA512
c981f0ac5430021290c94344773a4ddfdf3c3c88f3ff5e072e6bf52bda0de1c799d26db3d42398a01cfa0b6a51b93c2eed8a7487346103e7b4905f46e64d257b

Download Submit
C:\Windows\SysWOW64\Kkbkamnl.exe

Filesize
199KB

MD5
0bd2f60f6e59c7ca2b965eac46b86b9a

SHA1
0f430f7b6cc1ecbda05b3222dfc123fc0829a4c8

SHA256
ef92e6c8137f1acac86b335d6c136f47fe4642c5c7c1a4628e8ca936f681e4e1

SHA512
1edcebb4bd41faa9e49b9e595006cf09ae6d494ede9b3d3a27b66dc5a74eec5d7fea732b8bbd0f76aeecf85774701ecb7e3bf5f337dc52f19465f5552101b33b

Download Submit
C:\Windows\SysWOW64\Kmfmmcbo.exe

Filesize
199KB

MD5
d21dad154b199286344de529d53c4c17

SHA1
b0c43053a03c4cd8a696e35915e1a851905d52c6

SHA256
b9b1365136804c4fe0ff2fc217d946bfd09527a18564afd1e645cdab18e40832

SHA512
46160ecd2c9e76e25befcff5a394112e31b7e631f6b0b615b406faa5162e70e9c6ef1bf7a17b431a40f124015eccbea29f87ca92f3e9a802ade86474919d1ad7

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
199KB

MD5
35e0fae607c078381502e1175a444348

SHA1
2bffe6c31c691981dab9e1968a6691509b3ce0a2

SHA256
1b35ef85ca0f852f3b8230def580ac092d8e99e22117b7e53243964b4f456aa4

SHA512
bd2f809f1b1ef6a429cc76191c89c2a64084aca29b7100ce440fc6b845250404ed4a6fd251fd3bdd81d0db46d234e6df561bac421da93d6f213547e54a4aaa28

Download Submit
C:\Windows\SysWOW64\Laopdgcg.exe

Filesize
199KB

MD5
af95cfa114804e6184be40b2cad3cb4d

SHA1
e50e56e1b4a1375ea46480e57f80e483966d23b3

SHA256
473095e98074812aa9c4d043c9819fcb9c74583c00ec32bf71ca9a1d135aedd9

SHA512
4b8cba39fa498a6ea339343a21b49cfec71d095488e4d6f89e57d3532c63b8eb6e120df94bc57b520077028b1449f2526f7002f56ae195b3b5c08c0ad1b7a1bc

Download Submit
C:\Windows\SysWOW64\Lboeaifi.exe

Filesize
199KB

MD5
d9ff0816184395fb8087cd3b89933a4b

SHA1
303b84238b19ae2cf937b1eef0c2cd90773f3b8d

SHA256
922eba2b04bc630070770b03b2b202dffbe03e01a9a3cebf7b9a81cd5cf4062b

SHA512
393e8a361f76c72dc59ae55e5cfc6eeddbc51f971d3f27517d425df973ffa44207b185b33b11d792372447e88e760344db3e1ae733320a702e1502d624c481ac

Download Submit
C:\Windows\SysWOW64\Lcpllo32.exe

Filesize
199KB

MD5
5b701d5e79097647a9c8297ea88aaaa8

SHA1
447420768b2a69a64bf16ecfa700d99b5b43ad20

SHA256
5d5a0fe0cb32fb964d9b2a8008a0ea4403673cea5677f9cef33f8601a731c39f

SHA512
66fdbbaf42b1b585aa9b25eb902b1b7021a4400e2990ef44d2f93403d0c885cdc73093182eba7082a400202f173292f47b667ac5001a582cf179130423467e34

Download Submit
C:\Windows\SysWOW64\Ldaeka32.exe

Filesize
199KB

MD5
451f0a45cd598c74727cf9ddf8ce3747

SHA1
010354dc3d911150f6c2765454c679cf55a1aeff

SHA256
2eec8db9dab152eb0c08fe6cf4453819021c97fac1c84ac5cf45aa52c7ea04b5

SHA512
69ed221d9f03bdc0d9d26583b7fd6e47c159412017ef2f0dfc66242ef6dfa7b6fbeb0d830ff4da7d08355c0afda5de320f48aa890625b414f4ea4c30d6972cdc

Download Submit
C:\Windows\SysWOW64\Ldohebqh.exe

Filesize
199KB

MD5
e9cb3ed1bf22c3a68d969959f7979808

SHA1
4fb44ea571ae8689990b67e86c806ac528c81926

SHA256
5f03639a3ea3ca42acc7cd856b2e539819b519a456702231a7e7878514d67530

SHA512
12d96a51570041f2e55fbade7eb5e3689fc81ab7203f199a01e7bb4142012c3504f5ad441053e9d1495bf33b97f3ae88490b4cf57441df1112d4135d24ffa939

Download Submit
C:\Windows\SysWOW64\Lgikfn32.exe

Filesize
199KB

MD5
f32c2057d9ca8de9c56477b29e0e2bab

SHA1
7df5f7e188458b6cb0cda8a49906e3d40c1102ac

SHA256
a2b33955a60edfb7f920c7dd3203f76b7c6a9382924d80a4c0df7e38fa114b7f

SHA512
3e702a0b81bfa22d38fbce44604317b6a043bdb677676470143558ce64af17447895dd5a465176a471102e67959b60f282643bc7f1d70263bdd3a2a31d5b72bb

Download Submit
C:\Windows\SysWOW64\Liddbc32.exe

Filesize
199KB

MD5
f140561b765a02f67a845c38074a5e01

SHA1
5432fa8b7190328a79339789303ef89f88f99464

SHA256
8d60b77a8f29005a7156279c92ee0642aacd138d146c5702c1174649d1093a7d

SHA512
a5c46ab5affd546566102d164aa0aab33975099739a4ba6e521e8ab51f8bac506501122451f890413339274d447fd9d892dc6028f21b0c6b8b963e2cd059f390

Download Submit
C:\Windows\SysWOW64\Lijdhiaa.exe

Filesize
199KB

MD5
ef3b4c23ee96415acbdb6d0ed7adb325

SHA1
9889d7859b168df877e227ef852bf75d094c479a

SHA256
cabb44a6f0afa9c49753c4713e0c44bb9c04b176e642425807fdd5e37630dc05

SHA512
17a36689df6858e70d577197457753fe2330f5b859d60db95d6010412e4c8e05510cd781e87c25657ca68b021b98dc08f2d69ad47b2f249015e7dbb73a11f51f

Download Submit
C:\Windows\SysWOW64\Lingibiq.exe

Filesize
199KB

MD5
7bf7f2e60b28b8b2b79032ff406f38b8

SHA1
166d542fd3d48d42aafb8b5fce38f54de6d67451

SHA256
1282d740fe6526c808ddef7bc9a51e619f641dc7ca1397ccbc9c5d54b072d9fe

SHA512
8010d61f7771072b76446287bee1fa9fffbef4ae351cdd20275e7075c44e95c9dbd3a88063c01da1efd1870cfec1a87f024c601d4d44589493f7972f82c5cf55

Download Submit
C:\Windows\SysWOW64\Lmdina32.exe

Filesize
199KB

MD5
13681a8b27b9d996ae9c882b86b06afb

SHA1
49a95344e28bddde4000539b0a6a524e5474f6b6

SHA256
821534f545d49029063ef57af97dbdba1a8f1ab05628e0d7a156049d1c26101f

SHA512
3d5ecc2f85b079fc5df406579c0c4aaf8fb1fc3ae863456488ceaa9cf553c3bf0edd365441eaccccb396e23975ff72303f064caef5f32d694f1e72ee48df6b6a

Download Submit
C:\Windows\SysWOW64\Lnhmng32.exe

Filesize
199KB

MD5
cd166570a86b16185f082487b32d386e

SHA1
213414eb0723128b57eccfdac6a182718214780a

SHA256
2059bbe9910e4dcd3c12f64244c602aace3dc095c274e3a3143f61212f5a4b18

SHA512
e971432f3544328755f67b792a7199e55635585021c52e46d83a47e7c20206dbe7865f2a21bf241f0bef785ab9c049a25dc34426794f2710c5e66cc96d03d001

Download Submit
C:\Windows\SysWOW64\Lpocjdld.exe

Filesize
199KB

MD5
e44223610a2dbbe6c412ee23146187b9

SHA1
ad1a964aaa02f886de4ede14f1b1d38884231e03

SHA256
8a7fe40efe83c7d8303911fa384043f08a31f0e92e4cff12e27466014bcc993c

SHA512
756db565e40efe2f03cf41e8a783c325206c9724fa35f80a2015caf1050a64894e9ac9d47bd8755f491e8bb1651764ddb890468a0d96eb8aa26d5e291456328e

Download Submit
C:\Windows\SysWOW64\Maohkd32.exe

Filesize
199KB

MD5
4b69826f07601c1885538163b7c529cb

SHA1
f0305eae3c64d5d29205f22625c852099f611bb2

SHA256
b5afce107aaa75d21629ec1ca1654c67ae30167e65cdbaf361090e37d29560f6

SHA512
56f41a8bc587c6f2c0fd6ddd6f613c1600a66413722c77904153db4713a5030d9cf6b0145d1ac9ea120766de0bc2a4477587f844c13779f7a83d1d064bd8cdee

Download Submit
C:\Windows\SysWOW64\Migjoaaf.exe

Filesize
199KB

MD5
d07f02a23d37b935e543541dc2d408a0

SHA1
62168354a28834dc015fdccf987bc52c9b257c6a

SHA256
5981a9c499c75abf77ee11db70f4459522c2117fd97d318980e91203d94c2154

SHA512
acf35cd2d0fdf9b6098071ada6131f3a3a0e7c6702d4ca8cfb289029832f49ffca4481859c3f33dd6060806d4cb99f0360cd10a7851bf5e7fa14f691fe7d2b08

Download Submit
C:\Windows\SysWOW64\Mjjmog32.exe

Filesize
199KB

MD5
11e39ba43bfd11ef03fa9d756e87b569

SHA1
400c6f06a74fc8c1cf822986159db84945592e11

SHA256
52bf5c840dc7a390728d6c02bacf437c90062c86709a8024f13896580e3f6c49

SHA512
3675ae4082e1002ee392ad473bed6d618f9deeaf95c19c4ac7665d832ac45305720da2906e3ac5a5e7083776b59dd9bb4ea6d3ad47ea067dee360dcc8f8ff1cb

Download Submit
C:\Windows\SysWOW64\Ndokbi32.exe

Filesize
199KB

MD5
646ed5045d6637834d2880b6e803a18d

SHA1
9f8faeb557731fb0e02d21ba99b86edb55929b85

SHA256
c593c16710b8d303f5ce3717ce4af5edc3931455eb9527e8a27d3b411ed752b0

SHA512
0f39e53a3924f26dcf123a000bf949e037545acad0193c55c4b74e31b9898d236f7f22a12a9fb72db1b777fb80a9250521aef20199664178dd970207aa1ceb9b

Download Submit
C:\Windows\SysWOW64\Ngdmod32.exe

Filesize
199KB

MD5
14f1308d6cbc3f4b3e96b03b7bab1263

SHA1
6e66f2533b28674ade81063ed713539f732a3e5a

SHA256
1c8c6a958655e70ccc2a12ed62b4e09dd5325615ffb30cfe14ad22ee741a8e5b

SHA512
50e404ba7934cf6674ee2501febfe148d6094f9a1f307298973994ef93cf49c14caccfb4de2d8c8aaf05d0070bb21eaacf88214374704300c1906c9ffa96172f

Download Submit
C:\Windows\SysWOW64\Ngpjnkpf.exe

Filesize
199KB

MD5
b3ddca1b0c2581c66cd6c650baf30ccd

SHA1
9d850e24875f80aa0909073f67bf31e621e2cb2c

SHA256
10271c1f77943dc9297dcde5711611881286909a121a77eabc467d7ee6efb187

SHA512
ef139f2a1cc76ee61e9cedcd1b347317f3ed5eff4546d0bf81781154898e1a5dc7797990b547347fd2f9fce57e1cf7a1d2f4f989f4993167d9889787e7e11ae4

Download Submit
C:\Windows\SysWOW64\Njefqo32.exe

Filesize
199KB

MD5
87179c673158739a1cb819f71325039e

SHA1
5e17c3608139d2a432f92b5496952213c5790dc0

SHA256
a027df91a40c9b48775dfe8707bfbeebb5812dfea5286ac2f7ef709a9ee66179

SHA512
42dd1e622a2a5109918a65d2e26e670066a1671c41a605142af1fa49270cb555c335aed2f669fee0369a396b82368cdc7d85ec7426930c2e009529f39f3c3b79

Download Submit
C:\Windows\SysWOW64\Nnhfee32.exe

Filesize
199KB

MD5
a8a245b8af3e2010e0efbd0010a67764

SHA1
cc4b1221c173f07767e7dc13063abe903d567c48

SHA256
e939f7b054a63a1a379a72a07143683f8279dcae6ad8b691ea0e71954460b947

SHA512
124acb2d2071f6a7a8fd9775397a16a0344279a82fb84b835432e53dc828143dcc64d9b83144a288c312225dfe7790c06216a40e30e835786c638adb837c52a1

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
199KB

MD5
7e1ca6f57f68805199491e33776b6d01

SHA1
6f6e8f7b26d920c266d430882ac1d5704c904725

SHA256
752be0e7a92e949d704869c3c35752f8a357541278e157567701c636ad281bc0

SHA512
a3ff79b4979a11b7a5c18472605f0d02c35414ab3ee9e3dae99c6d02e381fdc5255e43a689c73d74e61cb5782e6cbf7bc806aa607b33b5eed4900c50cdb7db1a

Download Submit
C:\Windows\SysWOW64\Ogbipa32.exe

Filesize
199KB

MD5
b0bec4ec720f341cf5cf9bfecac5c145

SHA1
e244f81656b5bab26c668b98fced045f67cbbc35

SHA256
bc51f8f789180a352a7f00e97409c6734095d865302a75342f1e727e0de278e4

SHA512
09661ff921b75fcb544a00a6bbb98a74c9fa547a284a052be10c229d8555f4e8f8fd43fbff6952ef33919e1c43d7693251f8f2f54a4d438009f1fed4a21b9ace

Download Submit
C:\Windows\SysWOW64\Ogcpjhoq.exe

Filesize
199KB

MD5
a1728a74ca3616901cf6bba31a08417e

SHA1
b24ee1ae63d30e155a5711dcc694366b05107807

SHA256
4c48b6d7896ed71adcf087d2eb8785c87d9318a15515ff21755afa6d5805c18c

SHA512
0d2331126b2ad1c5f041a98f55f016d4179a50963fbce0cdf34c20377bd0fe10d047e6b43486b3f433ea1e5cafb1e1684ad7f535272946b56749431917cc6ea8

Download Submit
C:\Windows\SysWOW64\Ogpmjb32.exe

Filesize
199KB

MD5
8a7de6c147740abb9074802337552b7a

SHA1
c754272c86b53155fedf329ffec51fdd0a6e5ea2

SHA256
667d276a3ce12263a3f483630af86c8e14c117c93926ffe5fb79593307f59fb9

SHA512
d1401b717a56dea01bf7cc585e32aa459cb77d3330139f13ed0af42c48bdd362b1b7b43bdb9aab3f0388048a07b599ab2ed880375ebe5bc6ffc530beb0dbf93e

Download Submit
C:\Windows\SysWOW64\Ojjolnaq.exe

Filesize
199KB

MD5
a9226be75e7bdf461195491c6bb90f4a

SHA1
4a0d970a12d53f92e1fb665a25d3755bbb6fe8a9

SHA256
fe139bde8267a1bb30fd4b821c36cf3d2b5c73792a5cff47221663e1aa464739

SHA512
05c650d0e327b8b7d7a34d683bd54a383d649bcc6e7d821ba056e028addecfd2162d2b96d3223560d37a741321a5d3cdcab7e5c138fa15b69ef88c1c606a4e37

Download Submit
C:\Windows\SysWOW64\Pagdol32.exe

Filesize
199KB

MD5
6dcb0e07324c1c35c74bf7925d167d23

SHA1
5e639821a1b38fb78ea6febbebbc84b41966cad6

SHA256
257b4174ea67d7f3a2f00336b679f0e2162993eeeb6ad40225826d96468078fc

SHA512
e1b1218584d91410a0a4792dd1d661fbbc906397114bd9f4b77f37fd4c2b4f26d2981cbc30860a572ab6ab242d518cc1f2fa68dc55e2e8aa23d9d57c6b6ae94a

Download Submit
C:\Windows\SysWOW64\Pcncpbmd.exe

Filesize
199KB

MD5
419865934994f90a5e4a26de7ada0d82

SHA1
fa1965c6c44763e9572aa75511ff6591d217e0f2

SHA256
67763de0b91e99787e66db917b64ee6b344471246e16744fde1e51e68ce4bd92

SHA512
549820241205c2a7adb9418a548238aac13d3f6ada0ed6bce79c02afdc4f6050e3ee3f8e8dd43cd76a15b0dac4a8b99df1b910d73511267db56f670726bd7987

Download Submit
C:\Windows\SysWOW64\Pdfjifjo.exe

Filesize
199KB

MD5
e3d835394b3cb67e80eee673dcca6d5c

SHA1
6841c4ab4c2aced9132694124ee12d505eaa2742

SHA256
94cbc07a4f8462464abf3477bf8277e08fd29c6231656078a39c2f59ea205233

SHA512
8f4e0a2b743260465087ae97c4fd2aa7c7fd7eacc79c6aeb60086153c4628b198d6d132e505eea3799ab3cfbe11f2fc6cd9894d9426b9d724c19657039eda31f

Download Submit
C:\Windows\SysWOW64\Pdifoehl.exe

Filesize
199KB

MD5
23db00f26240edb2aeab98b958477640

SHA1
966b96577657b700d8bfebd1120cb89f0a587cf1

SHA256
3710489b1daaabbb08cfe4832cd79d2d77224699d327519c917a105ff13cf24d

SHA512
94247d427ad0f267d12ce2c365f260223f8914eeda0bf79f2301b4c6a29ad24057961aac0f2fe40ce7eb63ef441fa61a42d2a19a3fddda2fde3084f90fc8ec15

Download Submit
C:\Windows\SysWOW64\Peljol32.exe

Filesize
199KB

MD5
213fb299991d138487569697fbcd30db

SHA1
de46db432c757e76ba185944e5d9c20a57d4cd62

SHA256
a99d26aa8601c016fa1ee51b0bfbc0ab4aaa507e96eb281c6ba3754f5dd553ab

SHA512
fa34979307fac31c1f46508700d0302bb37b7937b49f78c0c12787bf6cfba797fe962270d20df97fd7dab706d4b931f7dbc9e1d10f6e357bf9f2549f0dcbc091

Download Submit
C:\Windows\SysWOW64\Pfjcgn32.exe

Filesize
199KB

MD5
1f1b7c5faa5248489d1ac62e1c4f4a5e

SHA1
0486a84112d5989dbbc43c4ea908254c61e5e4a8

SHA256
8eb39e19a198c38c2c9fffa056b573e0f9c70db22bddba6ac8c8889635c25c4c

SHA512
78300be117881726880262e2ba48adb0aa05545306fa074ab0394a39517553cc0a04c7707a0bc97426c3e37dbcea2cc4f085d9136f16f26d99714a0c11d0bc4e

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
199KB

MD5
6a89062fb5e544b5d0d43b967e6e1b77

SHA1
5a1e0c36dd8de1efd0f8aef37a59f8d9b0f45eb6

SHA256
5e3e086d8157d2f01ebd1892bf2d8c84667694a0be392a216c7e3a990d56f131

SHA512
8f0412b1c5f6634539b8c07ee46a1317e949f51f658b258a735ae9062b109992c0e183451700d2b998bcf30ea82f30afaea2f884dae9ce420c8e0fbd866e5f71

Download Submit
C:\Windows\SysWOW64\Qddfkd32.exe

Filesize
199KB

MD5
86f4b0787451d59af51bea56fe19ab70

SHA1
4817767f3195b4786073323c87b121ed5e179412

SHA256
bb50d539362f209819a6d785eb0109c67f4343c2ad0d165c3ddd45acbffd8c1e

SHA512
35a4b9697f98051ce0168304b376ac0cad667389a2e64334adc8ff453a2f99536749533f35ca5da075f65186b70ffb1a5f1b48e0ffb1719be97327694158d569

Download Submit
memory/60-414-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/372-72-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/392-316-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/396-566-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/536-49-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/536-582-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/740-229-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/776-232-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/780-217-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/940-274-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1032-432-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1068-559-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1144-576-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1172-276-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1228-378-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1240-192-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1244-153-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1332-286-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1448-474-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1580-456-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1616-129-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1656-288-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1728-17-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1728-554-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1920-125-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1984-547-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1984-13-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1988-408-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2068-105-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2092-516-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2204-294-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2220-342-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2232-306-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2264-534-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2264-1-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/2264-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2324-165-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2392-184-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2440-334-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2536-352-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2572-548-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2596-462-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2672-589-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2672-57-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2692-561-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2692-24-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2804-32-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2804-572-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2892-360-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2984-323-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3036-88-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3160-96-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3176-509-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3180-336-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3328-173-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3428-145-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3452-426-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3524-486-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3552-452-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3560-370-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3624-300-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3724-113-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3740-533-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3768-438-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3780-372-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3784-390-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3856-396-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3924-208-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3976-583-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3980-201-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4048-402-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4108-256-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4136-249-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4176-241-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4180-43-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4180-575-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4280-522-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4404-480-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4412-177-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4472-420-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4532-468-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4536-492-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4572-539-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4616-264-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4620-81-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4688-384-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4696-65-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4744-354-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4748-137-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4860-328-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4872-446-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4880-498-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4948-510-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5004-574-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5060-263-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5084-541-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads