22faaefe4061ff9acde7b8e44828b4cc933a8a065eae300880e4f0d150b33899

Analysis

max time kernel
125s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22faaefe4061ff9acde7b8e44828b4cc933a8a065eae300880e4f0d150b33899_NeikiAnalytics.exe
Size

196KB
MD5

c1ca700cfc67aba18393e2ed0bfa6a30
SHA1

2f13426f972834d3b3d2b456427a712f75a99cb5
SHA256

22faaefe4061ff9acde7b8e44828b4cc933a8a065eae300880e4f0d150b33899
SHA512

6c90b36c552082954d7cfb7d2ed8b2270e05dc08c84255b4a837c81d06659bcb1de68c8b2aff50865e5c5b10b0dad8e4fb7070d069d5892f55d55837af1c2c0b
SSDEEP

3072:cyzEVFdt2vdv0Cqx4Zecgu+tAcrbFAJc+RsUi1aVDkOvhJjvJ+uFli55p1:IB2WCqCsvrtMsQBvli

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Opeiadfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nfjola32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glgcbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enigke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Impliekg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loighj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmipdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Afpjel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baannc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cnkkjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igajal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcelpggq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmennnni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Enigke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Flkdfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dmohno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebgpad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eifaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hoobdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcidmkpq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Llmhaold.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ngjkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhclmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hoaojp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kpjgaoqm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocohmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bogkmgba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfnjpfcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddjmba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dbpjaeoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Deqcbpld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpcapp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfbcke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eokqkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Glipgf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mogcihaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnfiplog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eoideh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bajqda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnbgc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpdcag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffnknafg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iebngial.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Digehphc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jgmjmjnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mqafhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fneggdhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eoideh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eehicoel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eblimcdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmeede32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfkqjmdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cncnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dpkmal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcain32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfiildio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emjgim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eifaim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fimhjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qmgelf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddgplado.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ffqhcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Baannc32.exe

Executes dropped EXE 64 IoCs

pid	Process
3004	Cfnjpfcl.exe
3428	Chlflabp.exe
3480	Clgbmp32.exe
412	Cofnik32.exe
748	Cnindhpg.exe
4900	Cfpffeaj.exe
1112	Cdbfab32.exe
2440	Cljobphg.exe
3380	Ckmonl32.exe
4600	Cohkokgj.exe
4832	Cnkkjh32.exe
1304	Cbfgkffn.exe
992	Cfbcke32.exe
4672	Cdecgbfa.exe
3220	Chqogq32.exe
2204	Dmlkhofd.exe
2652	Dkokcl32.exe
1144	Dokgdkeh.exe
4136	Dnmhpg32.exe
3984	Dbicpfdk.exe
548	Dfdpad32.exe
3964	Ddgplado.exe
4288	Dhclmp32.exe
3272	Dmohno32.exe
4404	Dkahilkl.exe
4248	Dnpdegjp.exe
224	Dbkqfe32.exe
4484	Dfglfdkb.exe
2076	Ddjmba32.exe
916	Dheibpje.exe
892	Dmadco32.exe
2188	Dkceokii.exe
1684	Dooaoj32.exe
860	Dnbakghm.exe
4784	Dbnmke32.exe
3084	Dfiildio.exe
872	Ddligq32.exe
3952	Digehphc.exe
4840	Dmcain32.exe
2924	Dkfadkgf.exe
4636	Doaneiop.exe
4428	Dbpjaeoc.exe
2344	Dflfac32.exe
4340	Ddnfmqng.exe
3552	Dijbno32.exe
2468	Dmennnni.exe
2028	Dfnbgc32.exe
368	Deqcbpld.exe
1944	Enigke32.exe
5088	Ebdcld32.exe
5116	Efpomccg.exe
8	Eiokinbk.exe
4052	Emjgim32.exe
4792	Ekmhejao.exe
3452	Eoideh32.exe
3024	Ebgpad32.exe
3248	Efblbbqd.exe
5132	Eeelnp32.exe
5168	Emmdom32.exe
5200	Ekodjiol.exe
5240	Eokqkh32.exe
5272	Ennqfenp.exe
5312	Ebimgcfi.exe
5344	Eehicoel.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Cglbhhga.exe	Cpbjkn32.exe
File created	C:\Windows\SysWOW64\Ggpcfd32.dll	Eicedn32.exe
File created	C:\Windows\SysWOW64\Hpiecd32.exe	Hipmfjee.exe
File created	C:\Windows\SysWOW64\Akfiji32.dll	Nopfpgip.exe
File created	C:\Windows\SysWOW64\Cnocia32.dll	Mnjqmpgg.exe
File created	C:\Windows\SysWOW64\Dbnmke32.exe	Dnbakghm.exe
File opened for modification	C:\Windows\SysWOW64\Ebimgcfi.exe	Ennqfenp.exe
File opened for modification	C:\Windows\SysWOW64\Mmhgmmbf.exe	Mfnoqc32.exe
File created	C:\Windows\SysWOW64\Mgmodn32.dll	Bhhiemoj.exe
File opened for modification	C:\Windows\SysWOW64\Fpgpgfmh.exe	Flkdfh32.exe
File created	C:\Windows\SysWOW64\Pnjbcghk.dll	Jmeede32.exe
File created	C:\Windows\SysWOW64\Akdilipp.exe	Adkqoohc.exe
File opened for modification	C:\Windows\SysWOW64\Ebdcld32.exe	Enigke32.exe
File created	C:\Windows\SysWOW64\Kpcjgnhb.exe	Kfnfjehl.exe
File opened for modification	C:\Windows\SysWOW64\Nnafno32.exe	Nfjola32.exe
File opened for modification	C:\Windows\SysWOW64\Ckmonl32.exe	Cljobphg.exe
File created	C:\Windows\SysWOW64\Egljbmnm.dll	Dbnmke32.exe
File created	C:\Windows\SysWOW64\Dckahb32.dll	Kcidmkpq.exe
File opened for modification	C:\Windows\SysWOW64\Dfiildio.exe	Dbnmke32.exe
File created	C:\Windows\SysWOW64\Dkfadkgf.exe	Dmcain32.exe
File created	C:\Windows\SysWOW64\Kcbfcigf.exe	Kpcjgnhb.exe
File created	C:\Windows\SysWOW64\Ofkgcobj.exe	Opqofe32.exe
File created	C:\Windows\SysWOW64\Dhclmp32.exe	Ddgplado.exe
File created	C:\Windows\SysWOW64\Dmennnni.exe	Dijbno32.exe
File created	C:\Windows\SysWOW64\Ipbehfom.dll	Llmhaold.exe
File created	C:\Windows\SysWOW64\Ampillfk.dll	Baannc32.exe
File created	C:\Windows\SysWOW64\Npdopj32.dll	Iplkpa32.exe
File created	C:\Windows\SysWOW64\Kgiiiidd.exe	Kpoalo32.exe
File created	C:\Windows\SysWOW64\Jlllhigk.dll	Mmfkhmdi.exe
File created	C:\Windows\SysWOW64\Bdimkqnb.dll	Jocefm32.exe
File created	C:\Windows\SysWOW64\Jinboekc.exe	Jgpfbjlo.exe
File created	C:\Windows\SysWOW64\Loighj32.exe	Kcbfcigf.exe
File opened for modification	C:\Windows\SysWOW64\Lfjfecno.exe	Lqmmmmph.exe
File created	C:\Windows\SysWOW64\Omfmcjlk.dll	Opeiadfg.exe
File opened for modification	C:\Windows\SysWOW64\Dmlkhofd.exe	Chqogq32.exe
File created	C:\Windows\SysWOW64\Lobjni32.exe	Lmdnbn32.exe
File created	C:\Windows\SysWOW64\Ebcneqod.dll	Eifaim32.exe
File created	C:\Windows\SysWOW64\Ggpdhj32.dll	Gbchdp32.exe
File created	C:\Windows\SysWOW64\Ibaeen32.exe	Hoeieolb.exe
File created	C:\Windows\SysWOW64\Ebcmfjll.dll	Mcpcdg32.exe
File created	C:\Windows\SysWOW64\Akpoaj32.exe	Adfgdpmi.exe
File created	C:\Windows\SysWOW64\Dmadco32.exe	Dheibpje.exe
File opened for modification	C:\Windows\SysWOW64\Pmnbfhal.exe	Pfdjinjo.exe
File created	C:\Windows\SysWOW64\Cpkhqmjb.dll	Cncnob32.exe
File created	C:\Windows\SysWOW64\Oblknjim.dll	Cdbpgl32.exe
File created	C:\Windows\SysWOW64\Mhcmcm32.dll	Dheibpje.exe
File opened for modification	C:\Windows\SysWOW64\Qaqegecm.exe	Qobhkjdi.exe
File created	C:\Windows\SysWOW64\Hebqnm32.dll	Ibcaknbi.exe
File created	C:\Windows\SysWOW64\Apaadpng.exe	Akdilipp.exe
File created	C:\Windows\SysWOW64\Mjfmcmai.dll	Cbfgkffn.exe
File created	C:\Windows\SysWOW64\Bnnkgo32.dll	Kpoalo32.exe
File created	C:\Windows\SysWOW64\Dbicpfdk.exe	Dnmhpg32.exe
File created	C:\Windows\SysWOW64\Caageq32.exe	Cglbhhga.exe
File created	C:\Windows\SysWOW64\Cdpcal32.exe	Caageq32.exe
File opened for modification	C:\Windows\SysWOW64\Ljnlecmp.exe	Loighj32.exe
File created	C:\Windows\SysWOW64\Mgeakekd.exe	Monjjgkb.exe
File opened for modification	C:\Windows\SysWOW64\Glipgf32.exe	Geohklaa.exe
File created	C:\Windows\SysWOW64\Cajdjn32.dll	Knqepc32.exe
File opened for modification	C:\Windows\SysWOW64\Dhphmj32.exe	Dpiplm32.exe
File opened for modification	C:\Windows\SysWOW64\Eeelnp32.exe	Efblbbqd.exe
File created	C:\Windows\SysWOW64\Kqqpck32.dll	Fpkibf32.exe
File created	C:\Windows\SysWOW64\Gemkelcd.exe	Gppcmeem.exe
File created	C:\Windows\SysWOW64\Kpjgaoqm.exe	Jnlkedai.exe
File opened for modification	C:\Windows\SysWOW64\Cdpcal32.exe	Caageq32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9032	8932	WerFault.exe	361

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mqfpckhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpaagldf.dll"	Fpdcag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hohahelb.dll"	Hoaojp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lokdnjkg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bajqda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jipegn32.dll"	Eblimcdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojnkocdc.dll"	Mgnlkfal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nfjola32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oplfkeob.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cnkkjh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qmgelf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dheibpje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jinboekc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kcbfcigf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeeape32.dll"	Bpfkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmennnni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jgpfbjlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Adkqoohc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmohno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elkllcbh.dll"	Dfnbgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iplkpa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Flkdfh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gmojkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ipjoja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ickglm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oonnoglh.dll"	Llodgnja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ljhnlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pmnbfhal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nobkpkdh.dll"	Doaneiop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dkahilkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkgmdnki.dll"	Dkahilkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mqafhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glfdiedd.dll"	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abklmb32.dll"	Ckmonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Filclgic.dll"	Geaepk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcjfln32.dll"	Mnhdgpii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nopfpgip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hccdbf32.dll"	Oakbehfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dmadco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjkakfla.dll"	Loighj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkngke32.dll"	Jekqmhia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cfbcke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jeciaina.dll"	Dfglfdkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bhhiemoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpkhqmjb.dll"	Cncnob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gmimai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Akblfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bajqda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dbkqfe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pfiddm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Igajal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhhfif32.dll"	Jngbjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gepgfb32.dll"	Fimhjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lomqcjie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dfiildio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Micgbemj.dll"	Clgbmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dnpdegjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnjbcghk.dll"	Jmeede32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Adkqoohc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Efblbbqd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Igdgglfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lcgpni32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 3004	1812	22faaefe4061ff9acde7b8e44828b4cc933a8a065eae300880e4f0d150b33899_NeikiAnalytics.exe	90
PID 1812 wrote to memory of 3004	1812	22faaefe4061ff9acde7b8e44828b4cc933a8a065eae300880e4f0d150b33899_NeikiAnalytics.exe	90
PID 1812 wrote to memory of 3004	1812	22faaefe4061ff9acde7b8e44828b4cc933a8a065eae300880e4f0d150b33899_NeikiAnalytics.exe	90
PID 3004 wrote to memory of 3428	3004	Cfnjpfcl.exe	91
PID 3004 wrote to memory of 3428	3004	Cfnjpfcl.exe	91
PID 3004 wrote to memory of 3428	3004	Cfnjpfcl.exe	91
PID 3428 wrote to memory of 3480	3428	Chlflabp.exe	92
PID 3428 wrote to memory of 3480	3428	Chlflabp.exe	92
PID 3428 wrote to memory of 3480	3428	Chlflabp.exe	92
PID 3480 wrote to memory of 412	3480	Clgbmp32.exe	93
PID 3480 wrote to memory of 412	3480	Clgbmp32.exe	93
PID 3480 wrote to memory of 412	3480	Clgbmp32.exe	93
PID 412 wrote to memory of 748	412	Cofnik32.exe	94
PID 412 wrote to memory of 748	412	Cofnik32.exe	94
PID 412 wrote to memory of 748	412	Cofnik32.exe	94
PID 748 wrote to memory of 4900	748	Cnindhpg.exe	95
PID 748 wrote to memory of 4900	748	Cnindhpg.exe	95
PID 748 wrote to memory of 4900	748	Cnindhpg.exe	95
PID 4900 wrote to memory of 1112	4900	Cfpffeaj.exe	96
PID 4900 wrote to memory of 1112	4900	Cfpffeaj.exe	96
PID 4900 wrote to memory of 1112	4900	Cfpffeaj.exe	96
PID 1112 wrote to memory of 2440	1112	Cdbfab32.exe	97
PID 1112 wrote to memory of 2440	1112	Cdbfab32.exe	97
PID 1112 wrote to memory of 2440	1112	Cdbfab32.exe	97
PID 2440 wrote to memory of 3380	2440	Cljobphg.exe	98
PID 2440 wrote to memory of 3380	2440	Cljobphg.exe	98
PID 2440 wrote to memory of 3380	2440	Cljobphg.exe	98
PID 3380 wrote to memory of 4600	3380	Ckmonl32.exe	99
PID 3380 wrote to memory of 4600	3380	Ckmonl32.exe	99
PID 3380 wrote to memory of 4600	3380	Ckmonl32.exe	99
PID 4600 wrote to memory of 4832	4600	Cohkokgj.exe	100
PID 4600 wrote to memory of 4832	4600	Cohkokgj.exe	100
PID 4600 wrote to memory of 4832	4600	Cohkokgj.exe	100
PID 4832 wrote to memory of 1304	4832	Cnkkjh32.exe	101
PID 4832 wrote to memory of 1304	4832	Cnkkjh32.exe	101
PID 4832 wrote to memory of 1304	4832	Cnkkjh32.exe	101
PID 1304 wrote to memory of 992	1304	Cbfgkffn.exe	102
PID 1304 wrote to memory of 992	1304	Cbfgkffn.exe	102
PID 1304 wrote to memory of 992	1304	Cbfgkffn.exe	102
PID 992 wrote to memory of 4672	992	Cfbcke32.exe	103
PID 992 wrote to memory of 4672	992	Cfbcke32.exe	103
PID 992 wrote to memory of 4672	992	Cfbcke32.exe	103
PID 4672 wrote to memory of 3220	4672	Cdecgbfa.exe	104
PID 4672 wrote to memory of 3220	4672	Cdecgbfa.exe	104
PID 4672 wrote to memory of 3220	4672	Cdecgbfa.exe	104
PID 3220 wrote to memory of 2204	3220	Chqogq32.exe	105
PID 3220 wrote to memory of 2204	3220	Chqogq32.exe	105
PID 3220 wrote to memory of 2204	3220	Chqogq32.exe	105
PID 2204 wrote to memory of 2652	2204	Dmlkhofd.exe	106
PID 2204 wrote to memory of 2652	2204	Dmlkhofd.exe	106
PID 2204 wrote to memory of 2652	2204	Dmlkhofd.exe	106
PID 2652 wrote to memory of 1144	2652	Dkokcl32.exe	107
PID 2652 wrote to memory of 1144	2652	Dkokcl32.exe	107
PID 2652 wrote to memory of 1144	2652	Dkokcl32.exe	107
PID 1144 wrote to memory of 4136	1144	Dokgdkeh.exe	108
PID 1144 wrote to memory of 4136	1144	Dokgdkeh.exe	108
PID 1144 wrote to memory of 4136	1144	Dokgdkeh.exe	108
PID 4136 wrote to memory of 3984	4136	Dnmhpg32.exe	109
PID 4136 wrote to memory of 3984	4136	Dnmhpg32.exe	109
PID 4136 wrote to memory of 3984	4136	Dnmhpg32.exe	109
PID 3984 wrote to memory of 548	3984	Dbicpfdk.exe	110
PID 3984 wrote to memory of 548	3984	Dbicpfdk.exe	110
PID 3984 wrote to memory of 548	3984	Dbicpfdk.exe	110
PID 548 wrote to memory of 3964	548	Dfdpad32.exe	111

C:\Users\Admin\AppData\Local\Temp\22faaefe4061ff9acde7b8e44828b4cc933a8a065eae300880e4f0d150b33899_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\22faaefe4061ff9acde7b8e44828b4cc933a8a065eae300880e4f0d150b33899_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\Cfnjpfcl.exe
  C:\Windows\system32\Cfnjpfcl.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\Chlflabp.exe
    C:\Windows\system32\Chlflabp.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\SysWOW64\Clgbmp32.exe
      C:\Windows\system32\Clgbmp32.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3480
    - - C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:412
      - C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:748
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2440
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1304
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4672
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3220
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2652
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4136
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3984
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3964
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4288
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3272
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4404
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4248
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:224
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4484
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2076
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:916
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:892
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        33⤵
        Executes dropped EXE
        
        PID:2188
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        34⤵
        Executes dropped EXE
        
        PID:1684
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:860
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4784
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3084
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        38⤵
        Executes dropped EXE
        
        PID:872
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3952
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4840
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        41⤵
        Executes dropped EXE
        
        PID:2924
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4636
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4428
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        44⤵
        Executes dropped EXE
        
        PID:2344
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        45⤵
        Executes dropped EXE
        
        PID:4340
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3552
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2468
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2028
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:368
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1944
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        51⤵
        Executes dropped EXE
        
        PID:5088
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        52⤵
        Executes dropped EXE
        
        PID:5116
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        53⤵
        Executes dropped EXE
        
        PID:8
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4052
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        55⤵
        Executes dropped EXE
        
        PID:4792
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3452
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3024
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3248
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        59⤵
        Executes dropped EXE
        
        PID:5132
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        60⤵
        Executes dropped EXE
        
        PID:5168
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        61⤵
        Executes dropped EXE
        
        PID:5200
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5240
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5272
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        64⤵
        Executes dropped EXE
        
        PID:5312
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5344
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        66⤵
        Drops file in System32 directory
        
        PID:5380
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        67⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        68⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5596
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        70⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5684
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        72⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5764
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        74⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        75⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5884
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        80⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6084
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        82⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        83⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        84⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        85⤵
        Drops file in System32 directory
        
        PID:2580
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        86⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        87⤵
        Modifies registry class
        
        PID:2596
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        88⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        89⤵
        Drops file in System32 directory
        
        PID:5268
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        90⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5392
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        92⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        93⤵
        Drops file in System32 directory
        
        PID:4000
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4644
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        95⤵
        Drops file in System32 directory
        
        PID:4824
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        96⤵
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        97⤵
        Modifies registry class
        
        PID:5608
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        98⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        99⤵
        Drops file in System32 directory
        
        PID:5504
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        100⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        101⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        102⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5856
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        104⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        105⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6036
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        107⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        108⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        109⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        110⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        111⤵
        Drops file in System32 directory
        
        PID:5260
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        112⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        113⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        114⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        115⤵
        Drops file in System32 directory
        
        PID:5580
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5644
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        117⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5484
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        119⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        120⤵
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        121⤵
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        122⤵
        
        PID:460
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        123⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4912
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        124⤵
        Modifies registry class
        
        PID:5284
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1444
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        126⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        127⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        128⤵
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        129⤵
        Drops file in System32 directory
        
        PID:5844
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        130⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5188
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4856
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        134⤵
        Modifies registry class
        
        PID:5592
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        135⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        136⤵
        Modifies registry class
        
        PID:2284
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        137⤵
        
        PID:856
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        138⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        139⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        140⤵
        Drops file in System32 directory
        
        PID:5452
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:328
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6032
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        143⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        144⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        145⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        146⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        147⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        148⤵
        Drops file in System32 directory
        
        PID:6400
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        149⤵
        Drops file in System32 directory
        
        PID:6440
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        150⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        151⤵
        Drops file in System32 directory
        
        PID:6528
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        152⤵
        Drops file in System32 directory
        
        PID:6568
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        153⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6608
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6648
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        155⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6772
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        157⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        158⤵
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        159⤵
        Modifies registry class
        
        PID:6896
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        160⤵
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        161⤵
        Modifies registry class
        
        PID:6992
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        162⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        163⤵
        Drops file in System32 directory
        
        PID:7072
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        164⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        165⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        166⤵
        Drops file in System32 directory
        
        PID:6268
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        167⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        168⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        169⤵
        Modifies registry class
        
        PID:6512
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        170⤵
        Drops file in System32 directory
        
        PID:6592
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6700
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        172⤵
        Drops file in System32 directory
        
        PID:6800
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        173⤵
        Drops file in System32 directory
        
        PID:6912
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        174⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7156
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        176⤵
        Modifies registry class
        
        PID:6284
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        177⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        178⤵
        Modifies registry class
        
        PID:6584
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        179⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        180⤵
        Modifies registry class
        
        PID:6812
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7048
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        182⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        183⤵
        Drops file in System32 directory
        
        PID:6524
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        184⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        185⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        186⤵
        Drops file in System32 directory
        
        PID:6496
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        187⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        188⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        189⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6560
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        191⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        192⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7264
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        194⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        195⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7388
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        197⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        198⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        199⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        200⤵
        Modifies registry class
        
        PID:7568
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        201⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        202⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        203⤵
        Modifies registry class
        
        PID:7704
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        204⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        205⤵
        Drops file in System32 directory
        
        PID:7788
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        206⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        207⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        208⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7960
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8004
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8048
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        212⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        213⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        214⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        215⤵
        Drops file in System32 directory
        
        PID:7212
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        216⤵
        Modifies registry class
        
        PID:7272
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        217⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        218⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        219⤵
        Modifies registry class
        
        PID:7468
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        220⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7604
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        222⤵
        Drops file in System32 directory
        
        PID:7656
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        223⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7816
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7880
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        226⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        227⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        228⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        229⤵
        Drops file in System32 directory
        
        PID:8144
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        230⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        231⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        232⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        233⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        234⤵
        Modifies registry class
        
        PID:7716
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        235⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7860
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        236⤵
        Drops file in System32 directory
        
        PID:7900
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        237⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        238⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8160
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7348
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        240⤵
        Modifies registry class
        
        PID:7516
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7692
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        242⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        243⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        244⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        245⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        246⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        247⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7696
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        249⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        250⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        251⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        252⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8212
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        254⤵
        Drops file in System32 directory
        
        PID:8256
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        255⤵
        Drops file in System32 directory
        
        PID:8304
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        256⤵
        Drops file in System32 directory
        
        PID:8360
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        257⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        258⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8504
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        260⤵
        Drops file in System32 directory
        
        PID:8560
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        261⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        262⤵
        Drops file in System32 directory
        
        PID:8668
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        263⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        264⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8828
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        266⤵
        Modifies registry class
        
        PID:8880
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        267⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8932 -s 416
        268⤵
        Program crash
        
        PID:9032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4116,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
1⤵
PID:6656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 8932 -ip 8932
1⤵
PID:9008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Baannc32.exe

Filesize
196KB

MD5
fc18868886cc6529c1efccb95fa01af6

SHA1
b9ddd7bbe184c3c5cc9ed945734f615381c2cd33

SHA256
a5e40d278f7a7b698e9807af7008402034fb3f140593ef5beb2945804bf445c3

SHA512
88dd2b10327e8830731856f0518413541ca20b573ee27b469aa69caa75eeb5e3bff51838daab266077c30f87c1627a0eb01d6bdd1851cee861a6365f2b24e91d

Download Submit
C:\Windows\SysWOW64\Cbfgkffn.exe

Filesize
196KB

MD5
0de8927833ad7ec54e65b3e5abbee2db

SHA1
ba7a9910ce812fa0cb95cebcca257933aa437226

SHA256
9b3faed7b0d189bee785fef67c8bdb3b9ae595e683e4fa39b73bf5be0cf010b6

SHA512
9c0f631634d9633695929205d691b3ff87722232247766015c146c0efc101b0762154731a891f7a2e304daf4dccf019073075f5c22cf9d471d83ddf555645ec1

Download Submit
C:\Windows\SysWOW64\Cdbfab32.exe

Filesize
196KB

MD5
d07198f8b8df71e8ed833b009380c394

SHA1
6cce2d58b2f98194b685eab0a652fb6c1adc9752

SHA256
f661f8a69d5fa6fc3ad59775d568572214052d3e9b88f99500132298e5d9d28d

SHA512
7a7a0d58408dd216b188674fcbdc3cf69ae8e6c0b14919e33524a3f7ee4b3756c4ddbd11722da01510ec5022128fb417ef806130c261b18d71a394574d506f50

Download Submit
C:\Windows\SysWOW64\Cdecgbfa.exe

Filesize
196KB

MD5
b27e8ec918b9200aa9b5ba07fb5cdf06

SHA1
99d23d3b01417761c7305bbb9bc22b3766bbd612

SHA256
01c93d50e4330172dfab1c45dc23982dd380aaacc7b2bed2ef8bc96015e59ec2

SHA512
a047750324f28fbeeb849cced1bb34fab7577921eb6d5540eab83c4667adf42c899dc6276ff340cff17f44ab1019a76247a764889de8b0aebf8c6b4b5a7c4e35

Download Submit
C:\Windows\SysWOW64\Cfbcke32.exe

Filesize
196KB

MD5
6c97b3732ccdc1346895071831d50e93

SHA1
1dbf6277dbafdd34bf7a9c86233ea2a10b837dc3

SHA256
9856a782a2400b71317415fd25d1f4cf5bfc9a1e9a4c843207a60ba00ba39052

SHA512
ab8ff826c8a5aea3ca10e212e699016fae16cb3fa402de6919485e596def6afa88b3f7298aa4ad73828c2782e359ba6b8a171f7ae55899a87122f37bac40d0c5

Download Submit
C:\Windows\SysWOW64\Cfnjpfcl.exe

Filesize
196KB

MD5
263c49187df2ad2fb5ee6a924309f961

SHA1
388ff9cdf3d6bf307e81baba37a908f99cee9653

SHA256
c779667394cc5cc0d1ce15a5e5210508ebf54d16a7f0292b462378b3649ee35a

SHA512
950415d0597964a5faf3c3c40e92fe5ddb89da02f7f536f73bfc93402ed817673ec6774456ca720e61c3f082069443c3dfc3c25a16f39324e55ad81bcd6abe62

Download Submit
C:\Windows\SysWOW64\Cfpffeaj.exe

Filesize
196KB

MD5
a6b5fdcf1f81a7ea544cc0bf170859af

SHA1
bbc72e2caac15dfb6ed6b43aea9dbc5f6fdf3334

SHA256
b9807967b9de94d403ac18e7542a01b4fae802963b8f76e602af9e83b237e87c

SHA512
2fe949220d37aa0fc053d71dbe0521aebfbfbb285019396472fae1be019ca8cb2791c4c59e7abae3e3402268f12af4e17fd477c51bff2b52b40c61f2034d0713

Download Submit
C:\Windows\SysWOW64\Cglbhhga.exe

Filesize
196KB

MD5
18b1b50c4f465ceb4226ccb5bbb7bd87

SHA1
f6b71771f68cafc112d7040a4bcd5056bf797a0b

SHA256
ec9851514d8ddaedd2ed32e04e72efe74dc64b4d4d9c4c826757a5c2179a6fee

SHA512
e6e86c43a8c606535c57fd1c8dc945664c6bd3a8ab3ebb033c849f4318d7a6f56ee73028f570364817ab77fbe29152f5d89e4c4e6a1352c2a747e6933f2178f6

Download Submit
C:\Windows\SysWOW64\Chfegk32.exe

Filesize
196KB

MD5
bbd177179297ad470a732157b076e8a8

SHA1
c4a313facaded0a167a1780853787f8261ae41fb

SHA256
0c466b70269b9159b0d6389f5321c4de50e2aa653da612974918f55d68654fe7

SHA512
af7677cf55f5891eb0715816a8920642116dbb4e17168610e4b495ea5a75965c0f6b8523d77432bbdb47425e269067a6b22f311371e377f91ba114072be5d3b0

Download Submit
C:\Windows\SysWOW64\Chlflabp.exe

Filesize
196KB

MD5
1df71635cf7dd1c0750dc87994b4b7d9

SHA1
2c7c4b47c1fb44514a71d5af61bfec1364b64e1c

SHA256
c6361755b8d0d9fd4a9f1803d312079becd936370f96046660187c310acbb9ff

SHA512
602bdc38c093ebdf03f54ae0aaf4f40b41c4ce8fe74a00b771ed96dd411c1d58f71f6703e8acac9e5696919c2e5cd371096176053a03eaaffcedc512f0f2fa76

Download Submit
C:\Windows\SysWOW64\Chqogq32.exe

Filesize
196KB

MD5
0fde462fc5bbfb2768f496d89c7c0ab2

SHA1
16c343123365f6babe398876601de970fd6b87fd

SHA256
2e3d193cc4a11775ea1574d213c7b8f2a9f2379f5b73adca6b2909a796b312ff

SHA512
b0d1afe27813b6e247a7ab59d73853244fcd6311a9f05a3ad973f3d25d5a841ee7fa67e9285906647d358227cc32c33a691483d869e2fe948f48383fff9554df

Download Submit
C:\Windows\SysWOW64\Ckmonl32.exe

Filesize
196KB

MD5
9a3cb69171d9900dc3708242998ba0f2

SHA1
363d042061ce346b4ee27f09043366cf4c2a1b5e

SHA256
f8d3f70382dab069533d91c4662f9f01907f10ca20eb326ad21666dd71d0ff59

SHA512
9f863ae5c4f574c9156ae9e594ce647c3c6670e6c71ee2ed05cbfd21f5a8896af663979ac21fc3c99e7b66f9f42ba58e4171b167178ee7c6d5348fce9a578ed3

Download Submit
C:\Windows\SysWOW64\Clgbmp32.exe

Filesize
196KB

MD5
86a3fa9ef940164b3617fc12faeba730

SHA1
91f42c3cf824f32ebddaad20370008dada4e6526

SHA256
8e965f260ea87b0f2826e09a45e34ad6617b14cc6756d62410d6b059ed07d025

SHA512
09f14abb6c87250a097bf0fbe2e741c1b9471d9cb86f6a471aaaf2d3fef671a263510071f399da78c4974659ec0d7294353ff4823ed06d9cc7b72c3d91db1305

Download Submit
C:\Windows\SysWOW64\Cljobphg.exe

Filesize
196KB

MD5
9c42aeabb291f6243369260a7fe32625

SHA1
4eeb9ef4f9ceca48db2f76fb9d6dc55343730c75

SHA256
ee716b937b0a9e6c1f8ee113872119e656db973e10dcccb5b01136fd4749f537

SHA512
1eb60ca2a51deabf67f9d3e4f08517880d10d1cef9c37d5da5fc3eb50c07eef323f8ea5e7059887765fbb8f383f629f72c7ca60fdea917c708c72dcb0d84947f

Download Submit
C:\Windows\SysWOW64\Cnindhpg.exe

Filesize
196KB

MD5
3bff014c0e40302f69926e62af1c6f2a

SHA1
2259a412c6bcfe579378e1639907bb7e23f84aaa

SHA256
3fb01e66bf62f9fe13919a4412474b572095b20c743ada862214da6c7bb00ab0

SHA512
6a4c8f3a93eec1fde7ad87740003c327e626df7a0f214aa2acdcfdeee51db4d0f64260965148930e0970da46c6ee826d7683e378cdca1d3e4662168677e95ef3

Download Submit
C:\Windows\SysWOW64\Cnkkjh32.exe

Filesize
196KB

MD5
1ddae4cd63d92c21044b1c336d802634

SHA1
8904d31a69f1dd6d8702e97e7222968e56fe3c4e

SHA256
5577191e685ef4bedd91fecef6432ae97b42dae90cfcadfb76db8af4931c4791

SHA512
715c136a36e156f751f70dc8769f66a572c430f2c1895d67f74570509205755753ffac57829ff514f5a0a797cf8a59eb51126b7c834c5d9ad658fae0c52b0628

Download Submit
C:\Windows\SysWOW64\Cofnik32.exe

Filesize
196KB

MD5
249fdebf018e07589006d10316f237c0

SHA1
26ac4638255e566ed09aa968c6db08c3d2fbe979

SHA256
9753518f51a8fe97b5b3330f7993a194448f315482a1869f0995445aff00a04f

SHA512
a9f26476408db4372ee819c23a061a43ca144fcff5fcae2d7e8139a7583c97e23880dc5bd96bf00c0b87798ab726dd8d9cf996c3cd36d5adbdb7cd2504777aff

Download Submit
C:\Windows\SysWOW64\Cohkokgj.exe

Filesize
196KB

MD5
4ebffcb78948030b84fc916e3644688c

SHA1
178d12b2f37eb9f55425ab80182915abf6d5dd58

SHA256
f534a2e6588f40cd3e9b2f02d2e58b2701c7151c7eb409c6b3a896106f148c0e

SHA512
951466976271c0e24cdc9258de0b9fe73dde71295747a979bcc5d8063ae78a225db36f1ba422c3818a97b5b134ca06852f75f92d8da3cecaf46f966751299d35

Download Submit
C:\Windows\SysWOW64\Dbicpfdk.exe

Filesize
196KB

MD5
d0a581efedcedb36da10e191baf2c76d

SHA1
b7f4bdc28dff06d9fe0d8fa1572cd5850985e6b0

SHA256
abdc23f215a2d54e7cbac0202cbbc11c2a2bcda8dd1bf473d453d411c3a4ea11

SHA512
8aab7d52567d2b878dd13a6f2326fe95e11951c03efe79acabb95466f210832ab15ad98111f06f2312eec77cd8adb9786c43e988b933ad5b1b6a1e8440bd4e92

Download Submit
C:\Windows\SysWOW64\Dbkqfe32.exe

Filesize
196KB

MD5
fdfbf3eda9fca21626533ad0200c5430

SHA1
fde95f3845cb16115d8f20e3a3df94060b30265d

SHA256
b37fae3b1e6207821e8c3c0c5617cdff29a680bacc6a632b97c58d7ac072315f

SHA512
929f9cb82a59377f945c44049e811736adc894992dae8814b96b1d31a3717f20721dedeb5f5e4a6e0bbaba6f5480981b2660804fcbbd144593cb688b816d0134

Download Submit
C:\Windows\SysWOW64\Ddgplado.exe

Filesize
196KB

MD5
c687982006ce05f7272dfe9bdbbd4ace

SHA1
8099e0c41a098ceb04a3d4a800aeeebc95d88d70

SHA256
451c5259bb3efbad833f35dda2ed39108903449d41df9b052f4668e87526715e

SHA512
9a882840729c5cab9fc026a5c91b4b4cc41642bcfda7e9fa13953b4e524c883bb9be6f21ca0af95fa0cb540fa3230f956a9f2cdcf92afdbb38dd8f8c1726f3e0

Download Submit
C:\Windows\SysWOW64\Ddjmba32.exe

Filesize
196KB

MD5
fe24af9ae8cc3472fa7aea2a1a1a2bff

SHA1
1f5ca2e3d68da8069a0947c9e42a900444d8731d

SHA256
90663e8456000782b38f5c2624275b937c6a8ad51098ae0944f30669b2ae78da

SHA512
90ea44abf974175276b30b9e025c57831d7a3a6bc4b9845dfcc75795add554221bd015ba3bde88c8948b11f557c0d6269444fbf2f322ec4cd70221a0316e3f93

Download Submit
C:\Windows\SysWOW64\Dfdpad32.exe

Filesize
196KB

MD5
c3b049c540b9d5f9089863cfa64c117a

SHA1
b85833cd6a7a1c3a447c93f44194f372f050c3f3

SHA256
33bb628ea17597297a7924c52938f9f475b06b7ac693c98ce664b14601855971

SHA512
9e8056684fd94207dfc93db23baa4e2c5702fb526fbed0c44bd4370aeb9071217fbafbb332d3eadcce9539eb5614a4a6e6cefcb2661197955cccb4d06fd8d122

Download Submit
C:\Windows\SysWOW64\Dfglfdkb.exe

Filesize
196KB

MD5
3c49e382b5966f2df662818ebc1c3730

SHA1
af052b9aea1cdd70804f6efdb7a0df274b6d1821

SHA256
b0b7e291762b6e8062a51204112ed8cacc882df52815a4fb4eb8b856c327c10b

SHA512
064e29b7d13cc0396bf61a092d68390cf9c5c8ae7071da0083cb5cb858d66cdccc793b6a0f10611bf8a5e0a36deec012a359e4112a19bc4767fdf2ccdfb07604

Download Submit
C:\Windows\SysWOW64\Dhclmp32.exe

Filesize
196KB

MD5
d223249538bcfa4295cb64c94ee7533f

SHA1
f6cd1e09a89aab044a778e8a32ac9bfd7302dcd4

SHA256
f2a1654683826a4137867f847ab6e5dceef51b34f632dc5717ef5139c6496a8a

SHA512
0873772d4b9043c01ebbe8659be36abaad956ca0453877b605651fa14f47e87599eaf17dbabf68ac8fbcefc71582fc4d2dadfa3092249dc58506188aa02fa18a

Download Submit
C:\Windows\SysWOW64\Dheibpje.exe

Filesize
196KB

MD5
4c98d5dc9337884c8c1a749be022bd24

SHA1
37aae6e872301d9c276744188806389b4cf0219b

SHA256
bb9ae18ca4f6ea29b3467649cb19c3bc0c9cd85ddb216029373549d0b0c88a86

SHA512
51a317d81ac16d3e585fb8bfb8ee5f159386de2dfaa5e1d8802ff23731d46df342aa349daacc59a31fab79bd3286126c9672913d75740684782ae4918409fc10

Download Submit
C:\Windows\SysWOW64\Dhphmj32.exe

Filesize
196KB

MD5
3698ae9fcb20c3af5e5a342447d20481

SHA1
b33c7638f31d0755d8423e7b8350b3a84015c40d

SHA256
b8586dd8e760cc626ead802187f3bb933c64ff4c4550236047736ac452eebf65

SHA512
6ded0613f4b6382eba3b07c3459f0a68628215392e453c5ab0596ae49778542759700a5256ef43f7f4378943a2a7154e387e59630f1aba7d688e06909b835494

Download Submit
C:\Windows\SysWOW64\Dkahilkl.exe

Filesize
196KB

MD5
080802c825c148cc1d993a10da90870d

SHA1
77e065234046c6035ef8c5bb14e638ab40790448

SHA256
dc1f35ca911504e33b867eb9b152030f79870f5e342817a96b775e9a6c329815

SHA512
aa1e59cf07b55732d28b88fa7e8fc33556d95b70bd96100712f69f2e76170f61fe8955dbd00d61a0e7603d31456fc5b96391a425d32ab38ad1d590d0769d450c

Download Submit
C:\Windows\SysWOW64\Dkceokii.exe

Filesize
196KB

MD5
27b21d2362972e1b80fdcfbbed992e95

SHA1
109be15dc4e738a670063533148494ab043d3108

SHA256
bd14b924629dc981f9919f6192a7409cefd3388f91897b3de8f9da38812ffe65

SHA512
f3e1b0d02f9cf1d11a11fe05e3f2cd7555025e7f63954d3f334eaf4e5be8eabd6d1b1cc4065ee07f1138d897a0b6a2589052e6a2a412ab970a61e5a3992bc2a7

Download Submit
C:\Windows\SysWOW64\Dkokcl32.exe

Filesize
196KB

MD5
a3f34825a63225ed2e0b5aecf2993c43

SHA1
14d3fd017859d104cfa2b11e13cead6ef3df06d3

SHA256
ec7aae63dc1a5f1c6fb6ea68349d043db7b9df3882e6bd21e889dd4f4fa2f4fc

SHA512
6256b968a4e93e225c35f1e6574d24b62c113966a5abeea13659e85fd66f0c6426f9f7e613f19ffc2c73b2744817873234570f00f9ef88275faf0cb9a17789dd

Download Submit
C:\Windows\SysWOW64\Dmadco32.exe

Filesize
196KB

MD5
cd8f603b61b6e9a1ef053f9adf323517

SHA1
61a4ba2521c9d161a6e860bc236d934c7068f8e0

SHA256
baa493213d792abc77aca057d134259ff8d608bbe282f88e21601559899cd01e

SHA512
55afbdc587b89a7f32472394f165e7ef81daec4a3dec1ed92ffe76983ef4367940000d26ce0546bb3e605c3ded901d912e9753a60b137b63141a44ead7fa26c5

Download Submit
C:\Windows\SysWOW64\Dmlkhofd.exe

Filesize
196KB

MD5
1d4b8616813110745e720ebe37aa03e2

SHA1
2ca9e6d4f540fa7ba67ab92ba415029c45c751e4

SHA256
1fdeed94ad66b7951dad306b59420db210a85255c1635b1d9bb2d2685aa1be55

SHA512
1be421ffe4453afeb7c4f9774958ff0697d827dc48758dfb4dffe9b35316c5e5956dd5b47a56a79c0fabda1fba91ba1000538fdc15d8b68e37ccba4048e21782

Download Submit
C:\Windows\SysWOW64\Dmohno32.exe

Filesize
196KB

MD5
2263632ae18bec237992d33837c05b71

SHA1
6c31593501505dd308b308ed6dd2b496c1735739

SHA256
769e28ae4c3e30a0e0923dc2d61ef1039f3e3b21f228ba9a5fe7fdd73fab6005

SHA512
52ac01784e78f7eeb9d7e6185dcf8d67bfc5ae1c4bb41eea663f149abb1d2aed6aeb1b4710e5ff5a8db225fe431e41acf515fc796fee63731369240b86b1f0ee

Download Submit
C:\Windows\SysWOW64\Dnmhpg32.exe

Filesize
196KB

MD5
f2db198202c78bdfb4f69b9639c697ec

SHA1
c6cd5dadb92676e948b0e144883de8a44312818a

SHA256
11de27b27721d0e42d09b3e96125cc4b77fafc85cd53fa57044d09e6cc6e63b2

SHA512
d25b4fde7eec82584586faff14851ff1137e7c82f7d2299b964e65cfca255903aa0e413efbc84c3ccbc3800d0ef3dc2ec9955070736ab83389dff4c9ad4b4d6f

Download Submit
C:\Windows\SysWOW64\Dnpdegjp.exe

Filesize
196KB

MD5
4014c7261de3dc458c3055c75cf3b8a1

SHA1
13d67f323cf4315d3c95cfab27b43324229e2865

SHA256
160b1e9b35baa83910a31d16e7acf2a049ffa243941691c8a8cd1ebc730d575f

SHA512
79cae7cac0977c54c7074532fdca59ee9abc0cdef3ca5c182cd9a70b74f879d97429a3067c72694317f43eb38ef45a7fc0d60ee34e707aa44b615cfcf253a753

Download Submit
C:\Windows\SysWOW64\Dokgdkeh.exe

Filesize
196KB

MD5
20e0ba50ca07ce5d30bc578c2b3c9591

SHA1
6156dc81d5cabad18c78c7658cc0815b3cee936c

SHA256
5b4bc9e6dc2377743d8377a58452095cd8be8c22088dd663f031b5bcbc37a31e

SHA512
f511ab7e69ef9492674663151e0866491e5af68752356a2559a8c310f9255c2c59397d6979bddd1690270e07a6e42ea7e421eea80c3667090a24caa40a701192

Download Submit
C:\Windows\SysWOW64\Fiaael32.exe

Filesize
196KB

MD5
031f3cf17aed89e2a763b6d8166a3a64

SHA1
027fa8085981d4ee2ec0d9efdae7ba997c126381

SHA256
620013a65fbde0b266f119c82f0d80738ac995e4dabf580ffb61a4852f91fe71

SHA512
0914be8a954dd5b5fca3036969eb44d4762cdb013e0a57626aaf757b145a39616ded2777bf628effb9dc05f6390cfda57ee02fa8fc785fce7234559ec899d0ef

Download Submit
C:\Windows\SysWOW64\Geohklaa.exe

Filesize
196KB

MD5
bdaccba8ca1fe2667b91d9f9eef07f56

SHA1
33ce643b037970b0a1f18b8653c1d01d681a3684

SHA256
376f351e9c76e9f10462188e2b4fbfe547dd734f2bd98af158ea9af525fa976b

SHA512
8d16c35be518312e290d5bfba90fcf0c762d643574f8a918852d6cfa0acfb30402dcb26bc132974081868c027ee12c9b7f0e015014d1f0d987b6e7d3e91adc35

Download Submit
C:\Windows\SysWOW64\Gmimai32.exe

Filesize
196KB

MD5
48990c5396df920e26213a3be526f934

SHA1
f80583576b9b57903647ab2ec0a93ded773d0df6

SHA256
41a479c4f7482978ea7f400ccd87d7068b9d2114b69fabb565af2dfd029d88c9

SHA512
ed4685d6d4ecc41137c179f9f6ec99bdaab7b91af613dfdb3b5647765d77a9a383f0535b1b789b37b2361ad82df9b18933b53f6af0eff4ac14e4265190a5e766

Download Submit
C:\Windows\SysWOW64\Gpnfge32.exe

Filesize
196KB

MD5
e12acc207938e7b47cd2aa5d41338347

SHA1
990dbb0ce97c39aed434706c6bc3e15bf89f899f

SHA256
928fb2092637a9cc92c0cf87f8569997482006c225d9dc401c42aa742d8a6453

SHA512
1f7b978205608288202c0824eeea8509c1bebd08d83ef0df92e160289405095415f22d535a39bdf333d7d5b42305fc38d5baea2e6d312a2296c30ff9ba316ae7

Download Submit
C:\Windows\SysWOW64\Hmmfmhll.exe

Filesize
196KB

MD5
c4f6df6c553ed707e9a56f4f6e5f067c

SHA1
f8faf2475696a347a56998558d22a9b0f6b2e948

SHA256
098054e8128a66ca4a3d832ddc904a11cf76002fa871ffd98b84d31140432abf

SHA512
be1768c6708ecf74efa4809077a9de92a95dec4a4cfdc316a2a87e10776116800a9620bfea6855aecd537a97f562ededeaef5392adc60a4c41128605b544fa72

Download Submit
C:\Windows\SysWOW64\Hoaojp32.exe

Filesize
196KB

MD5
6f57cb4ec86d7dc5cd9b95971bfa4a11

SHA1
d7031d79e9c48151602c5ef1094e0981a2311a8b

SHA256
f8dc9e6d6437b7827a0c3632b1254660cd00b7793ece14774990a6d5fb7b2487

SHA512
b7b6e0700de913d19980e197a49578e7222c5366866047135c8df1fc2784a72681e66db102947800f665aa3e47e898c82d59d341eea2548b9ce423c376aeed0e

Download Submit
C:\Windows\SysWOW64\Ickglm32.exe

Filesize
196KB

MD5
665cb1cde12084000b03b5cd23001912

SHA1
129e72a20db19d94d70231c46e5f4348b27814e5

SHA256
e4fe955de1bda099a44f523eed7684af874d9e267cf9906f0a16101e237184ed

SHA512
fc2aee3305055e55608b77feea32de40e927121fd15f15f465e2ade85e77f90d5ee896aef39c3ab0a28ed7599b7794c59ab3df887514f7068575ac8713205bf1

Download Submit
C:\Windows\SysWOW64\Illfdc32.exe

Filesize
196KB

MD5
d5935b6f561793ad1d0d6a348be7678a

SHA1
5f60a40fce58a199fd03983e95676871802db99c

SHA256
eca8845954f0afe1e388b32e017a0cdf05d0d4a0e3d4c8f628682b065bcb3cf8

SHA512
ead6a7e927a5925384a2df10655bb954f3f0334be5dd8b4c81fc8bc1161a74ab2e89c5e0b4efe47f20fd8bbdd82c06271f681b35733d5df1550f3a6f91b4dd58

Download Submit
C:\Windows\SysWOW64\Imkbnf32.exe

Filesize
196KB

MD5
a218d2453569851ae60dcf378ac2698b

SHA1
7c697003ddefbc025b8033a7d9b3666b75cd46e7

SHA256
c1e80f3fe3a0593ece3f29ecd8a39e6fd8e7dc9e65253ad8847b46ea59a11376

SHA512
07404cf67099cbf7da9a8a074d58e6cc8473c83abd9d74ab1bd75ef9c493250ee92a33869be29b16387013fc61c45b3c4794f83cf4c1412a75b2bc9cd38aa2f3

Download Submit
C:\Windows\SysWOW64\Imnocf32.exe

Filesize
196KB

MD5
0799518d2c780efa9b118fed31542bb2

SHA1
d736196659f02a2817c4e8f5107179b75092f71d

SHA256
6bd9a2118d2723bacebdd541ebd9c1b4ca9cab6cb49c86f8ed5b79eccbfcdcda

SHA512
ad21fd0d7980e93a9ff24ccd596e3c77f56e4f15a216614e3d837bc2b92b34497e85d6890bab7b39a18e04a42b8dfa941f99443906e6b87eeefcfeb650f30b55

Download Submit
C:\Windows\SysWOW64\Jmeede32.exe

Filesize
196KB

MD5
e937d100ec8cecc8ae38aefeddb660f2

SHA1
e4a23d941d489f07e2fa4b695549b3a776ba80c2

SHA256
19fdecd810d2b5bffb85d4166ad77802eb674f92ac392a1396b06e7b511f1cd5

SHA512
fda8353012a852cb12b7239c60d055b424df7159bb8cf9e4086c726c90da3733345ea69ea82f6c2295d91e5e8bc59023b6cfe5a4a65fccd7485356c9256f04e4

Download Submit
C:\Windows\SysWOW64\Mbibld32.dll

Filesize
7KB

MD5
3b4418dc2acbb917b2c89b2d20a42969

SHA1
126cc8839ab407d83895db6bee8befbbc727cbdf

SHA256
d650ed3a9624bc8c4c4f5d2c6e03817e7463e709c31b67d02433cbfa7ec06e82

SHA512
0b70995156c8bc8dff2df7ae385582ce0d36184e3293464ba89a0ea5c4ed7856d7dcf563a249ec9650483a9bb9ae7d55eb077c24bd5a3c4ee65853f5a3382d97

Download Submit
C:\Windows\SysWOW64\Monjjgkb.exe

Filesize
196KB

MD5
552e7a6311f891e23e3406d753fec593

SHA1
178b44bdd0ea5e7a589b89eda34c14d87accdfb9

SHA256
752514ad00058b49392af351f9fb7ae57c98a0d536fcdaf2a06ce2da92b730fd

SHA512
cb50fae142c5e2f1cbb3b5c5949e028b886ef06fd84279d4723294d69b44116853f2d635eb29276986e9fa61281b8fce5ac1a79f604baebde79170ca33ef66bf

Download Submit
C:\Windows\SysWOW64\Nfaemp32.exe

Filesize
196KB

MD5
a0166e4c95492dc5c7087c3437438834

SHA1
c42c2539f4596b2c4f888e3311f0dc3afa29290c

SHA256
b46e475cf35e0e63894d9fcce99fd0cab34a9957d0a1801f4c38c86844ecce07

SHA512
36442fdcd113d75a99deb8ae05194e55c42e33af2d0711f49cb389e4d4de8c444127dd82517c931a7e819d269374105ce39f5a0ca972607b74e85b34fb60a41d

Download Submit
C:\Windows\SysWOW64\Pdhkcb32.exe

Filesize
196KB

MD5
c26e302481b4ec314930586517d5b1d2

SHA1
6b8df060863e083a5f1c4a0db4e162c043c34d7a

SHA256
c62aed6a02646f50621a9d7c46ccc0f9f03ca0b20ff2266ce0f513960c41b7d0

SHA512
d55e8ce0f70d6a79e9433ffb7d9bd3645a98cc9561360b8290d5dccf27de6dc28a72b91d7c3b7b548ad205ad18b414ff514dcb85ca25af181752c8c4769cab8d

Download Submit
C:\Windows\SysWOW64\Pfdjinjo.exe

Filesize
196KB

MD5
6f0e470926116cf5b7bc6e312db3a2c6

SHA1
5900a13d0732ceeb8a93dd650fb21f38ec75b763

SHA256
6fdbae4a299772825f43005b2231bc4c996826019103bf2b1d431c517c2df5fd

SHA512
b6d72f11e32c359c2066126adfae43ea97d656bd01a8d5ed56585c83fe21598bcdba64d715a9619fdca7df4d815f0cd634edca24aed37fdd901d95e48c7fa2f5

Download Submit
C:\Windows\SysWOW64\Phonha32.exe

Filesize
196KB

MD5
808c0b5801bb30144c85334712560cf8

SHA1
8dec6ec1459a5d8b8a352131c2b94e3df49e677b

SHA256
9e9b88bce75f9f0ea5d982882f1f3ab7231085910ef9049d70438e8268b258d2

SHA512
6dffddc79d3764ce56041a6bd587e33e5c801429d2f0f05cdff60b6068a6d0429f374093d4c367950aeadb801b587776e8f4e8a5ff66dec73e1626a82e357270

Download Submit
memory/8-451-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/224-321-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/368-446-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/412-39-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/548-315-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/748-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/860-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/872-331-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/892-325-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/916-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/992-306-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1112-298-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1144-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1304-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1540-574-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1684-327-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1812-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1944-448-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2028-445-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2076-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2112-566-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-326-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2204-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2344-337-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2440-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2468-444-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2580-568-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2596-580-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2652-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2924-334-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3004-12-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3024-455-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3084-330-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3220-309-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3248-456-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3272-318-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3380-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3396-610-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3428-20-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3452-454-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3480-38-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3552-339-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3952-332-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3964-316-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3984-314-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4000-620-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4052-452-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4136-313-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4248-320-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4288-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-338-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4404-319-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4428-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4484-322-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4600-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4636-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4644-626-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4672-308-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4680-556-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4784-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4792-453-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4824-628-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4832-304-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4840-333-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4900-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5088-449-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5116-450-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5132-457-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5168-458-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5192-586-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5200-459-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5240-460-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5268-592-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5272-461-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5312-462-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5332-598-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5344-463-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5380-464-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5392-604-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5420-465-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5456-466-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5560-634-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5596-481-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5632-482-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5684-488-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5720-495-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5764-500-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5804-502-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5848-513-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5884-514-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5928-524-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5968-526-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6004-533-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6044-538-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6084-549-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/6120-555-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/7944-1830-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/8408-1802-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads