1570cf68ed1744140636d808e3a8454247b81153badd7984f6779fa3167ddd6c

Analysis

max time kernel
120s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-06-2024 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1570cf68ed1744140636d808e3a8454247b81153badd7984f6779fa3167ddd6c_NeikiAnalytics.exe
Size

57KB
MD5

c195ef59bb4988c36b01da9cd237c620
SHA1

5efa2c70f923bc0ef6db5bbbc12794348f4f61cc
SHA256

1570cf68ed1744140636d808e3a8454247b81153badd7984f6779fa3167ddd6c
SHA512

dd532ca52b54e98e8cb212a14181b0cc4fae828285981ac176686af4b5ae4f19aea0fc6fd4d2a9de83dc1aa321ba91425ae6591b2ec3a1b67e2d688567756e30
SSDEEP

1536:+RlCVN6hqZP4L74+8KPinHnqEBjjP2u45MBjj:qEVvwvX7MrBjjPtrj

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odgqdlnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fohoigfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mciobn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocegdjij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aejfpjne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miemjaci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojaelm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogaceh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjpiha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajfoiqll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnepih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dahode32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcefno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcbahlip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnihcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qajadlja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgopffec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Baaplhef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blpnib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhnnep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdina32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpappc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imakkfdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llemdo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ambgef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odbgim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkpgck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpappc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blfdia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Demecd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lenamdem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgikfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjghpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhqcam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdpmpdbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Delnin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pndohaqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfgmjqop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Peljol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdiooblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhnnep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibqpimpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlcifmbl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bebblb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpocjdld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgdji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcfhof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Laopdgcg.exe

Executes dropped EXE 64 IoCs

pid	Process
2216	Kmnjhioc.exe
1804	Kpmfddnf.exe
1824	Kckbqpnj.exe
3708	Kkbkamnl.exe
5096	Lmqgnhmp.exe
228	Lpocjdld.exe
2832	Ldkojb32.exe
4892	Lgikfn32.exe
2332	Lkdggmlj.exe
4488	Liggbi32.exe
1008	Laopdgcg.exe
2196	Lpappc32.exe
2800	Lcpllo32.exe
3764	Lkgdml32.exe
1004	Lnepih32.exe
4856	Laalifad.exe
3720	Ldohebqh.exe
2052	Lcbiao32.exe
3104	Lkiqbl32.exe
4768	Lilanioo.exe
2708	Laciofpa.exe
1120	Lpfijcfl.exe
5004	Ldaeka32.exe
3616	Lgpagm32.exe
3140	Lklnhlfb.exe
2232	Lnjjdgee.exe
4104	Laefdf32.exe
4500	Lddbqa32.exe
1768	Lgbnmm32.exe
1144	Lknjmkdo.exe
3796	Mnlfigcc.exe
2212	Mahbje32.exe
4552	Mdfofakp.exe
2468	Mciobn32.exe
2436	Mgekbljc.exe
1616	Mkpgck32.exe
824	Mnocof32.exe
764	Majopeii.exe
2964	Mpmokb32.exe
3528	Mcklgm32.exe
3664	Mgghhlhq.exe
3168	Mjeddggd.exe
4508	Mnapdf32.exe
664	Mamleegg.exe
4748	Mdkhapfj.exe
4700	Mcnhmm32.exe
4072	Mkepnjng.exe
744	Mjhqjg32.exe
4584	Maohkd32.exe
1704	Mpaifalo.exe
1744	Mdmegp32.exe
3284	Mcpebmkb.exe
4040	Mkgmcjld.exe
3680	Mnfipekh.exe
3924	Maaepd32.exe
2584	Mpdelajl.exe
4936	Mdpalp32.exe
2036	Mcbahlip.exe
2244	Mgnnhk32.exe
3912	Njljefql.exe
376	Nacbfdao.exe
3700	Nqfbaq32.exe
4436	Ndbnboqb.exe
4216	Nceonl32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nnneknob.exe	Nfgmjqop.exe
File created	C:\Windows\SysWOW64\Bdolhc32.exe	Baaplhef.exe
File opened for modification	C:\Windows\SysWOW64\Ocegdjij.exe	Odbgim32.exe
File created	C:\Windows\SysWOW64\Cibifp32.dll	Hkmefd32.exe
File opened for modification	C:\Windows\SysWOW64\Klngdpdd.exe	Kipkhdeq.exe
File created	C:\Windows\SysWOW64\Njefqo32.exe	Nggjdc32.exe
File created	C:\Windows\SysWOW64\Pmannhhj.exe	Pgefeajb.exe
File opened for modification	C:\Windows\SysWOW64\Nbhkac32.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Dalchnkg.dll	Obfhba32.exe
File opened for modification	C:\Windows\SysWOW64\Dahode32.exe	Dllfkn32.exe
File opened for modification	C:\Windows\SysWOW64\Jblpek32.exe	Jlbgha32.exe
File created	C:\Windows\SysWOW64\Gbdhjm32.dll	Ncfdie32.exe
File created	C:\Windows\SysWOW64\Gbbkdl32.dll	Maaepd32.exe
File opened for modification	C:\Windows\SysWOW64\Ngedij32.exe	Ndghmo32.exe
File created	C:\Windows\SysWOW64\Ogljjiei.exe	Ocqnij32.exe
File created	C:\Windows\SysWOW64\Ibqpimpl.exe	Imdgqfbd.exe
File opened for modification	C:\Windows\SysWOW64\Jlbgha32.exe	Jbjcolha.exe
File created	C:\Windows\SysWOW64\Pbcfgejn.dll	Mjhqjg32.exe
File created	C:\Windows\SysWOW64\Jmmmebhb.dll	Aclpap32.exe
File created	C:\Windows\SysWOW64\Kkmjgool.dll	Ddjejl32.exe
File created	C:\Windows\SysWOW64\Kjqkei32.dll	Ikbnacmd.exe
File opened for modification	C:\Windows\SysWOW64\Ngcgcjnc.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Pgopffec.exe	Paegjl32.exe
File created	C:\Windows\SysWOW64\Kgkocp32.dll	Lkiqbl32.exe
File created	C:\Windows\SysWOW64\Nafokcol.exe	Njogjfoj.exe
File opened for modification	C:\Windows\SysWOW64\Nkqpjidj.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Gqffpbnb.dll	Odbgim32.exe
File created	C:\Windows\SysWOW64\Pnfkma32.exe	Pgmcqggf.exe
File created	C:\Windows\SysWOW64\Gjihje32.dll	Dahode32.exe
File created	C:\Windows\SysWOW64\Hiefcj32.exe	Gcimkc32.exe
File created	C:\Windows\SysWOW64\Dbfmkjoa.dll	Gcimkc32.exe
File created	C:\Windows\SysWOW64\Maohkd32.exe	Mjhqjg32.exe
File opened for modification	C:\Windows\SysWOW64\Bjokdipf.exe	Bganhm32.exe
File created	C:\Windows\SysWOW64\Pgioqq32.exe	Pqpgdfnp.exe
File opened for modification	C:\Windows\SysWOW64\Mipcob32.exe	Mgagbf32.exe
File created	C:\Windows\SysWOW64\Qjkmdp32.dll	Npfkgjdn.exe
File created	C:\Windows\SysWOW64\Leedqpci.dll	Lpnlpnih.exe
File created	C:\Windows\SysWOW64\Lkfbjdpq.dll	Nnolfdcn.exe
File opened for modification	C:\Windows\SysWOW64\Pcagphom.exe	Pndohaqe.exe
File created	C:\Windows\SysWOW64\Djhgpa32.dll	Eoaihhlp.exe
File opened for modification	C:\Windows\SysWOW64\Mnebeogl.exe	Mgkjhe32.exe
File created	C:\Windows\SysWOW64\Hpnkaj32.dll	Dopigd32.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Ngedij32.exe
File opened for modification	C:\Windows\SysWOW64\Imakkfdg.exe	Iblfnn32.exe
File created	C:\Windows\SysWOW64\Djnkap32.dll	Qnhahj32.exe
File opened for modification	C:\Windows\SysWOW64\Bfabnjjp.exe	Aepefb32.exe
File created	C:\Windows\SysWOW64\Laopdgcg.exe	Liggbi32.exe
File created	C:\Windows\SysWOW64\Ahmlgd32.exe	Adapgfqj.exe
File created	C:\Windows\SysWOW64\Qddina32.dll	Hofdacke.exe
File created	C:\Windows\SysWOW64\Jlgbon32.dll	Lbjlfi32.exe
File opened for modification	C:\Windows\SysWOW64\Odpjcm32.exe	Obangb32.exe
File opened for modification	C:\Windows\SysWOW64\Ogjmdigk.exe	Ncnadk32.exe
File opened for modification	C:\Windows\SysWOW64\Balfaiil.exe	Blpnib32.exe
File created	C:\Windows\SysWOW64\Mjddiqoc.dll	Jfcbjk32.exe
File created	C:\Windows\SysWOW64\Jjhijoaa.dll	Lgmngglp.exe
File opened for modification	C:\Windows\SysWOW64\Pfaigm32.exe	Pdpmpdbd.exe
File created	C:\Windows\SysWOW64\Bnjdmn32.dll	Kmnjhioc.exe
File opened for modification	C:\Windows\SysWOW64\Pqmjog32.exe	Pmannhhj.exe
File opened for modification	C:\Windows\SysWOW64\Lgpagm32.exe	Ldaeka32.exe
File created	C:\Windows\SysWOW64\Njqmepik.exe	Ncfdie32.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Hiefcj32.exe	Gcimkc32.exe
File opened for modification	C:\Windows\SysWOW64\Ndbnboqb.exe	Nqfbaq32.exe
File opened for modification	C:\Windows\SysWOW64\Bclhhnca.exe	Banllbdn.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10068	9844	WerFault.exe	495

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Paegjl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghopckpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klljnp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djgjlelk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpaifalo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfgkmfoj.dll"	Gdqgmmjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nabqkgan.dll"	Ibqpimpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njqmepik.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nqfbaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcbibebo.dll"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pniggbmk.dll"	Dlncan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmdqgd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imhkcaln.dll"	Hbnjmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmgfda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eemnjbaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iiaephpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmdqgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmmblqfc.dll"	Pdmpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Balpgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lelgbkio.dll"	Mdpalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjddiqoc.dll"	Jfcbjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiojlkkj.dll"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Meknidfo.dll"	Qbimoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdnjgmle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmlihfed.dll"	Mlcifmbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echmafdm.dll"	Ogogoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aejfpjne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acocaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofdhdf32.dll"	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iledokkp.dll"	Imakkfdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odapnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dboigi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnihcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anmnemcc.dll"	Aejfpjne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Madnnmem.dll"	Liddbc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afoeiklb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdiklqhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkbkamnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hofdacke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qceiaa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	1570cf68ed1744140636d808e3a8454247b81153badd7984f6779fa3167ddd6c_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocqnij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogogoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Miemjaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbejge32.dll"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqjamcpe.dll"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnjdmn32.dll"	Kmnjhioc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Legdcg32.dll"	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppelifin.dll"	Qchmagie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Abpcon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Baaplhef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hijooifk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llcpoo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njqmepik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnelfilp.dll"	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnpppgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jocbigff.dll"	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maghgl32.dll"	Aeklkchg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2216	1512	1570cf68ed1744140636d808e3a8454247b81153badd7984f6779fa3167ddd6c_NeikiAnalytics.exe	82
PID 1512 wrote to memory of 2216	1512	1570cf68ed1744140636d808e3a8454247b81153badd7984f6779fa3167ddd6c_NeikiAnalytics.exe	82
PID 1512 wrote to memory of 2216	1512	1570cf68ed1744140636d808e3a8454247b81153badd7984f6779fa3167ddd6c_NeikiAnalytics.exe	82
PID 2216 wrote to memory of 1804	2216	Kmnjhioc.exe	83
PID 2216 wrote to memory of 1804	2216	Kmnjhioc.exe	83
PID 2216 wrote to memory of 1804	2216	Kmnjhioc.exe	83
PID 1804 wrote to memory of 1824	1804	Kpmfddnf.exe	84
PID 1804 wrote to memory of 1824	1804	Kpmfddnf.exe	84
PID 1804 wrote to memory of 1824	1804	Kpmfddnf.exe	84
PID 1824 wrote to memory of 3708	1824	Kckbqpnj.exe	85
PID 1824 wrote to memory of 3708	1824	Kckbqpnj.exe	85
PID 1824 wrote to memory of 3708	1824	Kckbqpnj.exe	85
PID 3708 wrote to memory of 5096	3708	Kkbkamnl.exe	86
PID 3708 wrote to memory of 5096	3708	Kkbkamnl.exe	86
PID 3708 wrote to memory of 5096	3708	Kkbkamnl.exe	86
PID 5096 wrote to memory of 228	5096	Lmqgnhmp.exe	87
PID 5096 wrote to memory of 228	5096	Lmqgnhmp.exe	87
PID 5096 wrote to memory of 228	5096	Lmqgnhmp.exe	87
PID 228 wrote to memory of 2832	228	Lpocjdld.exe	88
PID 228 wrote to memory of 2832	228	Lpocjdld.exe	88
PID 228 wrote to memory of 2832	228	Lpocjdld.exe	88
PID 2832 wrote to memory of 4892	2832	Ldkojb32.exe	89
PID 2832 wrote to memory of 4892	2832	Ldkojb32.exe	89
PID 2832 wrote to memory of 4892	2832	Ldkojb32.exe	89
PID 4892 wrote to memory of 2332	4892	Lgikfn32.exe	90
PID 4892 wrote to memory of 2332	4892	Lgikfn32.exe	90
PID 4892 wrote to memory of 2332	4892	Lgikfn32.exe	90
PID 2332 wrote to memory of 4488	2332	Lkdggmlj.exe	91
PID 2332 wrote to memory of 4488	2332	Lkdggmlj.exe	91
PID 2332 wrote to memory of 4488	2332	Lkdggmlj.exe	91
PID 4488 wrote to memory of 1008	4488	Liggbi32.exe	92
PID 4488 wrote to memory of 1008	4488	Liggbi32.exe	92
PID 4488 wrote to memory of 1008	4488	Liggbi32.exe	92
PID 1008 wrote to memory of 2196	1008	Laopdgcg.exe	93
PID 1008 wrote to memory of 2196	1008	Laopdgcg.exe	93
PID 1008 wrote to memory of 2196	1008	Laopdgcg.exe	93
PID 2196 wrote to memory of 2800	2196	Lpappc32.exe	94
PID 2196 wrote to memory of 2800	2196	Lpappc32.exe	94
PID 2196 wrote to memory of 2800	2196	Lpappc32.exe	94
PID 2800 wrote to memory of 3764	2800	Lcpllo32.exe	95
PID 2800 wrote to memory of 3764	2800	Lcpllo32.exe	95
PID 2800 wrote to memory of 3764	2800	Lcpllo32.exe	95
PID 3764 wrote to memory of 1004	3764	Lkgdml32.exe	96
PID 3764 wrote to memory of 1004	3764	Lkgdml32.exe	96
PID 3764 wrote to memory of 1004	3764	Lkgdml32.exe	96
PID 1004 wrote to memory of 4856	1004	Lnepih32.exe	97
PID 1004 wrote to memory of 4856	1004	Lnepih32.exe	97
PID 1004 wrote to memory of 4856	1004	Lnepih32.exe	97
PID 4856 wrote to memory of 3720	4856	Laalifad.exe	98
PID 4856 wrote to memory of 3720	4856	Laalifad.exe	98
PID 4856 wrote to memory of 3720	4856	Laalifad.exe	98
PID 3720 wrote to memory of 2052	3720	Ldohebqh.exe	99
PID 3720 wrote to memory of 2052	3720	Ldohebqh.exe	99
PID 3720 wrote to memory of 2052	3720	Ldohebqh.exe	99
PID 2052 wrote to memory of 3104	2052	Lcbiao32.exe	100
PID 2052 wrote to memory of 3104	2052	Lcbiao32.exe	100
PID 2052 wrote to memory of 3104	2052	Lcbiao32.exe	100
PID 3104 wrote to memory of 4768	3104	Lkiqbl32.exe	101
PID 3104 wrote to memory of 4768	3104	Lkiqbl32.exe	101
PID 3104 wrote to memory of 4768	3104	Lkiqbl32.exe	101
PID 4768 wrote to memory of 2708	4768	Lilanioo.exe	102
PID 4768 wrote to memory of 2708	4768	Lilanioo.exe	102
PID 4768 wrote to memory of 2708	4768	Lilanioo.exe	102
PID 2708 wrote to memory of 1120	2708	Laciofpa.exe	103

C:\Users\Admin\AppData\Local\Temp\1570cf68ed1744140636d808e3a8454247b81153badd7984f6779fa3167ddd6c_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\1570cf68ed1744140636d808e3a8454247b81153badd7984f6779fa3167ddd6c_NeikiAnalytics.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Windows\SysWOW64\Kmnjhioc.exe
  C:\Windows\system32\Kmnjhioc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\Kpmfddnf.exe
    C:\Windows\system32\Kpmfddnf.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\SysWOW64\Kckbqpnj.exe
      C:\Windows\system32\Kckbqpnj.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1824
    - - C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3708
      - C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:228
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1008
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2800
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3720
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        23⤵
        Executes dropped EXE
        
        PID:1120
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5004
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3616
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        26⤵
        Executes dropped EXE
        
        PID:3140
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        27⤵
        Executes dropped EXE
        
        PID:2232
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        28⤵
        Executes dropped EXE
        
        PID:4104
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        29⤵
        Executes dropped EXE
        
        PID:4500
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        30⤵
        Executes dropped EXE
        
        PID:1768
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        31⤵
        Executes dropped EXE
        
        PID:1144
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        32⤵
        Executes dropped EXE
        
        PID:3796
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        33⤵
        Executes dropped EXE
        
        PID:2212
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4552
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2468
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        36⤵
        Executes dropped EXE
        
        PID:2436
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1616
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        38⤵
        Executes dropped EXE
        
        PID:824
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        39⤵
        Executes dropped EXE
        
        PID:764
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        40⤵
        Executes dropped EXE
        
        PID:2964
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        41⤵
        Modifies registry class
        
        PID:4388
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        42⤵
        Executes dropped EXE
        
        PID:3528
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3664
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3168
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        45⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        46⤵
        Executes dropped EXE
        
        PID:664
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        47⤵
        Executes dropped EXE
        
        PID:4748
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        48⤵
        Executes dropped EXE
        
        PID:4700
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        49⤵
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:744
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4584
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1704
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        53⤵
        Executes dropped EXE
        
        PID:1744
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        54⤵
        Executes dropped EXE
        
        PID:3284
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4040
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        56⤵
        Executes dropped EXE
        
        PID:3680
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3924
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        58⤵
        Executes dropped EXE
        
        PID:2584
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4936
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2036
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2244
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3912
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        63⤵
        Executes dropped EXE
        
        PID:376
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3700
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        65⤵
        Executes dropped EXE
        
        PID:4436
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        66⤵
        Executes dropped EXE
        
        PID:4216
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        67⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        68⤵
        Drops file in System32 directory
        
        PID:2096
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        69⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        70⤵
        Drops file in System32 directory
        
        PID:4624
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        71⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        72⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        73⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4404
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        74⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        75⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        76⤵
        Drops file in System32 directory
        
        PID:3968
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        77⤵
        Drops file in System32 directory
        
        PID:4848
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        78⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        79⤵
        Drops file in System32 directory
        
        PID:3380
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        80⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        81⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        82⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        83⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        84⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        85⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        86⤵
        Drops file in System32 directory
        
        PID:4632
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        87⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        88⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        89⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        90⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        91⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3180
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        92⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        93⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        94⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        95⤵
        Drops file in System32 directory
        
        PID:2400
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        96⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        97⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        98⤵
        Modifies registry class
        
        PID:404
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        99⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        100⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        101⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        102⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1924
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4428
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1392
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        106⤵
        
        PID:860
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        107⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        108⤵
        Drops file in System32 directory
        
        PID:4980
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        109⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2044
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        111⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5072
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        113⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        114⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        115⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        116⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        117⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        118⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        119⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        120⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        121⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5220
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        123⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5304
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        125⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        126⤵
        Drops file in System32 directory
        
        PID:5392
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        127⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        128⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5524
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        131⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        132⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5692
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5732
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        135⤵
        Modifies registry class
        
        PID:5776
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        136⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        137⤵
        Modifies registry class
        
        PID:5860
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        138⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        139⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        140⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        142⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6120
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        144⤵
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        145⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        146⤵
        Modifies registry class
        
        PID:5296
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        147⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        148⤵
        Drops file in System32 directory
        
        PID:5332
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        149⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        150⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        151⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        152⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        153⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        154⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        155⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5932
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        157⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        158⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        159⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5244
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        162⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5520
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        164⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        165⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        166⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        167⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        168⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        169⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        170⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5492
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        172⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        173⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        174⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        175⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        176⤵
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5712
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        178⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        179⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5768
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        181⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        182⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        183⤵
        Drops file in System32 directory
        
        PID:5724
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5384
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        185⤵
        Modifies registry class
        
        PID:6172
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        186⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        187⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        188⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        189⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        190⤵
        Drops file in System32 directory
        
        PID:6392
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        191⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        192⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        193⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        194⤵
        Modifies registry class
        
        PID:6564
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        195⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        196⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6692
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6736
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6776
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        200⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        201⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        202⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        203⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        204⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        205⤵
        Modifies registry class
        
        PID:7032
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        206⤵
        Modifies registry class
        
        PID:7080
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        207⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        208⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        209⤵
        Modifies registry class
        
        PID:6212
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        210⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        211⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        212⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        213⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        214⤵
        Drops file in System32 directory
        
        PID:6572
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        215⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        216⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        217⤵
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        218⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        219⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        220⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        221⤵
        Modifies registry class
        
        PID:7040
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        222⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        223⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6156
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        224⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        225⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        226⤵
        Drops file in System32 directory
        
        PID:6476
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        227⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        228⤵
        Modifies registry class
        
        PID:6684
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        229⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        230⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        231⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        232⤵
        Drops file in System32 directory
        
        PID:7132
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        233⤵
        Drops file in System32 directory
        
        PID:6228
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6452
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        235⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        236⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        237⤵
        Drops file in System32 directory
        
        PID:7020
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7148
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        239⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        240⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        241⤵
        Modifies registry class
        
        PID:7076
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        242⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        243⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        244⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        245⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        246⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6848
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        248⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7200
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        249⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        250⤵
        Drops file in System32 directory
        
        PID:7288
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        251⤵
        Drops file in System32 directory
        
        PID:7332
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        252⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        253⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        254⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        255⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        256⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        257⤵
        Modifies registry class
        
        PID:7592
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        258⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        259⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        260⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        261⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        262⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7872
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        264⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        265⤵
        Drops file in System32 directory
        
        PID:7960
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        266⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        267⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        268⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        269⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        270⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        271⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        272⤵
        Drops file in System32 directory
        
        PID:7280
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        273⤵
        Modifies registry class
        
        PID:7356
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        274⤵
        Modifies registry class
        
        PID:7424
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        275⤵
        Drops file in System32 directory
        
        PID:7488
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        276⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        277⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7692
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        279⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7868
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7936
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        282⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        283⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        284⤵
        Drops file in System32 directory
        
        PID:8168
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        285⤵
        Modifies registry class
        
        PID:7228
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        286⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        287⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        288⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        289⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        290⤵
        Drops file in System32 directory
        
        PID:7820
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        291⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        292⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        293⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        294⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        295⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        296⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7928
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7968
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        299⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        300⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        301⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        302⤵
        Drops file in System32 directory
        
        PID:8156
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        303⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        304⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        305⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        306⤵
        Drops file in System32 directory
        
        PID:8072
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        307⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        308⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        309⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        310⤵
        Drops file in System32 directory
        
        PID:8292
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        311⤵
        Modifies registry class
        
        PID:8332
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        312⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8420
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        314⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        315⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        316⤵
        Drops file in System32 directory
        
        PID:8548
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        317⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        318⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        319⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        320⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        321⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8812
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        323⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        324⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        325⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        326⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        327⤵
        Modifies registry class
        
        PID:9032
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        328⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        329⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9164
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        331⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8244
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        333⤵
        Drops file in System32 directory
        
        PID:8308
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        334⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        335⤵
        Modifies registry class
        
        PID:8432
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        336⤵
        Modifies registry class
        
        PID:8504
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        337⤵
        Drops file in System32 directory
        
        PID:8576
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8628
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        339⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        340⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        341⤵
        Modifies registry class
        
        PID:8844
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        342⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        343⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9060
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        345⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        346⤵
        Drops file in System32 directory
        
        PID:9192
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        347⤵
        Modifies registry class
        
        PID:8240
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        348⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        349⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        350⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        351⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8760
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        353⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9008
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        355⤵
        Drops file in System32 directory
        
        PID:9104
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        356⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        357⤵
        Modifies registry class
        
        PID:8320
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        358⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        359⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        360⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8980
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        362⤵
        Modifies registry class
        
        PID:9184
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        363⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        364⤵
        Drops file in System32 directory
        
        PID:8808
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        365⤵
        Modifies registry class
        
        PID:9096
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        366⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8884
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        368⤵
        Drops file in System32 directory
        
        PID:8328
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        369⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        370⤵
        Modifies registry class
        
        PID:8456
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        371⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        372⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        373⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        374⤵
        Modifies registry class
        
        PID:9332
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        375⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9416
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        377⤵
        Modifies registry class
        
        PID:9456
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        378⤵
        Drops file in System32 directory
        
        PID:9508
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        379⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        380⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        381⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        382⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        383⤵
        Modifies registry class
        
        PID:9728
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        384⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        385⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        386⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        387⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        388⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9992
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        390⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        391⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        392⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        393⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        394⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        395⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        396⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        397⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        398⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        399⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9520
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        400⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        401⤵
        Drops file in System32 directory
        
        PID:9668
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        402⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        403⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9868
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        405⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9936
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10008
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10064
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        408⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        409⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        410⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        411⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        412⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        413⤵
        Drops file in System32 directory
        
        PID:9632
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        414⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        415⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9844 -s 404
        416⤵
        Program crash
        
        PID:10068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 9844 -ip 9844
1⤵
PID:9980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abpcon32.exe

Filesize
57KB

MD5
ec0de3ef801b860e71659cdb9f40eb0f

SHA1
44ac8ee71e61dc310e3bebfa27c0f47341f8a54e

SHA256
66890e920775d216c94e89ecf2de9acf07b10bae4765e4493144585bda3c756a

SHA512
eb56eab218950dd8036ca073f9b3864e20947f7af742ed10946d54975c2ab0ed46d3746544dbadd74d165401fa49ed94aad42cdffe84fa76daa3ac415737fbd8

Download Submit
C:\Windows\SysWOW64\Aclpap32.exe

Filesize
57KB

MD5
38076d2092267b4b54dfaaa51f08af73

SHA1
cb888771babd7e5ddb8866b213739537edf26727

SHA256
f7fd585678ee191fb89b6f8c56e0547f9b358f8cfc52af3dad63f9dac8a1bb62

SHA512
3ca431361ab79ed97377588ef76905f260c1f84cd6f1fece98234eb9eb0d3052bb45d9ea4bbc46292d3c894c54ecba32fb7d2380bed5db997a616f447b2c317d

Download Submit
C:\Windows\SysWOW64\Ahmlgd32.exe

Filesize
57KB

MD5
30b9145b19b2c0c9a948d10ee23a1c5c

SHA1
a1321acb56e8c1e6be02fdc6769a07728b411f03

SHA256
8d9d2eb278c7b53384a2f9dd47a80e145712da9747723a7281736b4213f78099

SHA512
702de0d773a99efb93d25af6b79200bc6d51ff29d2b710cd98fc3d991a169045de24beab9f4deb465d5ea4cb47cd1b4994c6616a31ca700de36f1d329f44812a

Download Submit
C:\Windows\SysWOW64\Ajfoiqll.exe

Filesize
57KB

MD5
8c3a706029b15e821ebc1bb93b37f15f

SHA1
e9cc51291320dab7c86e394793f2d90f538c6e52

SHA256
810c76e4605c5b839eed7adda78cfc219c09756e3db823eb6f290ed5c9b84cb9

SHA512
68d9065985b932904dd97448026115f9bd4a1649fef353699d839837be2dbebf675e4565ed95a33b7029a2f0e4bad8f2f18af49e920e34bcd7e8bfa0c534353a

Download Submit
C:\Windows\SysWOW64\Alabgd32.exe

Filesize
57KB

MD5
d6dc5d86c8e75cfe8f110ba11f28ba1f

SHA1
c4042787a190fe202037d007a0aa664308ba4182

SHA256
b77eb7cd32f01457d5a26a072f24b6a524141e723f821891bd474d10b53f8338

SHA512
3e7855e491ed140b0c330d63e414cbea75d8456e3399c8f20a03b17777afa34af91546526303f5601d2b5482757c102842ee4bf5b90a707e496eb40a6e37a8ef

Download Submit
C:\Windows\SysWOW64\Alkdnboj.exe

Filesize
57KB

MD5
7045fc31fc0bdad2a40e4ae9e83c96e0

SHA1
3423d773fca86b8d7867d195d2fa86b151489054

SHA256
9ffbd8d5c2d05dda93858cbb0b646d1955ab9931f7d67faa9a9334796c5a76f5

SHA512
1e105c30a052fbe56d3db091e593726df1293351807aea2761bfc9bf6b33ae5ece28ddc3ed242636841302ba2953c2ae94c951ed9af2a603a9f0b77c2b4b6cab

Download Submit
C:\Windows\SysWOW64\Andqdh32.exe

Filesize
57KB

MD5
1ab57bbe8e34abe361a80351598d8639

SHA1
b2314e2bf55bc166d3dcf3b9a5fa846e586c7244

SHA256
e8b169b547ce9389d0cb7005114c60f301fc2a13c6090596432e70c3cc7aff4f

SHA512
ef93cce3fef9c5f0c5d0bbc485c34782867813830963f3ba5ee4463acfb01f59800d1ab50b68cd77c26d1d171cb011e69b8ea29179e33bd13c34848dd4a2c537

Download Submit
C:\Windows\SysWOW64\Bbgipldd.exe

Filesize
57KB

MD5
4ece4897932773cc6e26b7e871bbf59b

SHA1
91d9d0341bc1aa21c4b019093a90d7f7a468a141

SHA256
d95018f432dc810a7c69983def8e5f2b233dcdb6dc12b885389043908af5ae8b

SHA512
2cf09b34837895eff017ad6f30a864d55f68ec775edc98b0d4420d61688f175e84080023d570bf6f4f0717e61227e4ff01cc7f9bc430d89aa82aac109b3c269d

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
57KB

MD5
a629fb07b59b77a996e28a5e0f4d0ed3

SHA1
4e23df22346788a70a7fbbde4a6482b415fa55db

SHA256
41536271b2f0035841e3e1ff8f3ed739bd2af46cd07711db44bef37e565dfa76

SHA512
d44cf78b9b6534fc9924e4d69b5c622c3e0bf2e3a5eded543e49dcddf2bae876645e526dd67241618b25a80eb990b7013aa81e0b30dfa2e9886954d6bfc0d0fd

Download Submit
C:\Windows\SysWOW64\Bhfonc32.exe

Filesize
57KB

MD5
c22fc11fdfbee5630995b77d7b66a17d

SHA1
c99877a9ce3bdd78dfa3703a89be34e308ebc983

SHA256
7c7d65a19402f11bcbae0f4b876105c7613fa61596b73b55c5c141e3b59a2c2d

SHA512
6f13c6bc2ff81b5df7fa0454a8c32156cbc4a6021200981d4328d70067c72d6edd5f37860b685da91d988b1cd3e12656a8a3ed3b8daeb7e9ddd85e5bf6ede437

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
57KB

MD5
d362834452b0ec467df58c47d12f752b

SHA1
8d5eec738e2951b370cf390bc5e1afe833b23a9e

SHA256
f72e439891e28ac091f97475e33f81f823dd385f1c02205daed5c28dfa6fc0f9

SHA512
6aadd1d761615355d47e899ec885d0f9222fd33fa9a55005aca5e6764638a3488ca4289fef1c25455aa1da3b91cbce4788f4e1e1022878da8e358d5a0bf22966

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
57KB

MD5
39964f70d0bd51c154d3a1098ce2faac

SHA1
b641cc60cbaa33940d58d0d71a20d8cfc008f4d0

SHA256
2d1200c371490f4cee9d299332db8f9cf2e3f34b32e5822ec65628ee900fb1f7

SHA512
b0b3879574ac05e3f6a0940b7a197438c45595d322369f8d2b3457783f4ac56d6e81e724492eb1d0116c24e2ed925b354d1aa086bd22c1ec7c1e652d91b830c7

Download Submit
C:\Windows\SysWOW64\Cecbmf32.exe

Filesize
57KB

MD5
72ed6dca1ad63c3dcd474d5608f46f1b

SHA1
715db033ca7c76e67e59a1fe4cb6b818101a52a3

SHA256
b862bcfa9af0ec9281731ba7440dc53a3034ea5d5b022eaf12d80d4322edae73

SHA512
b71292c81f5df4e15c21c7c5f8f7ff23564381b71863520e3c984682077924ff40aa8cf7d33b2f71f5f098e407a448c35fad54b9ebacf902406a54f6a8467805

Download Submit
C:\Windows\SysWOW64\Ceckcp32.exe

Filesize
57KB

MD5
6aa2d97c260df1767b7a0a888cbeb33a

SHA1
3f76c2c22e445a487e188d548e9065d5417d2ae4

SHA256
b5cdce603e77859d2a516913b661d1d7d810381895efcae84f3480b429583f82

SHA512
72c2773aeaeb7260d4c96a19a85ae10cd226936381fd6d09194def00f59a56a7e3bddc392fdaee12231e9f13b87d4cac23c08ef5e6e22029be42ef9ca60a89a2

Download Submit
C:\Windows\SysWOW64\Cffdpghg.exe

Filesize
57KB

MD5
94351e6e611a36953750d5589cd3ca9b

SHA1
86a9da7e8be122a22dbe81366e49d0567a01395b

SHA256
e80f88d1a4041db9b65e000e33cf12daada0da7a2e6b20193e7ac0b5b028d861

SHA512
f84b3e7bf6b31bed808e9c02f325132086264d2a21e8014429c786e754ed32621f146d4460acc5b6cd5f7728c1ebac24d8b1bf8aaff9c26aa7a3e4e5aaf33a62

Download Submit
C:\Windows\SysWOW64\Chghdqbf.exe

Filesize
57KB

MD5
be9a382dacbda0d0a29e7f1c1c63f053

SHA1
cc72dafaeaa005c19ba8d4b4d4be2b35355c41af

SHA256
ee6ba30d75591250013cca5dd443af03a83e75b9a9581441ccd347e45a7ca352

SHA512
b7a2de8e568e4cf74f45e07bca70d01ab55088e2b7ee42cf32b5690667f27c2d71357c4f1fd99c5d1e22369dff4efc20d6a2f4e371dd9988fe92c3719c19f2e3

Download Submit
C:\Windows\SysWOW64\Dahode32.exe

Filesize
57KB

MD5
36a76118d9fde0ce1863bc9b214c2e63

SHA1
a3bfcd96c52f7760d463ba3b4105df967f26135e

SHA256
b501cb196b59e0004b80088d221966fa543973989bc397166cbeff24220e6e94

SHA512
f2e7076c76ca86fafb01a6639c9261b8a8e75d9cbc28c7e985e27210e980091890f2c89ac9f6959c69f6af19013f193ebd5c1a17ba6efe51257d3e6331d82ac9

Download Submit
C:\Windows\SysWOW64\Ddjejl32.exe

Filesize
57KB

MD5
c089d4f48d4804b65bcc3ab2306cc2d4

SHA1
361e08fc48d952dbc5e1b25bec17ba846c645cc8

SHA256
0e6edcd1bb2bb1e6f156e3fa130ed9ced6f17cf14ff7ace5f15e4944245e065d

SHA512
2fc8ce57da30e379acea8bf7aff5f23a412fce103e778ff475b47e4167b2657145b247cbb0ea3b7874c250014d36300a700b34f0f334e27f88a2e4df66b59a9c

Download Submit
C:\Windows\SysWOW64\Ddmhja32.exe

Filesize
57KB

MD5
578cc5c1f437fa0d798891dbc8c8ed98

SHA1
9360805e9143ffcff852671a82e6c470adc53764

SHA256
8b737aaf42166b4412c6934fb69606bba940b5ae4c4bc9a22b9e56517f44476a

SHA512
53cc42c2ba9a3a40609444285f82245c19796304c2815e59a3f81a08f420019989f8485763748997a4ab316e17d61c37ed0c0a1e28c70df6856e1feed4967786

Download Submit
C:\Windows\SysWOW64\Dejacond.exe

Filesize
57KB

MD5
36921d26de1aace087f82be739bf0178

SHA1
1a63d9117428395794ced4ef98fa08f56e1a1f9e

SHA256
9ccf0812544d970d32d35aeb64ae9a04034c5630b84bedb3751fc302f7dd6e62

SHA512
9aed2bb3d4e752bedef51ec6f8cad04a530e77566c0abf51a72e5c9c3818d503fa5a03d3f02e2f9862cb993c2b2e5d679a6f703602cd2fc76ee0323cb2bb2006

Download Submit
C:\Windows\SysWOW64\Dhkjej32.exe

Filesize
57KB

MD5
b5be6e5c137a49f25af33fb5bc07bbb0

SHA1
bce8e0bcd50f3d376d01376a2d828cd6b9be60e6

SHA256
74f6a0e013c52fd9604928c123d1223b4b1bf70ac5ab89d50a9950fdc5e07cff

SHA512
10fad7670efb4d5c61435275d183202717e8b9c83c44cde0b519d232c6f4c4140d13b522d9021c6ca82edeb370e0208049700dbdf58c3d193541fe86f7aeb022

Download Submit
C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
57KB

MD5
39eb19e6f61dc4bf98ef42c003149308

SHA1
58afd4fd82ad720c9701f6f9d56bd94a3dc53d47

SHA256
0df0fdbff4c18facdc3a8a067dbf2ef9784071c325ec6595554f5f1c3bb29675

SHA512
5ade16aa4a20105b8a9796ec77f0f6688da5c0c57c9f33b84d4644c100c5dbe661d0ef80f45c3c720f51f8ce191a0f60150b03a12c14d935d0c3ba3326f692af

Download Submit
C:\Windows\SysWOW64\Dmjocp32.exe

Filesize
57KB

MD5
83ec6c13d9706c929ccd33717b0815b8

SHA1
556dd1823c2de7bf5fb62596f03ec33061833085

SHA256
6529eac8bb631c319ec12d91eac832e827a467b035cd36857b4e6041e0f3da78

SHA512
92b9056c5b38f37572aced748b46c1ed6cb1dd9e300c11ddeab87463a4480fe48f38a629fc3f4a98fd338530cca14fb8f6092ad95e0704a9d310e18c2c0a718e

Download Submit
C:\Windows\SysWOW64\Doeiljfn.exe

Filesize
57KB

MD5
e810505dd9ec5c706e93584c759fa7b7

SHA1
e33cfa51c5be5fdc799f12a9d6bd08635da0304b

SHA256
6f6f578a6733aca6dff6481b9da516232e99d34bfd717c317d114783a46e98ea

SHA512
4a0f094d517c0a8fa3c349c476d9b90d250fe86d5f49523c0142badc0d33983f69a0c8829eace4f5611c374bdfc9d1b87625f8ed1692de59dcf3ff83684b2cdf

Download Submit
C:\Windows\SysWOW64\Eadopc32.exe

Filesize
57KB

MD5
843647db71c8a14da5b0f06ec3d8d1c7

SHA1
256d32f53938c3900a6dc0b14b6ab734b1466492

SHA256
221dffdcada1feacda66fedaff40dd506a5f1cdb8f993ece6d461b38223e42b5

SHA512
193ea1cc9eeb67c19b2e33211d5580230e2aae31a52df13b23f2ea72255231a022eaf223fc074aca724aaf343c0f62b8f74f7921f43c4abd3b1b8bc924a41e62

Download Submit
C:\Windows\SysWOW64\Fdnjgmle.exe

Filesize
57KB

MD5
0a0a8e5e9904677d289ed243eef259f5

SHA1
047da0e4507966fee9861cc1dcf687ca9aba82b5

SHA256
330f1bc6b4cd9848ba54b9ac666239b74ed53fb7e068f653c3f8278c4e188bef

SHA512
e54fd6eb838f35d1a6140998a7af676e2ad5203cbc33a33e5a23f0ebe4912c284b766e1a178e9729937b3b039cc2862cb826d937e4253caef3dcbe6bb132e487

Download Submit
C:\Windows\SysWOW64\Gcagkdba.exe

Filesize
57KB

MD5
25a178b5a879455d93eaef2b5cf2635e

SHA1
4ad7f4e0d57bf8d5e7ad5c689466cbbff224c131

SHA256
b3239cbb2586f57b9e981922c4490a30287996bb9780a81e59c07b16b3fb896e

SHA512
432959f9ff00d774bed0f996406828d521eb0ed69f93207d5add38a6e48de58c58311bccac0618993f0816e12685137b25da2528232ca01c89c1d2862028b19c

Download Submit
C:\Windows\SysWOW64\Gcimkc32.exe

Filesize
57KB

MD5
693c6a2890657ec3c97f89037bfc019d

SHA1
2e3b9bc0b2752a7e075f7e2681c13ae7d9630456

SHA256
5f6e98a23bd7e935fd7af28e2d8901d694f4765f7f838b875fd8fd26fd55cea3

SHA512
9379962bc444ab5b4c7ef8aeac4b0e253c8e89a474229f9200519eecf1332e72f81ad263dad44f57cd78ec7ee6bbdd57e23895669cec03e82c4321422d577631

Download Submit
C:\Windows\SysWOW64\Hijooifk.exe

Filesize
57KB

MD5
63c280c0e8dddd42a2e18b853a8ae5db

SHA1
65d66d14b17cc724f797fdf91ffead3716c30642

SHA256
d0c926a5c5af32bff0bcc674b35e546c16d26c20ffbf952bb27e21d826525426

SHA512
55a5c8421d66d27413ce31e414764bd6075be3d757610b607cefdf543fef82b4e566e468b53a47065fa7b8be2dbc3d846b10e3476d8bc51ca09ec47366e8273d

Download Submit
C:\Windows\SysWOW64\Iblfnn32.exe

Filesize
57KB

MD5
5e3328e8562d4830e4e04b611c25280a

SHA1
1f226f61852d09c6cd8fba92ab992ea06b5701fe

SHA256
ebf69048133368dede6958ffbae26f92bdefb4b06072db4bd9ae30b94c4fa548

SHA512
6df9d7788fc8c31d9ec6f53f427a40d9500bd6d4ad2af4df54fe868101c2b46c47e6b5c30558a68dce29a4554126b7039c9a859fb13901c53cf1c71c18470612

Download Submit
C:\Windows\SysWOW64\Ickchq32.exe

Filesize
57KB

MD5
7896261793924cb455b7b5f193af6823

SHA1
0245e0c448dfec8de2c1536f41641b1204a6e705

SHA256
4f343b879dc4d98c8614dae99dac763ab84b058b041c45ad69fa2f6a2d84d10d

SHA512
54c3155998c05baade6880189138d02bfba3b6132ed19d93bf89d2159da3303dc990667861902b641ce6bad6ab1bd23ac3e30c7b7dbcd9cecc4e7dd33fb5e8e6

Download Submit
C:\Windows\SysWOW64\Ikpaldog.exe

Filesize
57KB

MD5
fb9fcf9e5a6bb5074d28687a0d091335

SHA1
9d4cebea9ee84f2198ed48ea9d9289b0f10ec4e2

SHA256
2c96e5cb98d693d36f598aa8f95e8f160bdc860fc61e7dbae60cd41836e8966a

SHA512
31e982c7a4024e11f2df14431f68407912f4c77011b6811cd0ed067038f6f2aa379e2924361f80f143e51aae8151b3760b61b462da45d32b8b03e5074c258fc0

Download Submit
C:\Windows\SysWOW64\Imdgqfbd.exe

Filesize
57KB

MD5
523a3af96ef2d046f365281e44630364

SHA1
f7b512eccd2b284b6cdee146b359ca93fae6e307

SHA256
90483952086001f7aac96a0d44d7937b6ff95159fa3449f311e382157d25d966

SHA512
6f5cb02e75c2cc790bda5c0dada16aa800a9de0221f5403485f62e359ba5710f606d75ad9fa1017bac806c9d046ab255fd00af271455123db857726da6013d8b

Download Submit
C:\Windows\SysWOW64\Jianff32.exe

Filesize
57KB

MD5
8ff9e598ee90dbd5765dbbbee3e4bbd3

SHA1
50641337857d1014045f2e2a4168384e41703aa2

SHA256
2723a3f5d913dfafbf2118c39e54a728bbbd77d47678c44c0ed9713314a6c726

SHA512
7115df06a4720c453560a093531521462b6e083b64633a937fa5b6f8273393ad10104ac85e6e2a5543020f5bf0d7f71cce6fa6e222aa1a7167b2843d98ad1ec5

Download Submit
C:\Windows\SysWOW64\Kckbqpnj.exe

Filesize
57KB

MD5
66407b1d40cca7cc9b6b334aabe79cd1

SHA1
5257c4e122465327c7901e434e77df5613b8f46e

SHA256
439cb88e77627e9b6aed870e21e0f363a1802f448ba526a89b6e7808bb459d37

SHA512
655f789f154a531c1861411d76e8a81d976cf7d8107b30c4be7e96adcea042ebff82b78e516dbbcf49b45959b25673924bd379586f5d316303168cfdfb7af9bf

Download Submit
C:\Windows\SysWOW64\Kefkme32.exe

Filesize
57KB

MD5
27634c37dbd3b36a2ce2cede8a5ec109

SHA1
a08959f330bb3260946ed9a6345358a6e56e4e8d

SHA256
79ed4fb52a375d0427d8e83dc3459867455b70d3283a0c3b8e062b5d0ce760b5

SHA512
b3482c2dc9a6c39261ebf20020633e6aaba2bdf450c9e5057d37e236ba0fd26c3c65543ffdafa706af3ce735a357d93165b83f64b54e906f4d3e1326f7e247b5

Download Submit
C:\Windows\SysWOW64\Kemhff32.exe

Filesize
57KB

MD5
1b428b3422556d7bc8672e62855e26c0

SHA1
b65cad820d1cb46d09aba29706b1c1d2eb582c43

SHA256
78b13835f2573ab0f9e2e30602f89ae32ab27aa0638b84f029b4d86ae1297b67

SHA512
729eedc9668c3aabb8a2ca93e5aedad522d20c86eb8cac6dffb99291f26b9fd22e14f911b21b002f48c9c7c662c1c36f8b469138a54f2c0e8183c107a73a2ebf

Download Submit
C:\Windows\SysWOW64\Kkbkamnl.exe

Filesize
57KB

MD5
f929d17fe2ce8f55575f51a2ae15f096

SHA1
5105ffc558d5930a89bc753604d383e002453e97

SHA256
39adf3aacef2b5475f84d6accfaa8949aa6916f927be0fa03ea8d1a732e12f8d

SHA512
f6ab551ca1d455d9f0c6da601ae834fc15b8b885794d65886a73edeaf4c481f9a8fc2a520ba3d0f97c91c8617c57cc49691b159223475d3234faf8e9d9ef2eac

Download Submit
C:\Windows\SysWOW64\Klljnp32.exe

Filesize
57KB

MD5
838dd417ec2a6a1bddaeaa0460b1a1ad

SHA1
796dc0e01e7b0f274455dbd49de661d3c594c433

SHA256
71c4239f776bdcfea78211a006a874812e8c9b98112432c4d3d9e0b565748077

SHA512
272cd21174b2a2a1fefb97bd5512201398333b6f9294851477c6b6fe1183daaae4dc93a12b9f5b157170bc0844bbb5138b49166441ddce8081c34c437bbb5d3b

Download Submit
C:\Windows\SysWOW64\Kmnjhioc.exe

Filesize
57KB

MD5
40ab11e0fb10cff222795097dc7fa313

SHA1
934f93447be5d1fe632a20ef5db390b644df83d3

SHA256
7520dd477b04d3a4fc29087a3cf4904a7eb00838fe4dd6ba2424550bdab4ec4b

SHA512
fa0d68ffac8e418465dd6a3bf866704ea5a498a65dfe1d30b5d51aaaaaf8cdcd0b07e69a809b2df9110e4aca21c3fdb1ec6cbcece27fc708151e495198143d66

Download Submit
C:\Windows\SysWOW64\Kpmfddnf.exe

Filesize
57KB

MD5
67d4e4133276070eb94268e5df8e27e5

SHA1
74a951c5dcc5bb83e81a36fe82ba7b6c47a9cb3a

SHA256
eb42414e9d18179923ecfb0718b3502e3103adb5ae5ac9f86d450ed11c647cc9

SHA512
52fabaf529024f34c935beb71ffb69695d2e6882ae386da3b81215be195de05efe0e6375ef75ab49256d24b51287880cc67e28d810d38a1ae338403f06e47d38

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
57KB

MD5
27666e0671da3d26d3bf0915fb1b8161

SHA1
ce2ece8416aa4e549757d184cd5dc992b5d41263

SHA256
f534fe553b6cdfd0692a6fe7b2983e42db6de09448514602f8fda96798663a73

SHA512
b73c120b26ec692aefd9350000b38b1acd4fa27c09b2f6c02592f5c60f3fcb78cfd5315d93f6b6c75f45cc00e4d8ec92fd88e5a1fce97d2a80af6635a5df354f

Download Submit
C:\Windows\SysWOW64\Laciofpa.exe

Filesize
57KB

MD5
cb3b909492b78136b316ea43c69c7b3f

SHA1
8c0ab2d8d8d829ec25a64c1140b4cb5466592d74

SHA256
4fe8f8d121e0715ef1ded0f1a9c85ef3080943528c61d79f8ae69803d4706d5a

SHA512
f348d8166992a6dfb3e82cf9b740d9ce9c137bdca938d4d86aca55ca9ba8a6d31faad41f8f340e17fce8c6723d3bb074d11854ec298a0b76521f4efc495268ee

Download Submit
C:\Windows\SysWOW64\Laefdf32.exe

Filesize
57KB

MD5
d9f240e90dcad52b743b256285613cf3

SHA1
95a5d94c5184fdcb03bac2c8f61b64ff6f68630c

SHA256
3a0fa15d4656199214934eb8ec7b7d21f3e2fd439416399576aad4de49a0108c

SHA512
4b5a96d0dbe1169ab2e7a0610b6369af5cfde14ff0308934e4cd6d1e825fdfce98f21c3395d6e7eefa48a46c5fdb500da6aed98cbcf20af676e8c3c3e8d97d18

Download Submit
C:\Windows\SysWOW64\Laopdgcg.exe

Filesize
57KB

MD5
5ec6abfd5f5f32771930a39815701795

SHA1
fe11a22910370cc2f237fe7dec6db64cab930103

SHA256
6d90c8c8f1b050e54ec9682beecf0eaf4614f010d8304b318ce1050c36de2f7f

SHA512
c67e81e86f3c84da61c71250255f3e38989e5588eb9ec08282c97124cbf72867d95b5ec0f20a764a82db579162591d846ce0e8f3e42e74235271e6533be27a7b

Download Submit
C:\Windows\SysWOW64\Lcbiao32.exe

Filesize
57KB

MD5
dfaec3bc04dff2d9e2a928465283d731

SHA1
b5d93077884cf24967feec4891b09861f953e03e

SHA256
ef5d66798c0cfbe5d11f651ab4e6c9dbb4b61054577595c0e76b6b1aa99048f1

SHA512
7b4e3440d0af6660058ae2adc8aba8c5636de9585aa8dd8aca25db371d2e79f90027b9e5056fe0903002b660d90d8dad3ad4a28f0762b9b189feee5afd318874

Download Submit
C:\Windows\SysWOW64\Lcpllo32.exe

Filesize
57KB

MD5
123d5aca28e5346d9efe86266e5f66f9

SHA1
0d666d7c1914fd4ce8dd368a40614e3eadab9ae2

SHA256
9bedecee0ab94e8f3fd12f19c148ad7e8f0bcd05bc927be72bcabac8fbeb17e2

SHA512
3af8d4c9342436d4cc388e143d5448267bbb73f2e66796112abe4923b7dc1a81bb5a06d20f4e258e71fc21f86eeff438a4fc82da52bf5992ae6986a44dd25566

Download Submit
C:\Windows\SysWOW64\Ldaeka32.exe

Filesize
57KB

MD5
f8aea33fbd710753e02fe92a433a6aaf

SHA1
acdbe76b8d0cc33ae63b05a4a4f9d56eee011597

SHA256
8b7a35691ebe066f871c0723f26be43104e4be48ce5af0788e67263e25ecbe50

SHA512
bbcdacb65879b322201e4f9bb6f587af15515db8dd90bda21bd123db28b9e8b84e35ba1f043875a70701db8da7dbc6592d9c497f5fe34a8a44581cd835b4eba1

Download Submit
C:\Windows\SysWOW64\Lddbqa32.exe

Filesize
57KB

MD5
fab8c79fee4ca515f0e1f858960bdf83

SHA1
eec920a6b52699d2e5d6684a93157ee51a423501

SHA256
f3954e2ed7500b8e01969e8eff3b1b44fe2876b39aaeb1d192a2da8f5e1a298c

SHA512
747274239d57399d9e649d91f98edf7fae457cf6ac53e6a7d2ed46efefb36b2f7021d8dc8f3526780c82f2cd8c527f57c80bb4983c8c989149cf2f2e019f2750

Download Submit
C:\Windows\SysWOW64\Ldkojb32.exe

Filesize
57KB

MD5
46d1db7abf3ea1bc4d3eca878b289723

SHA1
8a550a76f98bdf8f2f64c31d0b6a27b1486f6114

SHA256
990b59f3337590fd7c6a91edd577a86dbb6471bfb729aef621786fc18bd828a8

SHA512
a272b56bdd958c9696d0afaba547c948655457077bbe684377d3b31b0eaa24edb65e21c590034fa8e8dc1b97844fb41cf13a75750714a59625e286fd0794aab8

Download Submit
C:\Windows\SysWOW64\Ldohebqh.exe

Filesize
57KB

MD5
cc64d4e20a1d042940659a54e12a2f0f

SHA1
a1573937805b6c3f84b3dc3f4d9f67d8d88d19a8

SHA256
55358c23ac3b82009e6b7e11d5b7ce8dcf62ac1290a3c0b0902538b4231094d1

SHA512
84bba75339a77c5c810c57ebf3b5c8823f76e82e8a8cfc9312e021fa50c9ff3d4e4fd93c0605622b56f4a64c0a87e4a7b8f0c6bc6d6ce0df8be8652a6e6a591f

Download Submit
C:\Windows\SysWOW64\Lgbnmm32.exe

Filesize
57KB

MD5
524283ad8bf8e95845e0847a9e3f9694

SHA1
4428ce46f0fa7f40b489339005213940b703add1

SHA256
be6527e9e49394da9ae4d538616108cffbae3aa59fe66c21f2396b22303e4823

SHA512
e33eaf20087f89d43e3776d294c2ec9ffea49a0151112114035c0aa4d0730571bf1ed6a1dbe153300d47790eabeaf2d6df89b9d1338f5b501a46ed037fc0ad30

Download Submit
C:\Windows\SysWOW64\Lgikfn32.exe

Filesize
57KB

MD5
5a4966c5dcf55ba9af90ead79ed5f48c

SHA1
c5041eb81140ec0a6e0131e58e8d9c1d518ab2be

SHA256
9156d55b18a3b2960179b06c136a7df4fa2dc68ba24008e5cb5c61f5f53dfea4

SHA512
e467d5ac922982574228a9f8a05c654a44fecde2d8b1bcab14020568e6886914701ee7e04b505c49bb4345b793d7b89b3787d2172123af666b09372fe543d4e6

Download Submit
C:\Windows\SysWOW64\Lgpagm32.exe

Filesize
57KB

MD5
1dbb7eab1d038e897ce8515f9a2f111d

SHA1
12abf57dd9b9982017c780316bcba3f96da7f87f

SHA256
66cd1096705d55b88a614d76681045672904ab48e08ac2fb685b2e353e732d50

SHA512
74dd3b3fdda63d50146a3af1db1df4f4044c9b7ffb46671e1b15bab931932ece74c996e6adb1acc43d3113e034eaedce3ebf0903b75f52826b9fa9d5b95c377f

Download Submit
C:\Windows\SysWOW64\Liggbi32.exe

Filesize
57KB

MD5
fe082f3f169e51e62d74334333447aa8

SHA1
6676d9fc9d949f4398f502d3ff1b62d068d5bcd1

SHA256
2ea58cbe540ec04d7d8e003f1b6ab103ce5d96a3f336ce1035118a38058471d1

SHA512
fb0900cb8f0be340dc0bef1ab46d4047315c12b70b93faf298822bad56b32adff1e54e1337789c93d60af09caa8279303799c87f0643aa8d687bcf6f9b8c0c33

Download Submit
C:\Windows\SysWOW64\Lilanioo.exe

Filesize
57KB

MD5
b133b55ad29c4ab15c3eb53e2d630800

SHA1
a3177bc4e5d3b52b17264b47e93281b379548987

SHA256
f629eb3819a2db535f113bd8aac7787ff237e26188ccb5f6c889f3e8c462d135

SHA512
992989a2a73dde609029261babdb8e0cf02d1116894bbd0bae071da82f8b5e4b55ec142cc93c82b663b265a541f1f3b50acfd87aae862c7fe120f0bf919fec1c

Download Submit
C:\Windows\SysWOW64\Lkdggmlj.exe

Filesize
57KB

MD5
6474caf0f07fa8b97a64f543223f76bf

SHA1
70c8f01497d440026883f11daebad0dc7f0f32c8

SHA256
190863a4e02e7be73a4e246d7069725b835d9ff82cf4de71a4d97186518ac978

SHA512
b83e6b9952e1cd7c064dfba0a745cb07d7ad9a214f4e0763e52afbc67d0542a4993ba0721d44c9c14fa4a4b11cd354a4e2e7e292a7a70e74015a20f0544afd6b

Download Submit
C:\Windows\SysWOW64\Lkgdml32.exe

Filesize
57KB

MD5
84b3b63a6b11555d03f3f42176a4057c

SHA1
78320aafe3d8565e48529f752e5bfd678c41ca33

SHA256
1f8841246ce0db9ef5f1ba7e9c2f051fe5dba4902dab1b802ca86266cd446301

SHA512
0208af64b96d54cc0a8e5d2e12fc205c2235f38624ef0f81fa268e44cf3dbe85f22370c968873b6b6b6c6bd5318d966204702067e889cf4fd6d591afa8472788

Download Submit
C:\Windows\SysWOW64\Lkiqbl32.exe

Filesize
57KB

MD5
dd1d3e923c63a0847e56bb163edc06fb

SHA1
5be7b00269b70c687144e52bfa72f9af6e8aef63

SHA256
633d55f3d74e67c24e220a1389a627ba356d226b7120adfa3d621f21f6987e08

SHA512
2b75a7de03c5d1fd0f2a2a51314c24505427b67fbe1a0812db33173d9b5a5c09661e3dd5bb33e977542f59274c7bdefaac2b4fbbc99a5bfc2f9ad7ff4c4eb5d1

Download Submit
C:\Windows\SysWOW64\Lklnhlfb.exe

Filesize
57KB

MD5
ae1d83ade4b945c8a73d702ed8bcc90a

SHA1
363024d579b642c8e6432bd8702ce19718803547

SHA256
98293481a708449fac3f9caff4223c462fce3ad8566caaa8d0dac42a8a406868

SHA512
af03ad5c253a8f38ce3546b76e8542a1b8f37419118b5fb640ed9d3605923a9d80b6173e1cd87fd47210708baf0513b015cc3b456e37acaf965ecd54172ae2f7

Download Submit
C:\Windows\SysWOW64\Lknjmkdo.exe

Filesize
57KB

MD5
5d1675ee3ae7fab8fedeadf6a7b78fb9

SHA1
5016622f29ad574534ebb1a5cf23fc95014f6992

SHA256
d15bed2dc44fbd5433202244c9ab6266ead44621539d1cd403dc525936a5678a

SHA512
e974358e501a34924ebce29bfcd1555baff788c49e7a9d4cd0b7818b3bac0ea019ce4219336e234c8a16d972bff783547757c257c58ea02ce674dc05c4dd5951

Download Submit
C:\Windows\SysWOW64\Lmqgnhmp.exe

Filesize
57KB

MD5
ee6aab761fca315ccf07070184c398c4

SHA1
3af522545d1245f45858cba775379d264895e525

SHA256
e3b8f6b7fc703ffb9bddd71fabf4972729635ab19bcfbf160aa23f12760aebba

SHA512
e749d3beb0bc510bcbcba50f85938badeff2aa51606a7fca7bbd3932e603afcac5306965779890a2e15a545680f35af4d593855ec51a20226a072a9ec6fc5849

Download Submit
C:\Windows\SysWOW64\Lnepih32.exe

Filesize
57KB

MD5
12c26035c1e85507a31e21d6ae506b65

SHA1
f56cfbf65848e50b4363630e00d191e77fff0332

SHA256
33d054f595a5c60441082c7245431a0fe165896531435ac1334fa849580717de

SHA512
8a100e9a3cdcfcbc04f73e0c580629202df52c65a38ffff7f5ad1958e3306a59c1abf9b9692ae33ae88f7373dbdc4a758f8cce36f142e83b2e629f2c3a9114c4

Download Submit
C:\Windows\SysWOW64\Lnjjdgee.exe

Filesize
57KB

MD5
b33202829d95994fedb480fd51ccb40e

SHA1
e1258a88d1fd3e447d580af82e65bef5215257d8

SHA256
715f9d9aca519282aa609c6df890a535f415edf4b6fd998c19bd1b91f0939d8c

SHA512
134a64804f8fc88f5385f122050ea885468cc393984c9f2e34e70633a8ee537f7fd8ca9d7f6f43db6297a877a0c8711005228fc45a51488b2b5067a5e4dde6a9

Download Submit
C:\Windows\SysWOW64\Lpappc32.exe

Filesize
57KB

MD5
d6277d60ef5dba2606c76778673d7acd

SHA1
e4c57663b4cd218ebac131af92d2e88f69d26bf7

SHA256
b14d2598243185f4c66c024df16894dc841816d12139f40677c5f546c65e483d

SHA512
399d91f0a9e2947167bdfab2952bab626664a47670985e8b82c2ee10eaa4411971cf13214c17192134fef4ac465de8a04cff2a563a55ca5794498bbc97535c0b

Download Submit
C:\Windows\SysWOW64\Lpfijcfl.exe

Filesize
57KB

MD5
8726177a2a824df7a969b165aabe0f22

SHA1
07627520180a71244fa3920451293f9f7ecca356

SHA256
d10cbb3e84c6c986948beddfbbba731efda1c06967c9a4418a20b51468d3ea73

SHA512
75dbe31405bd844c9372b47004d1562070e1b471ad113314becc145f53284619b45be44ef1ad52ac1438861180dcc99415c7a2dcccb32b4130f75cf29a93b9e1

Download Submit
C:\Windows\SysWOW64\Lpocjdld.exe

Filesize
57KB

MD5
46b50fa4c77c511161a8ed9a2bcc792a

SHA1
c9ef0e2b285462148d2bbbdba0e4718d4d0e5ac9

SHA256
dfe51f4c83ed711030ddee55dd22c74774cd5aee9354d3379d99c6d88cbd2160

SHA512
b175e2107d6a02ff1f92f76708a5cd5a429e94b87ac14a139b158f11e20a75816fed0dc3a760eab12d73013fe9fc7cc649b19d09c779317a0ed309fb7458d4c2

Download Submit
C:\Windows\SysWOW64\Mahbje32.exe

Filesize
57KB

MD5
b967d778291fa2efcec9151660874286

SHA1
2fb264df7acc5447ff406e2684afb3f7810ac465

SHA256
ff4e561fba900fbbbc9aeebea78f7bf09401fc72dc21183111c2a2da35e6f552

SHA512
db0a7075d95089388ae950a40c42ab6b14752799ba381c6c29091db9665bf761e0d965687e01a19f8751579436fb4ff7aa9f6cd1d4882567e1158b60226ccbc8

Download Submit
C:\Windows\SysWOW64\Mciobn32.exe

Filesize
57KB

MD5
498c6d059000e13f2ea0f625d3977950

SHA1
8ab6155c7f040660d9bb91f8e0c27264547146d5

SHA256
46355c33a2bdf47677352020eefa9a6c14e788972f9a88febe3a138f8126ebbd

SHA512
46768091ce5fe3a0cd12d3ad695a7c909e8246af7a2d7a29c8fd3e68c1e1060af927acfcddddd2dd8ea42b6f278fc05088c6b90bfb7910931a25b1e9baaff1dd

Download Submit
C:\Windows\SysWOW64\Mckemg32.exe

Filesize
57KB

MD5
45d43ef206500aae7d81195afcbb6d04

SHA1
5ae90a3eb678b73cf200603712f6ac7721175bda

SHA256
d2b70cb41aa8f8275dfcfc9c5c7834b212141bae1aee754b28a44fed371472e8

SHA512
1d280b114c0e3be2190e2d8813d84d2821828ac19d4998a4074b8ac9524bb550286ec05c39e70604c7f98869f24bd9775250a34bfcbea6adf9348ac269593da5

Download Submit
C:\Windows\SysWOW64\Mdkhapfj.exe

Filesize
57KB

MD5
1ea48549809c07da55b4027678cb04f2

SHA1
bfc7a3f9986900fbbe8785c4f7aa66e9b570d7ce

SHA256
0c0f672fa6da44f7ae0bc6adda387924337f054e61b2e376116393c901b296e9

SHA512
df75c3cb37da57f1474ffb3db011f15e7a270ef994c6218199d5437097500b02a1bb4de456dc54584307918714da901b8c977f7536517d726bca1c0098c5925b

Download Submit
C:\Windows\SysWOW64\Mgagbf32.exe

Filesize
57KB

MD5
f31b7d45c151ad123e7b83f6ecb8a8ac

SHA1
dadf37fa7f3814dfc65e71292e5031b5fba542e4

SHA256
83373246ad6441c75938cd1854fe1a1b97d04eddb634f02ce8cd647c948f6215

SHA512
969f6ea2d95483337930c9382ff5db245072a9cc32cb1fa6a3205f60ac2859cb9ab65340406f41bb0f82150118769c771a16de0c0587afdbd32368c9c6c26800

Download Submit
C:\Windows\SysWOW64\Mjhqjg32.exe

Filesize
57KB

MD5
2cd7e230181c0138d72f3b7ef8dc4f43

SHA1
ebf655d98c2ae5066c85f57fc0be03e60f543c01

SHA256
88cbce889fb3992efb792d02f73b24f86a9968ed131ca2e750dd582450e341b6

SHA512
6ea76caba547ffe608852ce42c5299c4b32cf0fea9827e941d929b595032e7171d26ca1d85d7264e7fee7dd45f05629de3a00e0dc0967a59817ad4227691608f

Download Submit
C:\Windows\SysWOW64\Mkgmcjld.exe

Filesize
57KB

MD5
09fa5e922e183e45898c93ab24af97c7

SHA1
94656c8f03325e042f165de5635d19201d7b9fba

SHA256
ecfb3b06e66e2eac15f43a9a624836b8975f60304de1adff54e43515e28ad5c8

SHA512
fc9acc1c852bccea6a425cd3f60614368c5b4177d081bcc3e0726b8f55638c700b43e60788270c5de9e5809f1243f58fc0f7ee7301216da545a8e788a3b690b9

Download Submit
C:\Windows\SysWOW64\Mlcifmbl.exe

Filesize
57KB

MD5
17024ec919086a24edb91ee2715ebafe

SHA1
26731693716a68a8de8edcd6c78f469d73712b16

SHA256
326646a8bf039ccb594c2eb9fbe46df192ae26f3fb326d25e6c083b4f1b1c408

SHA512
2a2020150083c69acd9598bd46165a14b3d57a882c16bae28a2a320c55ceed51c6c339b530440553d57800db53aef29f637a97608315cc7a394be89a21d6c8d3

Download Submit
C:\Windows\SysWOW64\Mnlfigcc.exe

Filesize
57KB

MD5
0cbdeb402c099c54f86e803eadaaa0d7

SHA1
2e5d36d8a6986b483919d36c8320ecbecaa5cab8

SHA256
351cb25f8b698d1232fa24a152acb503ce8be1dc1541b5a909376734ce9f0756

SHA512
9a7492876e728b4571439a3c209bea77dbce85cfccf40d68e71bd9ab75fd5fe43e040cdefc82bb754cd9b82426515aa2c557c34615d07581afcaca64472e9b08

Download Submit
C:\Windows\SysWOW64\Nacbfdao.exe

Filesize
57KB

MD5
2d42aae666b608f9d77af981f282c75a

SHA1
b38a93e04eba637143a89c4dc825464d40eb7209

SHA256
ae64c04c39ea573a2942073fded716f4ccdc1a2eba5b7a33ec75b5d3d5badc77

SHA512
02dd1a012c4a680e32fa938dd083d83bc87b4bd236926597b3303b0c8de59c590a3e31c5b5f5ccce8da1e93693f4758402f60422fd4c1956c360f7fcd715db8d

Download Submit
C:\Windows\SysWOW64\Nbkhfc32.exe

Filesize
57KB

MD5
ad1a922d14ab64fa12f21697913ef8df

SHA1
9aecb31050a679cb9fdff0b3957680bd9845c8c9

SHA256
290448dfbee7c95380d23f650cc2161055d0e845340055014b429a3a644263df

SHA512
4fa254bac11c0a3b4651e1d48eaadcc7059d1f4898812f64e180cbf79ff6b2f43f077316973959fae92cae56c488a5ee5b0ee2f34e64486d52ddc74285fc5f80

Download Submit
C:\Windows\SysWOW64\Ncldnkae.exe

Filesize
57KB

MD5
2c0adfe190679812801a9afc875807e5

SHA1
f529eaa25c7204b10f42c6495ce31b622421fcca

SHA256
9469024e9964bb24e6f1491b4ee05fe5cee6f2f559e2caa9cc5a384aa04989eb

SHA512
4c5e1ba6088d6d1709d344dad38f66d52ac5182f6a82842b03dc9b97e37b7901f36c98877d2803e6639b5ff6c8c937eef1d54bc5572bd5bb9aa5c57c45098d6f

Download Submit
C:\Windows\SysWOW64\Ndokbi32.exe

Filesize
57KB

MD5
c1b6c359dd7104c4966035a4af1da41e

SHA1
ae2a7e1e2fa95d3a2468603026af389d50415b1f

SHA256
c0edd71e851876b49d60cd166e2a5a21b01580296fdff8ddc1d78c247e68b848

SHA512
a4f7699c6b2efa84bcc5ffe9284ff22628ba4297365c0a2bcb089be8934295702d9e08981992a5cccac3cc701fe0b5b4d5e49f33346c07869bd67b77e370024a

Download Submit
C:\Windows\SysWOW64\Ngcgcjnc.exe

Filesize
57KB

MD5
30e0f3e12664b8d0b3921e7b60b541ce

SHA1
fd05539bd1ac025213391c2396d13d84a5be0e01

SHA256
18367ebba92d56f6ecfbf4005feb4d63571a38cf4b1c4655deae040ed6789e85

SHA512
eb017676454a332520116d2c671a6a9e0f07716ec5db90fcc1fc262b4166f2f7c6a219696408f0e3e8cebaa90e688acc3ee0839552a50b53d3f4c1dec43f4d73

Download Submit
C:\Windows\SysWOW64\Ngedij32.exe

Filesize
57KB

MD5
5ca8e9140852019fb29ce5a9ec34654b

SHA1
5316361663cdf279367e2fc26a46b9c24685fa4f

SHA256
8c188ede84511cb5198d0721bf0294f1e4774401d2579a5d854cdcbc72540ec6

SHA512
6ce5633ef1e3ddf2bb65848a9200e6923c6717788d398399d6296a775203da848f2011f0960656d6694c82fc8a281d57695bdc6036cdc9444cbd5993004767d8

Download Submit
C:\Windows\SysWOW64\Njacpf32.exe

Filesize
57KB

MD5
153bc264b1fe16c3f2a71657717cf7fb

SHA1
680edd2452dc5ca67d4ffaf5e01936e0ed4e717f

SHA256
a2944dddd5cdd96d2afbbda70d306da6696c6e7c96683d30ecb168b556c4815c

SHA512
66fc7158f3e066348356b409bb4d4c444e12dbd66c9a656cdbae8d02985443075ab7aa230dac1de8dbfa762762f54fe40187aefb53598c8f79f9e459b362e210

Download Submit
C:\Windows\SysWOW64\Nklfoi32.exe

Filesize
57KB

MD5
5c90e5be4dc5c8a79f8d15ebcd99a1b2

SHA1
af1c07f00c979e457f1ea088aa64d860c793f3ce

SHA256
e53f8def11b32a160de8475120764075c3a81e5c907e7f152a09ccc000400ad7

SHA512
810f6404779518eb735df9eab4ab831b5cdda6c16b4efc7383024bf92b5d51e060048df820917fc3da1d13b94c290d7c8476cb4a8ae0c6442bd40d61564bcaa8

Download Submit
C:\Windows\SysWOW64\Nlmllkja.exe

Filesize
57KB

MD5
a8e517c4c3927366a264bfa7dae52b3d

SHA1
ea76d38b2cfbc63bbf92e5745be7263bf870e67b

SHA256
b36b5c8e23a419dc0bda1826ed184b5affe5c5e0bceedda83b2d0af54d1f894b

SHA512
145365a6854d9db2ef9eb78bdf4afb022270ae16daabffcb5968a5315cd1c6faab3773fe87efc55f36bb51759f0712f6e8ba7d1e60f215e5d467f6c69e11e0db

Download Submit
C:\Windows\SysWOW64\Npmagine.exe

Filesize
57KB

MD5
eba9b0e31c72ef22e457788458d25eae

SHA1
1bcd2a26fd5401c18704d1e9e66acd3e2ba26d4a

SHA256
f9113d97b0b4459dadc88e4137bb2ce4daa08bdb4eee6c1687937f29f284bae8

SHA512
89caf71e5057fd13179f322b05d4f19eed3ad0e35e963af42d5158540e4f78bf33b7860eefac07a77d4532622c1085d7e9eab5397284b8529a1a8c4437679c79

Download Submit
C:\Windows\SysWOW64\Nqklmpdd.exe

Filesize
57KB

MD5
2f3a43966f88421c45da437570e86044

SHA1
b41a5d9f8ac1dbd61a306ae084994e496dbc250c

SHA256
14d9be8bdc67575834146fea27c6f84d4d32a7c99630454a3b6b039b6b5ea3f2

SHA512
32d1a00091b25c95d0df098c926e59a3646cbf93bc2ec35d9014fecfe4345ca353a133769a7069c93e35425ed228b6a2943680e5697cb17b857961540c969634

Download Submit
C:\Windows\SysWOW64\Ocbddc32.exe

Filesize
57KB

MD5
2e047973cd6d90403b5bca82ac80ad19

SHA1
7b94ad60d5e766d0f2b7ed67ee1ffb8d649b44d8

SHA256
96a2d09797d1fe7de67e1a3c5b4166568a2fec10d2ceb6e259d45d4bacee5179

SHA512
9d7be9d78f3c56a3e98fc5d431d0cf9119555902486557bb8a3b090ed65a981f893ab6d80d97e4dd788a79b49f9a54207b0f9e6f7fe466825c07e989c9b94d65

Download Submit
C:\Windows\SysWOW64\Ocegdjij.exe

Filesize
57KB

MD5
b72414e7e4e0b7753c35ad90b054e9d8

SHA1
eba9a01f265da0a559e2d1ef526fd5f421b54bdb

SHA256
0f6cb912ebdcd0b2325c5b756640f9f9f4c31d5e5507a5e2e99f96d5b9044691

SHA512
fe2f66f1706bfe48bdf9d567a13355158ac552bb71b3118980926a8041dc3fcd6493081ce7c38d1c5dec0065bce4ffef3c1b8f403a72e854d4558e655506c0bc

Download Submit
C:\Windows\SysWOW64\Odnnnnfe.exe

Filesize
57KB

MD5
f29953f6cdee76a1d12074ef62cd895d

SHA1
63e3159bdf7bd2603a3ba577b4a6f34ef0857023

SHA256
4176b4dac4df67d8dabeca8faf7257b50d20cd1398519c5d8264bdebdb33d048

SHA512
090e6259c36c1e87adda9202b4f0a24292049cbe5804f020da5a89e755987ab9221bdbb55fc1f8772f07995218ce2a615b56804fc9ed7637412eff522851b2fd

Download Submit
C:\Windows\SysWOW64\Ogifjcdp.exe

Filesize
57KB

MD5
50b22a152555d1b06952d2a8e7b0675f

SHA1
85c32efdd8768c4b43c732115c3d5f223c49eb2e

SHA256
26887c395f2c6ba15f08958ea88e6b5a69037e71321c1abf7ed0f4df2658a451

SHA512
f9b0499c3482b135f15291db8488df1d2b13684e074d37d78a803ed69f9d734fb43e866070120602108ea777b06eb72de1b6f3b006dea50b8f68e2620fcb0f80

Download Submit
C:\Windows\SysWOW64\Ogogoi32.exe

Filesize
57KB

MD5
2230f15dd93156d4336d6d7a6ad21001

SHA1
f3f9062cee74fd18c6a91b259bae2e3fd85ccf82

SHA256
293843a0e37e2aee97ed568ac2254cb45a871027a69f788fc676e1ec7e8db761

SHA512
3ee0184dab79da442d0ee5bfc7e55e93c9a8ff10f15131963f8b2b459887986291a6fcbc3ccfa027be6a700565c74c2a9e754e8c80e0d0dc05e78104df9b9eeb

Download Submit
C:\Windows\SysWOW64\Ojhiqefo.exe

Filesize
57KB

MD5
1b1217810b485c059ea44922206aae75

SHA1
3d24d1f9f6cbb7b892a4d7576d924f7ab2acc6eb

SHA256
e52779918a96c27aa205df1ad3b2eab1621e09569c81972e59dcb20d7300745d

SHA512
26527acf7eb899e6bd0a771dedab53510e54b18cddcd49966e0491ecd1b826205aac5979946880e92589efc4b64a9c8650368d3f056e675f073732e2c79d0cc1

Download Submit
C:\Windows\SysWOW64\Ojopad32.exe

Filesize
57KB

MD5
e1858995454c1809b9ec77775b240a22

SHA1
e43cba79aab752596c7d7070c54082c95aa72aca

SHA256
a90fac2c3051c5c26994f3ac95ce3c9993ee1781a65f8a6f41170f5131f2287a

SHA512
37a00c161f22121a6a2c14fd4d3b89472f9f10533e4668dbbf79eeb89b83483f7ac0953d4e96cbb3a4138f0dd02074170eee0e0431ba8eebf498702b49866c45

Download Submit
C:\Windows\SysWOW64\Pcagphom.exe

Filesize
57KB

MD5
35bb5cf3e47d86dcc35559561535f713

SHA1
744ecb49381d39732e868d1b13ee4928423bb4d6

SHA256
6e0c0933caa23278404f5b6e14cec019fc804208270a7981cda9b7977383bf3f

SHA512
5e4ba541e1f8559ed52a3005632aada75439a41a03e568045f6da4539f53afe6867c72c37a25ec56a6326b326b72787573dc14b4becac518765b6a0efe830372

Download Submit
C:\Windows\SysWOW64\Pcjapi32.exe

Filesize
57KB

MD5
9e4c5085ecb7496e480836a7e579b87c

SHA1
b70bae5aa5eaea1e2a1527bce0733e86845036a6

SHA256
aa77d2536dda2bfea02354246b989be62a512b0d401c70f6b293679432bd62e8

SHA512
f398000c48c20e5afc3abdcdabad361abe38069200c4db9b2f8a394c1b3252252ab7068a60809ff6f04d5a884cc12a9e80898a0d36308f86cae679cbb5fc7716

Download Submit
C:\Windows\SysWOW64\Qjpiha32.exe

Filesize
57KB

MD5
125f04bcc8ea6a98f97cfd2aed59a3c1

SHA1
c3eeca4d4aa5cc6bf8623df50873f3488b968d56

SHA256
02b8d1e3a729aaa943bd657568c75bcd25447af2cbfff05b2459e02ab07dc0de

SHA512
bfbd03cdc5c5be0c9055f0be4b8c6ea7359ecf6c8d2acefefd0ec4a3660dec1ec05f5918160158c3d641ae822e798eaef0b56e9e2757446f419edbb4e4bce76f

Download Submit
C:\Windows\SysWOW64\Qnhahj32.exe

Filesize
57KB

MD5
e77450d41d195265f4d4c39bdfec9b79

SHA1
f683cd9bed6ad3c5adfd6adad093fc7927405013

SHA256
105cb48e8ae93431f3feb5fc8e0e978a7d4eb0de8377f040a263899cabff9019

SHA512
4483839165b8a9335ea4869df5dc2d5f2975d6ce2f0b57039ea199fa5c6fe1ec4abb088c40a04e10cecf98befbb0158d9a9982575306206fe3875ef22ee58f7f

Download Submit
memory/228-49-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/228-582-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/376-432-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/664-330-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/744-354-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/764-293-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/824-287-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1004-121-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1008-93-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1120-182-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1144-241-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1424-460-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1512-534-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1512-5-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/1512-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1616-283-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1704-370-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1744-376-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1768-233-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1804-17-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1804-554-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1824-25-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1824-565-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2036-418-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2052-145-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2096-462-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2156-498-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2196-97-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2212-257-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2216-547-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2216-9-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2232-209-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2244-424-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2332-77-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2436-275-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2468-274-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2584-407-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2644-524-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2708-168-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2800-105-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2832-589-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2832-57-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2892-539-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2964-299-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2980-569-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3048-583-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3104-153-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3140-204-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3168-318-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3272-555-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3284-378-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3380-528-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3528-310-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3616-192-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3664-312-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3680-390-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3700-438-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3708-568-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3708-33-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3720-137-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3764-112-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3796-248-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3836-481-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3912-426-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3920-548-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3924-396-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3968-510-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4040-384-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4072-353-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4104-217-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4132-541-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4216-450-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4292-567-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4388-300-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4404-496-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4408-490-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4436-447-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4488-81-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4500-225-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4508-328-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4552-263-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4584-360-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4624-474-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4632-580-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4660-509-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4700-342-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4748-336-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4764-468-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4768-161-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4848-520-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4856-129-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4892-69-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4936-408-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5004-185-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5096-579-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5096-40-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads