a133f8e63e5c21b75e14cda7449c9683abfe301962ff218c6b9f1801abeac455

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28/06/2024, 16:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a133f8e63e5c21b75e14cda7449c9683abfe301962ff218c6b9f1801abeac455_NeikiAnalytics.exe
Size

305KB
MD5

ed31ce77ca10bdf91eacfb05b5505060
SHA1

1868652370f6302336645f4fb4f855fa150e7519
SHA256

a133f8e63e5c21b75e14cda7449c9683abfe301962ff218c6b9f1801abeac455
SHA512

95140f826c99be63786ebc469416b3f63ffb3a7b249b4d5c822e3bc7225e34e79c30b8fe8eafcc877183e3fd42f4a39c2457bf4735978e95bb0ba020fc8f2aed
SSDEEP

3072:pKhyNCq8NQYyMhl63Myu+lc802eS5pAgYIqGvJ6887lbyMGjXF1kqaholmtbCQV1:pNCqwnkPlc85dZMGXF5ahdt3b0668

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Flqimk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eocenh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Febgea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlednamo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jkfkfohj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onmhgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eoolbinc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogcpjhoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gcimkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdkldb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kipabjil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dlncan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhgjblfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hkkhqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Neeqea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ljnnch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eefhjc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldohebqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Obdkma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdckfk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	a133f8e63e5c21b75e14cda7449c9683abfe301962ff218c6b9f1801abeac455_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjhbgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncfdie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbfiep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qbimoo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlkagbej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chghdqbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lalcng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Onfbfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbbgnpgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aejfpjne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cbjoljdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnqbanmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojopad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dboigi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbgqio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Flceckoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajkhdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jianff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfjhkjle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bcebhoii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbimoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjhbgb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkepnjng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpojcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gokdeeec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iikhfg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aldomc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncihikcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjbena32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gofkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgagbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgmlkp32.exe

Executes dropped EXE 64 IoCs

pid	Process
612	Jaimbj32.exe
2400	Jidbflcj.exe
2092	Jmpngk32.exe
1532	Jpojcf32.exe
1456	Jdjfcecp.exe
4000	Jfhbppbc.exe
4544	Jkdnpo32.exe
512	Jigollag.exe
2468	Jangmibi.exe
1640	Jpaghf32.exe
2656	Jdmcidam.exe
4524	Jfkoeppq.exe
4280	Jkfkfohj.exe
4240	Kmegbjgn.exe
1936	Kaqcbi32.exe
1524	Kpccnefa.exe
1800	Kdopod32.exe
4388	Kgmlkp32.exe
1236	Kkihknfg.exe
3120	Kilhgk32.exe
2336	Kmgdgjek.exe
1680	Kpepcedo.exe
3400	Kdaldd32.exe
2532	Kgphpo32.exe
4616	Kkkdan32.exe
2264	Kinemkko.exe
3280	Kmjqmi32.exe
2272	Kaemnhla.exe
3572	Kdcijcke.exe
2260	Kbfiep32.exe
2276	Kgbefoji.exe
4172	Kipabjil.exe
3180	Kmlnbi32.exe
3268	Kagichjo.exe
3748	Kpjjod32.exe
4888	Kdffocib.exe
4412	Kgdbkohf.exe
1932	Kkpnlm32.exe
1056	Kibnhjgj.exe
1812	Kmnjhioc.exe
2548	Kajfig32.exe
4996	Kpmfddnf.exe
3000	Kckbqpnj.exe
1192	Kgfoan32.exe
3744	Kkbkamnl.exe
1892	Lmqgnhmp.exe
1908	Lalcng32.exe
5052	Lpocjdld.exe
4644	Lcmofolg.exe
4316	Lgikfn32.exe
740	Liggbi32.exe
1492	Lnepih32.exe
3520	Ldohebqh.exe
3252	Lgneampk.exe
2628	Ljnnch32.exe
3780	Laefdf32.exe
5036	Lddbqa32.exe
3112	Lknjmkdo.exe
3144	Mnlfigcc.exe
1548	Mahbje32.exe
3592	Mgghhlhq.exe
3540	Mnapdf32.exe
4640	Mdkhapfj.exe
676	Mkepnjng.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ehedfo32.exe	Eefhjc32.exe
File opened for modification	C:\Windows\SysWOW64\Flqimk32.exe	Ffgqqaip.exe
File created	C:\Windows\SysWOW64\Gjdlbifk.dll	Jlpkba32.exe
File created	C:\Windows\SysWOW64\Ljnnch32.exe	Lgneampk.exe
File created	C:\Windows\SysWOW64\Pponmema.dll	Nnjbke32.exe
File created	C:\Windows\SysWOW64\Cdkldb32.exe	Camphf32.exe
File opened for modification	C:\Windows\SysWOW64\Dboigi32.exe	Docmgjhp.exe
File created	C:\Windows\SysWOW64\Bapolp32.dll	Deanodkh.exe
File created	C:\Windows\SysWOW64\Bkjpmk32.dll	Amgapeea.exe
File created	C:\Windows\SysWOW64\Ghkmacoj.dll	Jfeopj32.exe
File opened for modification	C:\Windows\SysWOW64\Kdcbom32.exe	Klljnp32.exe
File created	C:\Windows\SysWOW64\Mnodjf32.dll	Olcbmj32.exe
File opened for modification	C:\Windows\SysWOW64\Mdmegp32.exe	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Ajdbcano.exe	Agffge32.exe
File created	C:\Windows\SysWOW64\Akalojih.dll	Cbgbgj32.exe
File created	C:\Windows\SysWOW64\Ijhkffjm.dll	Conclk32.exe
File opened for modification	C:\Windows\SysWOW64\Ibnccmbo.exe	Ippggbck.exe
File created	C:\Windows\SysWOW64\Bbjiol32.dll	Mchhggno.exe
File created	C:\Windows\SysWOW64\Bpcbnd32.dll	Kkpnlm32.exe
File opened for modification	C:\Windows\SysWOW64\Lpocjdld.exe	Lalcng32.exe
File opened for modification	C:\Windows\SysWOW64\Qcepkg32.exe	Pagdol32.exe
File opened for modification	C:\Windows\SysWOW64\Qajadlja.exe	Qbgqio32.exe
File created	C:\Windows\SysWOW64\Jjqehkaf.dll	Ddpeoafg.exe
File created	C:\Windows\SysWOW64\Lejfpelg.dll	Hckjacjg.exe
File opened for modification	C:\Windows\SysWOW64\Hcpclbfa.exe	Hkikkeeo.exe
File created	C:\Windows\SysWOW64\Jmpgldhg.exe	Jfeopj32.exe
File created	C:\Windows\SysWOW64\Qamhhedg.dll	Kbceejpf.exe
File created	C:\Windows\SysWOW64\Lknjmkdo.exe	Lddbqa32.exe
File created	C:\Windows\SysWOW64\Ocgdji32.exe	Oqihnn32.exe
File created	C:\Windows\SysWOW64\Fcnopdeh.dll	Fhgjblfq.exe
File created	C:\Windows\SysWOW64\Hkdbpe32.exe	Gdjjckag.exe
File created	C:\Windows\SysWOW64\Lpcqcc32.dll	Hflcbngh.exe
File created	C:\Windows\SysWOW64\Likjcbkc.exe	Lgmngglp.exe
File created	C:\Windows\SysWOW64\Olcbmj32.exe	Nnqbanmo.exe
File opened for modification	C:\Windows\SysWOW64\Kgmlkp32.exe	Kdopod32.exe
File created	C:\Windows\SysWOW64\Abbpem32.exe	Ajkhdp32.exe
File created	C:\Windows\SysWOW64\Hmenjlfh.dll	Hobkfd32.exe
File created	C:\Windows\SysWOW64\Nklfoi32.exe	Ngpjnkpf.exe
File opened for modification	C:\Windows\SysWOW64\Pcccfh32.exe	Paegjl32.exe
File opened for modification	C:\Windows\SysWOW64\Kikame32.exe	Kbaipkbi.exe
File created	C:\Windows\SysWOW64\Lmiciaaj.exe	Lbdolh32.exe
File created	C:\Windows\SysWOW64\Bmngqdpj.exe	Bcebhoii.exe
File opened for modification	C:\Windows\SysWOW64\Njciko32.exe	Ngdmod32.exe
File opened for modification	C:\Windows\SysWOW64\Pnpemb32.exe	Pjdilcla.exe
File created	C:\Windows\SysWOW64\Bbifelba.exe	Bjbndobo.exe
File opened for modification	C:\Windows\SysWOW64\Cbefaj32.exe	Bdkcmdhp.exe
File created	C:\Windows\SysWOW64\Clpgpp32.exe	Chdkoa32.exe
File opened for modification	C:\Windows\SysWOW64\Kibgmdcn.exe	Kbhoqj32.exe
File created	C:\Windows\SysWOW64\Dnkdikig.dll	Lcmofolg.exe
File created	C:\Windows\SysWOW64\Jbllbm32.dll	Pnbbbabh.exe
File opened for modification	C:\Windows\SysWOW64\Edkdkplj.exe	Eamhodmf.exe
File created	C:\Windows\SysWOW64\Geplnioe.dll	Fkalchij.exe
File created	C:\Windows\SysWOW64\Jkdnpo32.exe	Jfhbppbc.exe
File opened for modification	C:\Windows\SysWOW64\Pcagphom.exe	Pengdk32.exe
File created	C:\Windows\SysWOW64\Mjddiqoc.dll	Jlnnmb32.exe
File opened for modification	C:\Windows\SysWOW64\Dccbbhld.exe	Dkljak32.exe
File created	C:\Windows\SysWOW64\Nhgaocmg.dll	Kbhoqj32.exe
File opened for modification	C:\Windows\SysWOW64\Nnjlpo32.exe	Ndaggimg.exe
File opened for modification	C:\Windows\SysWOW64\Ddjejl32.exe	Calhnpgn.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Fibjjh32.dll	Ngpjnkpf.exe
File opened for modification	C:\Windows\SysWOW64\Bnlnon32.exe	Bjpaooda.exe
File created	C:\Windows\SysWOW64\Mhciec32.dll	Colffknh.exe
File opened for modification	C:\Windows\SysWOW64\Ocdqjceo.exe	Onhhamgg.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11576	11496	WerFault.exe	548

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	a133f8e63e5c21b75e14cda7449c9683abfe301962ff218c6b9f1801abeac455_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ehedfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpcqcc32.dll"	Hflcbngh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lfkaag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bagcnd32.dll"	Mgagbf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aeopki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmenjlfh.dll"	Hobkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agjbpg32.dll"	Dopigd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Anbkio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlcadgkl.dll"	Dboigi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmogab32.dll"	Dlgmpogj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eleiam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gfpcgpae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hflcbngh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkijij32.dll"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddakjkqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oqihnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjpaooda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eefhjc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdckfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpiaib32.dll"	Glhonj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jlnnmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Likjcbkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odaoecld.dll"	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgdpie32.dll"	Beeflhdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecaobgnf.dll"	Mipcob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnlhfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pdmpje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qnhahj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jchbak32.dll"	Lalcng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nkjjij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fchddejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnhjmp32.dll"	Jlednamo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfogkano.dll"	Onfbfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qbgqio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dhnnep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aomaga32.dll"	Likjcbkc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kipabjil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fbnafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lejfpelg.dll"	Hckjacjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpnnia32.dll"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdaldd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pnpemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ligqhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ceehho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Doqpak32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hihbijhn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Imakkfdg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pagdol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pglcddpd.dll"	Hfifmnij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kmdqgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eocqqdjh.dll"	Daaicfgd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3776 wrote to memory of 612	3776	a133f8e63e5c21b75e14cda7449c9683abfe301962ff218c6b9f1801abeac455_NeikiAnalytics.exe	83
PID 3776 wrote to memory of 612	3776	a133f8e63e5c21b75e14cda7449c9683abfe301962ff218c6b9f1801abeac455_NeikiAnalytics.exe	83
PID 3776 wrote to memory of 612	3776	a133f8e63e5c21b75e14cda7449c9683abfe301962ff218c6b9f1801abeac455_NeikiAnalytics.exe	83
PID 612 wrote to memory of 2400	612	Jaimbj32.exe	84
PID 612 wrote to memory of 2400	612	Jaimbj32.exe	84
PID 612 wrote to memory of 2400	612	Jaimbj32.exe	84
PID 2400 wrote to memory of 2092	2400	Jidbflcj.exe	85
PID 2400 wrote to memory of 2092	2400	Jidbflcj.exe	85
PID 2400 wrote to memory of 2092	2400	Jidbflcj.exe	85
PID 2092 wrote to memory of 1532	2092	Jmpngk32.exe	86
PID 2092 wrote to memory of 1532	2092	Jmpngk32.exe	86
PID 2092 wrote to memory of 1532	2092	Jmpngk32.exe	86
PID 1532 wrote to memory of 1456	1532	Jpojcf32.exe	87
PID 1532 wrote to memory of 1456	1532	Jpojcf32.exe	87
PID 1532 wrote to memory of 1456	1532	Jpojcf32.exe	87
PID 1456 wrote to memory of 4000	1456	Jdjfcecp.exe	88
PID 1456 wrote to memory of 4000	1456	Jdjfcecp.exe	88
PID 1456 wrote to memory of 4000	1456	Jdjfcecp.exe	88
PID 4000 wrote to memory of 4544	4000	Jfhbppbc.exe	89
PID 4000 wrote to memory of 4544	4000	Jfhbppbc.exe	89
PID 4000 wrote to memory of 4544	4000	Jfhbppbc.exe	89
PID 4544 wrote to memory of 512	4544	Jkdnpo32.exe	90
PID 4544 wrote to memory of 512	4544	Jkdnpo32.exe	90
PID 4544 wrote to memory of 512	4544	Jkdnpo32.exe	90
PID 512 wrote to memory of 2468	512	Jigollag.exe	91
PID 512 wrote to memory of 2468	512	Jigollag.exe	91
PID 512 wrote to memory of 2468	512	Jigollag.exe	91
PID 2468 wrote to memory of 1640	2468	Jangmibi.exe	92
PID 2468 wrote to memory of 1640	2468	Jangmibi.exe	92
PID 2468 wrote to memory of 1640	2468	Jangmibi.exe	92
PID 1640 wrote to memory of 2656	1640	Jpaghf32.exe	93
PID 1640 wrote to memory of 2656	1640	Jpaghf32.exe	93
PID 1640 wrote to memory of 2656	1640	Jpaghf32.exe	93
PID 2656 wrote to memory of 4524	2656	Jdmcidam.exe	94
PID 2656 wrote to memory of 4524	2656	Jdmcidam.exe	94
PID 2656 wrote to memory of 4524	2656	Jdmcidam.exe	94
PID 4524 wrote to memory of 4280	4524	Jfkoeppq.exe	95
PID 4524 wrote to memory of 4280	4524	Jfkoeppq.exe	95
PID 4524 wrote to memory of 4280	4524	Jfkoeppq.exe	95
PID 4280 wrote to memory of 4240	4280	Jkfkfohj.exe	96
PID 4280 wrote to memory of 4240	4280	Jkfkfohj.exe	96
PID 4280 wrote to memory of 4240	4280	Jkfkfohj.exe	96
PID 4240 wrote to memory of 1936	4240	Kmegbjgn.exe	97
PID 4240 wrote to memory of 1936	4240	Kmegbjgn.exe	97
PID 4240 wrote to memory of 1936	4240	Kmegbjgn.exe	97
PID 1936 wrote to memory of 1524	1936	Kaqcbi32.exe	98
PID 1936 wrote to memory of 1524	1936	Kaqcbi32.exe	98
PID 1936 wrote to memory of 1524	1936	Kaqcbi32.exe	98
PID 1524 wrote to memory of 1800	1524	Kpccnefa.exe	99
PID 1524 wrote to memory of 1800	1524	Kpccnefa.exe	99
PID 1524 wrote to memory of 1800	1524	Kpccnefa.exe	99
PID 1800 wrote to memory of 4388	1800	Kdopod32.exe	100
PID 1800 wrote to memory of 4388	1800	Kdopod32.exe	100
PID 1800 wrote to memory of 4388	1800	Kdopod32.exe	100
PID 4388 wrote to memory of 1236	4388	Kgmlkp32.exe	101
PID 4388 wrote to memory of 1236	4388	Kgmlkp32.exe	101
PID 4388 wrote to memory of 1236	4388	Kgmlkp32.exe	101
PID 1236 wrote to memory of 3120	1236	Kkihknfg.exe	102
PID 1236 wrote to memory of 3120	1236	Kkihknfg.exe	102
PID 1236 wrote to memory of 3120	1236	Kkihknfg.exe	102
PID 3120 wrote to memory of 2336	3120	Kilhgk32.exe	103
PID 3120 wrote to memory of 2336	3120	Kilhgk32.exe	103
PID 3120 wrote to memory of 2336	3120	Kilhgk32.exe	103
PID 2336 wrote to memory of 1680	2336	Kmgdgjek.exe	104

C:\Users\Admin\AppData\Local\Temp\a133f8e63e5c21b75e14cda7449c9683abfe301962ff218c6b9f1801abeac455_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a133f8e63e5c21b75e14cda7449c9683abfe301962ff218c6b9f1801abeac455_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\SysWOW64\Jaimbj32.exe
  C:\Windows\system32\Jaimbj32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\SysWOW64\Jidbflcj.exe
    C:\Windows\system32\Jidbflcj.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\Windows\SysWOW64\Jmpngk32.exe
      C:\Windows\system32\Jmpngk32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1532
      - C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:512
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4524
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4280
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4240
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4388
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1236
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2336
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        23⤵
        Executes dropped EXE
        
        PID:1680
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3400
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        25⤵
        Executes dropped EXE
        
        PID:2532
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        26⤵
        Executes dropped EXE
        
        PID:4616
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        27⤵
        Executes dropped EXE
        
        PID:2264
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        28⤵
        Executes dropped EXE
        
        PID:3280
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        29⤵
        Executes dropped EXE
        
        PID:2272
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        30⤵
        Executes dropped EXE
        
        PID:3572
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2260
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        32⤵
        Executes dropped EXE
        
        PID:2276
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4172
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        34⤵
        Executes dropped EXE
        
        PID:3180
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        35⤵
        Executes dropped EXE
        
        PID:3268
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        36⤵
        Executes dropped EXE
        
        PID:3748
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        37⤵
        Executes dropped EXE
        
        PID:4888
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        38⤵
        Executes dropped EXE
        
        PID:4412
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1932
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        40⤵
        Executes dropped EXE
        
        PID:1056
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        41⤵
        Executes dropped EXE
        
        PID:1812
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        42⤵
        Executes dropped EXE
        
        PID:2548
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        43⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        44⤵
        Executes dropped EXE
        
        PID:3000
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1192
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        46⤵
        Executes dropped EXE
        
        PID:3744
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        47⤵
        Executes dropped EXE
        
        PID:1892
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1908
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        49⤵
        Executes dropped EXE
        
        PID:5052
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4644
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        51⤵
        Executes dropped EXE
        
        PID:4316
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:740
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        53⤵
        Executes dropped EXE
        
        PID:1492
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3520
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3252
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2628
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        57⤵
        Executes dropped EXE
        
        PID:3780
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5036
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3112
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        60⤵
        Executes dropped EXE
        
        PID:3144
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        61⤵
        Executes dropped EXE
        
        PID:1548
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        62⤵
        Executes dropped EXE
        
        PID:3592
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        63⤵
        Executes dropped EXE
        
        PID:3540
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        64⤵
        Executes dropped EXE
        
        PID:4640
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:676
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        66⤵
        Drops file in System32 directory
        
        PID:1244
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        67⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        68⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        69⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4068
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        71⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        72⤵
        Modifies registry class
        
        PID:4968
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        73⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        74⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        75⤵
        Drops file in System32 directory
        
        PID:1344
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        76⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        77⤵
        Drops file in System32 directory
        
        PID:1728
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        78⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:220
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        80⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        81⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2368
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        83⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        84⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        85⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        86⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        87⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        88⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        89⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        90⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        91⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        92⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        93⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        94⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5296
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        96⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        97⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        98⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        99⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5520
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        101⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        102⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        103⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5704
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        105⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        106⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5788
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        107⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5876
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        109⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5968
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        111⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        112⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        113⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        114⤵
        Drops file in System32 directory
        
        PID:6128
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        115⤵
        Modifies registry class
        
        PID:4064
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        116⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        117⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        118⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        119⤵
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        120⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        121⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5652
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        123⤵
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        124⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        125⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        126⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5996
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        128⤵
        Drops file in System32 directory
        
        PID:6076
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        129⤵
        
        PID:380
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        130⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        131⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        132⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        133⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3892
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        134⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        135⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        136⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        138⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        139⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4496
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5628
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        142⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        143⤵
        Drops file in System32 directory
        
        PID:6052
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        144⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        145⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        146⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5192
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        148⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5336
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        150⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        151⤵
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        152⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        153⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        154⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        155⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        156⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        157⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        158⤵
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        159⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6540
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        161⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        162⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        163⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        164⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        165⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        166⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        167⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        168⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        169⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        170⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6968
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        171⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        172⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        173⤵
        Modifies registry class
        
        PID:7092
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        174⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        175⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        176⤵
        Drops file in System32 directory
        
        PID:6196
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        177⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        178⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        179⤵
        Drops file in System32 directory
        
        PID:6432
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        180⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        181⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        182⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        183⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        184⤵
        Drops file in System32 directory
        
        PID:6752
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        185⤵
        Drops file in System32 directory
        
        PID:6840
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        186⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        187⤵
        Drops file in System32 directory
        
        PID:6964
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        188⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        189⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6152
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        191⤵
        Drops file in System32 directory
        
        PID:6256
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6364
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6472
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        194⤵
        Modifies registry class
        
        PID:6580
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        195⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        196⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        197⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        198⤵
        Drops file in System32 directory
        
        PID:7000
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6016
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        200⤵
        Modifies registry class
        
        PID:6216
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        201⤵
        Drops file in System32 directory
        
        PID:6844
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        202⤵
        Modifies registry class
        
        PID:6624
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        203⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        204⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        205⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        206⤵
        Modifies registry class
        
        PID:6444
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        207⤵
        Drops file in System32 directory
        
        PID:6744
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        208⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        209⤵
        Drops file in System32 directory
        
        PID:6324
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        210⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        211⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        212⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        213⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        214⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7260
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        216⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7392
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        218⤵
        Modifies registry class
        
        PID:7432
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        219⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7516
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        221⤵
        Drops file in System32 directory
        
        PID:7560
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        222⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        223⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        224⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        225⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        226⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        227⤵
        Modifies registry class
        
        PID:7812
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7852
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        229⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        230⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        231⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        232⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        233⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8112
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        235⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        236⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        237⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        238⤵
        Drops file in System32 directory
        
        PID:7300
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        239⤵
        Modifies registry class
        
        PID:7380
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        240⤵
        Drops file in System32 directory
        
        PID:7440
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7536
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        242⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        243⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        244⤵
        Modifies registry class
        
        PID:7760
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        245⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7932
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8020
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        248⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        249⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        250⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        251⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        252⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        253⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        254⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        255⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        256⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        257⤵
        Modifies registry class
        
        PID:7660
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7780
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        259⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        260⤵
        Modifies registry class
        
        PID:7460
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        261⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        262⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        263⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        264⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        265⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        266⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8368
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        268⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        269⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8492
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        271⤵
        Drops file in System32 directory
        
        PID:8532
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        272⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        273⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8612
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        274⤵
        Modifies registry class
        
        PID:8656
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        275⤵
        Modifies registry class
        
        PID:8704
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        276⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8740
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        277⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8792
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        278⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        279⤵
        Drops file in System32 directory
        
        PID:8864
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        280⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        281⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9000
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        283⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        284⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        285⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        286⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        287⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        288⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        289⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        290⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        291⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        292⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        293⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        294⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        295⤵
        Modifies registry class
        
        PID:8700
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        296⤵
        Drops file in System32 directory
        
        PID:8776
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        297⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        298⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        299⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9080
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        301⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        302⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        303⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8376
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        305⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        306⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        307⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        308⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8820
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8912
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        310⤵
        Drops file in System32 directory
        
        PID:2852
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        311⤵
        Drops file in System32 directory
        
        PID:8976
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        312⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        313⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        314⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8460
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8632
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        317⤵
        Modifies registry class
        
        PID:8840
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        318⤵
        Drops file in System32 directory
        
        PID:1464
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        319⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        320⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        321⤵
        Drops file in System32 directory
        
        PID:8232
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        322⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8860
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        324⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        325⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        326⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        327⤵
        Drops file in System32 directory
        
        PID:9060
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        328⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        329⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        330⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        331⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        332⤵
        Modifies registry class
        
        PID:9312
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        333⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        334⤵
        Modifies registry class
        
        PID:9392
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        335⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        336⤵
        Drops file in System32 directory
        
        PID:9480
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        337⤵
        Modifies registry class
        
        PID:9512
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        338⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        339⤵
        Drops file in System32 directory
        
        PID:9608
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        340⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9692
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9724
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        343⤵
        Modifies registry class
        
        PID:9772
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        344⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        345⤵
        Drops file in System32 directory
        
        PID:9856
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        346⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        347⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        348⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        349⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        350⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        351⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        352⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        353⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        354⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9220
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        355⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9344
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9404
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        358⤵
        Modifies registry class
        
        PID:9472
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        359⤵
        Drops file in System32 directory
        
        PID:9548
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        360⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        361⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9760
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        363⤵
        Drops file in System32 directory
        
        PID:9824
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        364⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        365⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        366⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        367⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        368⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        369⤵
        Drops file in System32 directory
        
        PID:10224
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        370⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        371⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        372⤵
        Modifies registry class
        
        PID:9528
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        373⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        374⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        375⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        376⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        377⤵
        Modifies registry class
        
        PID:10104
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        378⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        379⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        380⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        381⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        382⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        383⤵
        Modifies registry class
        
        PID:10000
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        384⤵
        Modifies registry class
        
        PID:10216
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        385⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        386⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        387⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        388⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        389⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        390⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        391⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        392⤵
        Modifies registry class
        
        PID:10404
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        393⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        394⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        395⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        396⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        397⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        398⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        399⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        400⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        401⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        402⤵
        Drops file in System32 directory
        
        PID:10792
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        403⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        404⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        405⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        406⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10972
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        408⤵
        Modifies registry class
        
        PID:11008
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        409⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        410⤵
        Modifies registry class
        
        PID:11080
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        411⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        412⤵
        Modifies registry class
        
        PID:11156
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        413⤵
        Modifies registry class
        
        PID:11192
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        414⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        415⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        416⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        417⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        418⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        419⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        420⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        421⤵
        Modifies registry class
        
        PID:10628
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10708
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        423⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        424⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        425⤵
        Modifies registry class
        
        PID:10908
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        426⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        427⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        428⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        429⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        430⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        431⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        432⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10444
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        433⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10664
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        435⤵
        Modifies registry class
        
        PID:10776
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        436⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        437⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        438⤵
        Drops file in System32 directory
        
        PID:11140
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        439⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        440⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10400
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        441⤵
        Modifies registry class
        
        PID:10608
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        442⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        443⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        444⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10620
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        446⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10552
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        448⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        449⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        450⤵
        Modifies registry class
        
        PID:11280
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        451⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        452⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        453⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        454⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        455⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11460
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        456⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11496 -s 416
        457⤵
        Program crash
        
        PID:11576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 11496 -ip 11496
1⤵
PID:11552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adgbpc32.exe

Filesize
305KB

MD5
2c6248d180c15133b5b4b75501115ff7

SHA1
11dd0013b552565fad64862d2760641f3fa90b47

SHA256
376d6f89808cac58cbac885b9ae5a2df9e6014e5e04a4f5439dbd55fcd8189d2

SHA512
4136b94087574f3e4ff4467964feb0adc575e9644ebd1c5dc9a0bced2c57f412319318542227e0350228af303bca7883683cdae046ec42a352d3fbca4429c42e

Download Submit
C:\Windows\SysWOW64\Aepefb32.exe

Filesize
305KB

MD5
7a4df31bd150728984c0a21176822de8

SHA1
6cc82200f6b5c5398f9045712ef24b7c33a6015e

SHA256
1a97c2adbb97c6503e4d1d5ddae42a75d441fa05ba6622c657d8c74de5eb826d

SHA512
d9c7dc2f358ebd6fbace42e6dbef3bbc193d24ecd910e0748ad647a176576c17bea6b570eecb3a113c3902648f9b8bb7e874343bcb337dbdac5164259d64dbbd

Download Submit
C:\Windows\SysWOW64\Afoeiklb.exe

Filesize
305KB

MD5
d1bc9cb403a58c0f6c545ff2246f70d7

SHA1
d6dcc949db2f1c6d6cda9c707e4120dd522deb0b

SHA256
6b1fe2d7cc38195394494c0e820df427e504a771d3c14afb9d3552233bc43784

SHA512
82354c210bfa6e716c0ef431cc51b810bcc984f1a9c4c2a80009e964860cf494676e41d20f0cd9cccdbf0d2579073446998abc73ab31de4d7b64fba80cc93f5d

Download Submit
C:\Windows\SysWOW64\Ajkhdp32.exe

Filesize
305KB

MD5
de57ff2c709dc2cafaaf7820ac1cb4e2

SHA1
aa3cb1d71f3994443c37ddaf7e16b5a56403ccd3

SHA256
c781f8a2138c46d83cf64162ec309fb6e26cf04a41ede57ece51e5175c3a3360

SHA512
19a872c5bd8df5f9f85ab23d970b26397e514b0b6ddae3aa51debd4ded7ac8a77ce2dda97eb751fc906dfad6ce828109526a0f31eb7a050257458f0a00e251ac

Download Submit
C:\Windows\SysWOW64\Amddjegd.exe

Filesize
305KB

MD5
f3ad8a7c5adbf0939c9ffbcf89f93292

SHA1
c371e0a3569bed5eafbbe02191ce3550fa71e750

SHA256
c1fc68a9394b42533e1154b30aac02c48576f43053ebbf7820eed1d328412e00

SHA512
342c1abb9b9b41de193c49ef76395d73fc0561934f447df9b8510d67a1d164b06032d8fc9da5f1ce94a6fb1cefaf7dfe6e2a6f1a802c352a7518414667a9fb5a

Download Submit
C:\Windows\SysWOW64\Bapiabak.exe

Filesize
305KB

MD5
2bf01848cb53137e50126d74083b6835

SHA1
875866a7e4bcb4e98391de25ac281d2a58c1308d

SHA256
fd2f415904b1f347a666cddf252ac4104da8555bfe1b940df063173761c21039

SHA512
eb0d59e01fde8083f5c335a09c09fd088dd0c35e2bff299801a1eb7b7fadc4046c6af1daf4240e9ee24075c85bd953d85c3978b19e4388e83cc2891172015fc3

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
305KB

MD5
1f23cd5b1d3ec9fc43ba10393389b3dd

SHA1
09845a8e2424fa95e8bbea7c20df8caf3d0a732a

SHA256
9b815f3b6d4a1d006bf2f7588ef8c8a6bbda0da38e22c72de9aa84a40a71d17f

SHA512
20a9576945d46a6b10520620f412139e640a67830c7a0b732f0ed5b447f167caa9aa5498efa5283c97c2e5aedb02bb42645b81cd584a063811fdbe88bb34f953

Download Submit
C:\Windows\SysWOW64\Bfkedibe.exe

Filesize
305KB

MD5
5c7e4e324820d8b3467ddd8d8b543761

SHA1
2eb2d2ad04353687d3d539d9aee07386ebc9d0c2

SHA256
a116e95d651d4c349a0bd37d1b30d4835ade0847806d44947af7ffec5cd01e10

SHA512
1bad42fe32b8aeb8ba45e479ec76cbc298ed98990059c0b6c6e9e7bb505bde66c536fb533095aa5c8a411220c9cc7a1a0e192801ca55b0541a5bca85e69dbb05

Download Submit
C:\Windows\SysWOW64\Bmngqdpj.exe

Filesize
305KB

MD5
924b75120e1000967907b7247cd5fc65

SHA1
9e041def054ad85826d91af863e608b3a379689f

SHA256
a0d774278fbb901dd6ecb5e704d98da86a279086ea1043b0df41ebc7ccf5a0f2

SHA512
3ef23e763f1e5756b0303803d8e68e49b1ade6516946f06edf18f2d18e546c695c823e17074dcdf228aab584119fd56fbe3e9455a44cb3c3a51a9ba265aab928

Download Submit
C:\Windows\SysWOW64\Cahfmgoo.exe

Filesize
305KB

MD5
8425aac4abae00b842f1f69d51352e6e

SHA1
ef58de13b68bcc5d64da586f3eff4b13e64a14b5

SHA256
b27357c773e8256d94f85bce3d3d25db705d78271d79d99911470245bcdaed1c

SHA512
6903dfc5a7ca5fc5e6f8f41d79a6936fe30d3c746670629ec9c68cea1ecff9cf56b04988d003ccc78ecb5487b486d890722b46e53cd3c9ed747a3704efd01226

Download Submit
C:\Windows\SysWOW64\Chcddk32.exe

Filesize
305KB

MD5
f265f8019741562a415fa4956d984bda

SHA1
fa925ee7bffdac6d71f2c1e01259a18e28700e7f

SHA256
f015d9df4c5c37e729c5cced55d54351031506534ff4118b9cb1a13453a18d3c

SHA512
b1ccfe78cb2e7c0b07533f47bcf2a19ad8cc91694b21b1f4af1014655bce861b23e7cb575bfefa276790a9bc8a2de3144a4d7c07fd906d9f5adc472e8d4d067f

Download Submit
C:\Windows\SysWOW64\Chmndlge.exe

Filesize
192KB

MD5
dff5573a0552b0bd16f81a24942e43b0

SHA1
0bd3a734f56e2b3d3a222080d26219b73147806c

SHA256
9fe8c9df460efaee5d2f68d65d6e46475062bb12c5f73d068db887abae863d2c

SHA512
d1c8e872d5857cfe5079af1a9e98d9816aa80ae98130212c10d0f929bb4d655d363b65a01f0f2084a7b23ed5c620aae106d6b52918a903e2c01cdd1a6dc9794b

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
305KB

MD5
2a45c770b73a8e947ddc6755d0e67646

SHA1
16397e73e25fd879c35c601717e936390b0b09fe

SHA256
ee5f793dd20e541a3bb71cb29f7abfbad3f2b0c9679dc4ad4b994981393f42ce

SHA512
0715dac7a891781a4f6a5bd30b77e073d2fc138ea7d6665be1d78365b0a3c5889717b4f899381c7b7e909a1882963e5107438fa3afe9f3830a5ed8113307341e

Download Submit
C:\Windows\SysWOW64\Clpgpp32.exe

Filesize
305KB

MD5
f0c5c4687b09e4540faee8e22837cda4

SHA1
d6a1d708573d7460e61bb4f0ceae61ee5fe0c924

SHA256
59ea84a4544d3d2b5c35deb667a103e3af0f29c9a193bfcbe3be060b98564583

SHA512
3f60fa1f4bb5eb17726e348e70e18bf691835d81249aa8270b90b631b55e4e12be3aac97f013d7cd85228a968d039d7f32ec1eab2d1c578416a9d43ff12064ff

Download Submit
C:\Windows\SysWOW64\Daaicfgd.exe

Filesize
305KB

MD5
1142ea8e913063bbdfda9c4549e16008

SHA1
68a2d5614e4dfca6b9efa842fa0a1a1a6c9b53e9

SHA256
e6dbca296f9c462f220765244031edaf53b8752955a48fdfd635ae6231d72acd

SHA512
c57fe75f5b8afa8a0191a082aebb65abe32b7228716c11888cefa99ebd1031f37ead33ab693bb223d91cfba1b2fe1a5f8a367ce633a459d90cb7b4abacd76b13

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
305KB

MD5
f81b0c8d695a9d0316cdedb86017b0cb

SHA1
265865ffe8c16cd40a58bcbe4f106286b54c27dc

SHA256
f6bd4b735c915f58b1d0f7b267cc4d53468fd8d2c376d1bffc3b53db7da0678d

SHA512
77f4201f1e2575980a09ed12daebaeb8814d200fdba4d77ad4a071a29aeca5e79aea799d6b7b9f99c188718cb6140d80c1d87998d6e7b1539a351e1295045f06

Download Submit
C:\Windows\SysWOW64\Dccbbhld.exe

Filesize
305KB

MD5
b3d74a758a0c6dd7c63ed7626126fc6a

SHA1
94f43872f413b9597c91907fec0a734f7e7086a7

SHA256
898b5eb582d67d1adf30ba2c4110c079197a5121391edfcd8fae67a431871e6a

SHA512
f4dd6b55b91af6f452fbd9ca17a43d7c492147a3f4eaa12f17ef6016d4522ca23cc27b4cb88bb7925b4185b06e98a79954131547340d128b021c6983b74af90e

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
305KB

MD5
500a76d5a09a02b518b066d7fb5051bf

SHA1
0fd834c8d14f5156b95bc0e0e5e44b03289c97f9

SHA256
62aa3b97a5d309f511d82768cd051b6a191590c3d304bd6f38f36a16aa7efac8

SHA512
42407128f6f09fca8cb300602fc55d9c6476e4f8fe747a715db43f81f625618a12faf3f5a6b53cf647fefef716fe692d7f1898c7a3459f167f4ec0866f03a7da

Download Submit
C:\Windows\SysWOW64\Dfknkg32.exe

Filesize
305KB

MD5
3e428c54c4b86f074ad75a70e6d7b286

SHA1
dce9f6ed0aef67e247d11a7251ec17d332c9cf78

SHA256
e3cb3cdf6d4b8f5e0de9a0dc117d6f8bca9551ff9afe934792d68999e0873210

SHA512
c2be10cb26deb85ea91353d98068497ccecd8b7c8d52c5682116614f4a7d359c53942718b5ccab6901c1865799a0d75e1a80414716d4a3812f8b752845d4a909

Download Submit
C:\Windows\SysWOW64\Dhkjej32.exe

Filesize
64KB

MD5
44b7b9da3f6c557658a6564359edd326

SHA1
0907c56aa09aae8e2f782a307fa527d801cf6259

SHA256
3bc99681cbcd6198b0a690ab132aa4d938c612a3a262455ca9d4f47910929ac2

SHA512
791e62e6355c8cddf2538c080325c585a4081e9bde9677f89822cfc4c0d438e3c8f206e4cd5a1dadd757afe6fda2c9fe158a634ec7f2864aa33fb75467f8e20f

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
305KB

MD5
efceb9cee5a71353d57d90d871ed69bc

SHA1
61175a064a9ab7caa031734acfbd5c555e549b23

SHA256
055b85eca79fcb213291d66a13ac5c1b864dda47780481183fc0d2f0744cb0a2

SHA512
fd9c095e11c102ec2350b05834c59338775ee00e2f5669612d5e2484e4991503d3df5b51ce8fc0018894418dc806739248d87ddd733847c0ea48b41d8fc01625

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
305KB

MD5
2ce79096111397ba59f62b83465f7316

SHA1
c3f4264332498db8cdc56b0067d8930f0369dbbb

SHA256
fc5af867b94f730c3761a53504ea17952e140173f6a54397ba139ae841ba79b3

SHA512
66b38927985195eff2dd5032d100e6f86fd02e696eb22206d9edf71ad0468c5d24bcd08163c970b422e91bccce2a3c312d07092007e00e6ab685f00049033653

Download Submit
C:\Windows\SysWOW64\Dojcgi32.exe

Filesize
305KB

MD5
5ee672e1c00547419384334b5e787898

SHA1
c04def0a0cab0f4ccad4123bd7e3a1caf2035a79

SHA256
8e2c191a973a73f093b911d2522e2de9f6207c17902ff84c1d18f9280d06f270

SHA512
03c391b13565e8d168f8095f5ad47845e5214dcf3da51bb023f4958460c787266cc89eb1e96166127cf269cb628663fc8578f342cc9422010777933cb92fd7a4

Download Submit
C:\Windows\SysWOW64\Echknh32.exe

Filesize
305KB

MD5
1d7ffc033b073b37c0ad5355ef448f69

SHA1
20f57a0bc87a20cc25d634b5424865298c92c6b0

SHA256
436a4d2a2d95f6d33d9226b74991d591b11fe8ef807e38995bb58f90bb112425

SHA512
6504f75fa69a1a66965d6d576a83ef7eb0012bed67587c20a888a5c5037ef10bf5542a4e2db63b626aedfc5e31de46b9de2635588237eb48b503ecc57bdc29c8

Download Submit
C:\Windows\SysWOW64\Edbklofb.exe

Filesize
128KB

MD5
4e747d296a0d20e9c853108dd2a7d978

SHA1
3f5e7387a672076fec4f7f8611b923f60ce202d5

SHA256
258c3c6ef95ad24a521ccad2240440e154e59eb50fbefe6318ae6cf367cd70f0

SHA512
8baf0f7ef767854eb77068507a514c47f74a44b06bc6f5573ae2e70524990794d5090e470da2718334bea586f1b42826f7ec002f979a04e7e8ffb7067f6da476

Download Submit
C:\Windows\SysWOW64\Ehgqln32.exe

Filesize
305KB

MD5
1d20ecf5ff988ed17d8e21fc9b0ad025

SHA1
58150a19de840b8d444205f1b09d7b82699826a6

SHA256
7f16007f32a26a25c4f691af97dc6ee67ceb93d111c6077d37b57e1c225558cc

SHA512
9b20ff30329e2f957e80c64e567a6dc1241864bc2862cb41527478915dcb182bddf3f70c1844ececee001ceda35533339514fac4cf1c3026c2d741c6a98c513c

Download Submit
C:\Windows\SysWOW64\Ehifigof.dll

Filesize
7KB

MD5
7cd07efa3375492f25c6d6e81293a2a0

SHA1
51e350540c7c6bfc4ef4f7addc547c1b80197bbd

SHA256
b5efeaba619b7f4d16ffcf4e3c7beec0b9ae9c4e760942e4f5a89169d9f7e20a

SHA512
56f3b572a097cb082d9468d0219d6c723ad3960ec3e08e25a9540da6dc14be029981e433b3e824f0ab995d8c866dd821f41b6fe6eede6463b7562bbdcc03335b

Download Submit
C:\Windows\SysWOW64\Eocenh32.exe

Filesize
305KB

MD5
c5cf93020f86b4de2e39ca37c3397d53

SHA1
7d09867de3092fd6b414db05ed7e81f007a578f1

SHA256
645889de49ff2062327f5f2fe58f801d791aee43f1c94c74bac288b531b9e8b8

SHA512
d4939fb13a4a2b23d0b2211c69fbd48cf9f965d42cb0c2dd4a30dce36d22bbf13799e1385ceb4136a8beaa21866dacbeebf3af96904c6456d50f6ad453c461d2

Download Submit
C:\Windows\SysWOW64\Gcimkc32.exe

Filesize
305KB

MD5
a9d19cb02334a4030d08d1b96d0f759a

SHA1
06238cf92e195bfdd9516593fd3b0d7f51b52909

SHA256
ef6fd0a3b2c313bafe8a1084f90d5ef310c928c393db5789e5b8c359842e600a

SHA512
e54cf1143a23baf8393d111a0019af59e1a432eadc1717702ff05e8c9a2b7ac240198bcef59b5818f4392c1575e59bc1ff7d7657812c87a28e5cfa0eef3cf3e9

Download Submit
C:\Windows\SysWOW64\Hfcicmqp.exe

Filesize
305KB

MD5
140baf808212e13097c754b62b0426bb

SHA1
352ad5dc83b59bcee809ffadecf8356375786766

SHA256
c80d7ed676a8e056071929b7dbf40ee8ef5fa99b829cf1606b7ef82d5ab92ec0

SHA512
b10f84a8251116b5851e7fb117fa29a3d3b6856f678d7b9866964028353ef5f4868a0469ab0da0983f6913dad5062ecb35dcba0675daec47fdece17ecea99234

Download Submit
C:\Windows\SysWOW64\Hihbijhn.exe

Filesize
305KB

MD5
73f10e2913af8613b684cf7c6f7a17dc

SHA1
c956c4cc7c7b6cc72155eb5373ed7c67bd7997eb

SHA256
9f0e96c80c9a4fcfc802f87f3e817d52f525954170de28cc268c6d68392154f4

SHA512
a6f7365e1526970230e6f4425092d18617e96be8e421dc09f7bd365176ca1fb2e20f8d7e67385cddc9bb57afa0203239d852e47e57f432a744c57a5dfa88fd8b

Download Submit
C:\Windows\SysWOW64\Hijooifk.exe

Filesize
305KB

MD5
9bb2bbe51771de70411eeddc2e5012c6

SHA1
1210de128db39929b432942c7364922dd6bf9af0

SHA256
bfcafe24dc2b00995827b312d3f09f929914d9003d053ad84327a5fa143dfd7c

SHA512
6357b4f0226dd50fe29f5f728325eed7c080f6314ce5e37b2ce1a6a83560644917a3002b4a5af8c03ec1a7eba64ceee93522725322c90522faee6d81c66bcb2f

Download Submit
C:\Windows\SysWOW64\Ilghlc32.exe

Filesize
305KB

MD5
ff84937340875f965ae53851cfbef1a7

SHA1
6d2e68e3b034acdd0985f9cd6bc446be9413fa86

SHA256
02c6e9ea6a7393f58a791486c1a56d4c310eb5c6dff4034e93a1efb2080836e5

SHA512
92ec8cab51817e0703f387391d03bac24f1f4858ce26976fd0d0b408f95d3d69ff59c84ef49ea3e877bb762b3eb918a1d389c0fd144eb02c8b738a683155b571

Download Submit
C:\Windows\SysWOW64\Jaimbj32.exe

Filesize
305KB

MD5
b6229ed980c4ec405870ae00e127bde4

SHA1
f6d0ce1a7c8d4459f34ccb2c62c77b315abbdf72

SHA256
d37c2daec17f65814905f6405fbe96c639e30ac4bf98d1de66ae33bc041b51ad

SHA512
1f48fd0f797d872aefb850a36ecf5dc9cc149ce7cbb4adf1841619c102bd0dd3bb07aa3bceedca42bf8c775047fa036ffdf61a706d257eb5a6ce0e249db5b2ac

Download Submit
C:\Windows\SysWOW64\Jangmibi.exe

Filesize
305KB

MD5
78619f137d9b1cd3d3f3c43bc104a31f

SHA1
94a1074fda2743071a0fd3910953af4c3dc58446

SHA256
93a9980c57c32b70f5ade099110819e36dfb310e8e29d2a65cd5073038d33581

SHA512
6af9564b7e03b8b99101b727e3253d4abe26ab39175cbef07974f7f97706fc32200b491486c72bea15c1561b7af9c0675c3b9f412eeb2e4d8bb44fccdf3a772a

Download Submit
C:\Windows\SysWOW64\Jdjfcecp.exe

Filesize
305KB

MD5
ed6836d65b59b1d3aab5e0ed0a05d7b4

SHA1
66ee6e866acd365cc38eb5c3985678461ed1126b

SHA256
61209c6aad1e368556b47aa19b110e883ef1952b525f17ece84093900f09c4fb

SHA512
6a4bf018061e39d68578af3cd9e1aaa07e10c4da38a5d3f47b1c64bdfa72d91a272b3453122b21d56cc59ecf62004c88203a535ef1b7bf7f0389d8107cd650e7

Download Submit
C:\Windows\SysWOW64\Jdmcidam.exe

Filesize
305KB

MD5
9599874321d87945c6e7801f8a60c360

SHA1
d6b847fe1d6ccace2e0249720b132075dd2b49ef

SHA256
60f8b0f431cc9075e368939ca742799ebbdaea4b9ffd83f66295ae0f1384890b

SHA512
6891fb68461de1cc2283694db56d0038025f7cbcddf91d3f14d659e641ccc6bc95347306a43bd2063cf6e2b0f462d2a1e745ac16f4311202fc8cad8dba11ebf9

Download Submit
C:\Windows\SysWOW64\Jfhbppbc.exe

Filesize
305KB

MD5
7a56021b5b3f4ef780edf874f4bb4855

SHA1
ee04e30a2fb8de9bb5928e2d0364014398c05d3c

SHA256
45b038cda4f81cdbde3303fd6712e3a07334a3daae63435cadc3d1cdc71bf77a

SHA512
45bc1cc31cb3a09c77bef1a26d7a139987ea398cde2fdcb57336807e2b447c9e59ceb60c6244c321f5b73d21eeb5ff22dfac1e089f7a7c54953566cd07955dde

Download Submit
C:\Windows\SysWOW64\Jfkoeppq.exe

Filesize
305KB

MD5
55d15721f213341bf35ba56a8800bd6e

SHA1
e4e716a4776862bf3e745baf9feb470e32e41a5e

SHA256
01c31ff1e46672b517d23a3cc0972701aceb77d0ab57121d38780d557c62dc89

SHA512
f1cf28be969c21730b5a5bd625960f467df6e87a46aa66fe97c0f07023d709be6584da572a8ba29aa62c015b7700c63f9c96b26fc89b58ee451e1422d14dff5f

Download Submit
C:\Windows\SysWOW64\Jidbflcj.exe

Filesize
305KB

MD5
581b97bbbf4e0318d1dc1402cce8750e

SHA1
c27c09b9004862c5922059efdcc260231ac23034

SHA256
334b61566c04d809985ec068190d38fdcbfbc02a483760b3bb5adbff7d1d15b3

SHA512
ac6a1ac640989a936ac7930cb6ac51f502197e09ab73324f07e6c1f85e22aaf4f2b26f6e598d67f9a26a62d54947ac0a17da2bbce885c94769098f719045e441

Download Submit
C:\Windows\SysWOW64\Jigollag.exe

Filesize
305KB

MD5
35bb80eb77a19f7d4d4c82d4de3c84e1

SHA1
00c2b9d44503328c4e55d4a6be51b37030d6d623

SHA256
cf2deef71978bf0bb4e0f03e8707a97626f64cfe48b460756aa1a435063a4e3a

SHA512
7c6c55e1363327b49e9b09b4c3a3c7d41acb03f2139d46e5267ae131b837606c94b1f0cc5610281bee9acf38fab84ddbe958bee8e5a34ccec6176d85a3041123

Download Submit
C:\Windows\SysWOW64\Jkdnpo32.exe

Filesize
305KB

MD5
8bc3ef6602f77b16d1d48c7060f07f80

SHA1
7e8e8b2edc0a22edf872de686049b0cb3d968587

SHA256
6512eeff2dfb9e6056d7efab9b8233cb7ddd33f4213e73121bcdf04e771b81dd

SHA512
358d1e467ebcdf317e526e3a88f150721c6bed6f66ca612c50c942cd62ee6121228fffc45e0ed40ea64f79b7cfe85504e0a7a0a795a6ff4707b9055efe8e8c34

Download Submit
C:\Windows\SysWOW64\Jkfkfohj.exe

Filesize
305KB

MD5
4e4db257073bb92707a208ee1f00e7dc

SHA1
2591b4381001e96437817fe6fdb67226a1cc7096

SHA256
ad357735eb933fdf7ab66354aa12fddd5534c1e22e4ec5fc25629fe3c32fc7cd

SHA512
88fef2fc8f5ea3cee0c9c75cb204a6a8620120212c75e672377e4364d7f127badb062b9d85d9df643528f41107c737e54de7c50a9f698e0059b1358f772cd2a7

Download Submit
C:\Windows\SysWOW64\Jlnnmb32.exe

Filesize
305KB

MD5
734a3009d19d97ba0a897f1cdf5bdb27

SHA1
9a739ae230781556b18434ef82c8514cf8be0a3d

SHA256
56e6caa223200f4c6190bf219529c43a473e0bf797dd63dba97a9794d96cbcee

SHA512
acfe1bd70673421196f2b32e6f2e1e202222a8b82e4084c2ad57408b204aee60a56a6328bc8c7fe115d9b370fd15add43dd813c8890da1d64470f16dafeaf121

Download Submit
C:\Windows\SysWOW64\Jlpkba32.exe

Filesize
305KB

MD5
b22150866afbd19cff4f990c6b4c6a77

SHA1
aa9ecb63c86aa24501d56f92af13460dcac1ce19

SHA256
7f02d148883e955bddf4aa32dd292665793bbc1224ba91c8ca36308339104803

SHA512
ae9a7dd7cf5a36bd97308f7b5a90835f2789e4e6d22f6d08ec0cc0e4fe627dfb07dc1b115a6eb422151dbd9b1034b17e97bcf2a2adcc584ecfa0d9a5f16b795b

Download Submit
C:\Windows\SysWOW64\Jmpgldhg.exe

Filesize
305KB

MD5
515814437efa67c0a941ab4057176aa7

SHA1
db7db3e74d1f91d0f8104f2df279d18391d15d23

SHA256
6ca51db0f73d034a1b50e2ec4c0479b38950fb24ec3b04224b577025334ee430

SHA512
f3ebaad88e79403a60834f05282e6fa7388c3dd056f9af6cfd047a99f715a850b9e2976e7028b01645461c2c4638b259de547b89df4b932ba2ff00163ff56f70

Download Submit
C:\Windows\SysWOW64\Jmpngk32.exe

Filesize
305KB

MD5
89fe04f9ccaf468c5bc3bf60291a0c28

SHA1
4d98fd19b1c4749cf51fd16f5f4dd9f112c0381d

SHA256
0611874f156e3eb947c7bb659ddcb7b758582c6c21d53493f980e9233919b0da

SHA512
9f2fbf95c39cf36008681aa423c1534cbbfe551c865bf46893074f18715968e6e4893e77ef6c0c927c84b60e2abf0b61831b6847ca3ee91b5e6e84aa5476082b

Download Submit
C:\Windows\SysWOW64\Jpaghf32.exe

Filesize
305KB

MD5
67b3b0fa99ca1a016f9a3afe093b285a

SHA1
83b6f6c770586bee0009d9d9d0e59506f9d8f48d

SHA256
4b2a56f17061fb88c29709036bf1bb818898cb8996a9bfd0a4ef5436e5d4d1c6

SHA512
4fe81a151ad024051f93e13f671217be823a5f9d23403d5c6b146e7c762ace99b57bb89e7455afda7f156dbc207558f790ee330c4348c656e8414f3668c2d4f8

Download Submit
C:\Windows\SysWOW64\Jpojcf32.exe

Filesize
305KB

MD5
e51f50f00b4a2699eb4e8805b194b541

SHA1
cbf94e2dd61b91275f36f6f40ca1b5e7b487cfbe

SHA256
11e88eeb6782680e2779f1fc9c42aeca2f3fadf10f232c0545c22dff7d8722a9

SHA512
197e79368f2f5b431c1234ba525b4b979483794b551de335a291b4bbaeca222ff1969a6221fe8b97210310f62b59c39adf92364c74565434a346f69de9b78101

Download Submit
C:\Windows\SysWOW64\Kaemnhla.exe

Filesize
305KB

MD5
52a9d5406abaee48bfb8eac1f9d30622

SHA1
ee48c409a7df8ddf3c3500d0d8038f2054217189

SHA256
abbbe40e8acd7ff9e8d9a34ec339b242f83970e9dd86a9b154a5291fe79b41cd

SHA512
f63a6e1326ba003dfd9fdf576d8628ad389d4f54e75c2fa0d9d5e0445213be7c2d2eda39e921a5b914b36f50f442c8bf76a53a14b67e32e1adf3877df2f6a104

Download Submit
C:\Windows\SysWOW64\Kaqcbi32.exe

Filesize
305KB

MD5
4e1dbe9ae98e42eeae0d99defac28fb6

SHA1
0903198204e65aee8198458325ee270ea73cd678

SHA256
5d5d93ed1e36339fb451e44e933091b8412c69c277c05806091f6629a5b86091

SHA512
4fc3edef6277242598bba2af07d5359fdaf31abcc608b740cf917213cf19a3098358f94ade08ee32a04d38c7982367e5884b7375faf672b3b861faeaf1442ab5

Download Submit
C:\Windows\SysWOW64\Kbfiep32.exe

Filesize
305KB

MD5
c207f99d546847748b4ca55c049b3c02

SHA1
1007ac1b4c4eee757687e1e0134de6b48a64c011

SHA256
a91efed69671e1fad5afcdc3db59c8c23ed1e2fbc2352ca332bfc328a7d8772b

SHA512
7f7bfc4285f991e9394fefe35df5594e53e2031fcecefc1465db3444c10ef591645c27674f86f91d13a9f3542d020619208a1a77257d56f104bf2f1fafd9ab34

Download Submit
C:\Windows\SysWOW64\Kdaldd32.exe

Filesize
305KB

MD5
9de9a17aa4e6279b644a29eab1e0a6fd

SHA1
65e237bca357a2cfb8c05a87e1612aac10d44333

SHA256
cac2475854d51ad7ae8adbcaea33855f222c2ab322a3b758b55fe81d5efa8f3d

SHA512
c5f6b541ceb77354c66423783d31898126e691dc48a31b3f88a5f17885ed3f998827660db309fca1f0d64def3ca1581a7e980e8042fd66513f6ec54d3918b46e

Download Submit
C:\Windows\SysWOW64\Kdcijcke.exe

Filesize
305KB

MD5
41559ff5916d6a7333cb1a39e3c1dd3f

SHA1
df7ce2796ae4c63d26983f2eb8d4f8e2b9f8afa6

SHA256
32df38a481cf8a4f40caaf5d80a8fd13cedcd1d056ae8e5f6708511018a26825

SHA512
46769b5df0ba4fbb87082fc24cd62b0cf0b3acd59785a4b2a9ae5ebd71f9d76184b8fb12ed2d681d36cea219a64b649cd721bf935529a6ad9c09eb09c1081f8c

Download Submit
C:\Windows\SysWOW64\Kdopod32.exe

Filesize
305KB

MD5
2875a555b8eb315627e8eceea475f3c8

SHA1
c9790d64aa7479390c94cdd23f6cea4239c25f4c

SHA256
3080e7e8809693bf3a182d4a4cb8c173a9e204b711527a60233f54bcb97aff55

SHA512
d322c9d27b07eb997130ad8ae11f651e982e6e851b036abd3735565164a810f888daa1e01bd814731aacd3dcaa0b8fe07a6d72db1000d488ec18fd2706aee23b

Download Submit
C:\Windows\SysWOW64\Kgbefoji.exe

Filesize
305KB

MD5
597a6d9a9e39949e27e1680a6072f996

SHA1
145f5529d78f043c485a50d012e7f821f11a44f8

SHA256
0378609a311c8f722bf293c342bda63eb3dba67ae25eb2574183d18d1c8c1036

SHA512
70a3e46fc9ad7e133e3a5387513df47a4a3dad14a8c35e45387ecfbbd9ba3bd84c41315c91ef2cfd064d74c3308a8ed48d5db39640d42e23906a9d06c7bde84c

Download Submit
C:\Windows\SysWOW64\Kgmlkp32.exe

Filesize
305KB

MD5
dbe9587c7b714bb2b37549535c904706

SHA1
8906575deaa0a7cadf99c79ebfd12190e5a51eef

SHA256
14e57d3aa0789a37235093fbccf007c850109a7a439d5c23db6fa3084ec6d17d

SHA512
b36a74be2723bd2476f0206a790c77f13450ed7b5f55681bd682fa89d435154987a677f597f1b90ad30783f257897120ab41b42e5763518ac96538c7956badd5

Download Submit
C:\Windows\SysWOW64\Kgphpo32.exe

Filesize
305KB

MD5
6271f6e956060a46bec8a9146c59fa59

SHA1
050c58c65fad459d482253f29501625c665d242c

SHA256
1f069fdc595edc739e179eff33f4db8c8fd3729795beb269bae1d212d6094a96

SHA512
510082451e052c7dfcf24e12e6e90c2eb7a0714fe3e863e37032e6a06e1d6238cd3909d7bec7b6973ed9d50fc3ed12ed4a492eb75058421c2d495e5670651c40

Download Submit
C:\Windows\SysWOW64\Kibgmdcn.exe

Filesize
305KB

MD5
050baddd3d9f1f08177ba6936f5b6794

SHA1
dec862c201baa6b26ae71f0d76403ddaa0216c10

SHA256
b456d3b37eece97a239e2a489b77ac1e2046ac9cb137fc5c59dd16d580d71922

SHA512
ba287f7ba57c6a0d0822e7ca422dd67872ef1579b431dd79185101647dd3aa40b5847c3036a5dcf795496c487ac53d01de04df2618880b64bf1d16f33e27a68c

Download Submit
C:\Windows\SysWOW64\Kikame32.exe

Filesize
305KB

MD5
f75f10c9b2eb589b31fba52c2ff4c860

SHA1
33b6d21bc04eca92fc7448aca714bcfc4147e0fe

SHA256
cf9ba1094a4213a2edab80714b977f87122ce40c0578ae3e329acd90149ebdf4

SHA512
0be58bf441ea79bcceae9c97b7254edec110eb0db9a5ce0ae037cbc6d232b6439f5ea672c7d83ebacf53694ae9153b9cb97db645874355c6982b3025f7bf689b

Download Submit
C:\Windows\SysWOW64\Kilhgk32.exe

Filesize
305KB

MD5
938f1ef3e1f7d71ebe8b341ebf9015e1

SHA1
774edd461dfb0f107e979782fced1971bca03689

SHA256
76941fc231bebfd0317a0bb4f95e8591c0e149f99ff85f1c1f9ba17dcade0ce1

SHA512
65d1318feab62409c3c1e896f0a30f4c974b6c867415ee4a9efc68e68aa9709912147d0daad261e5afecfb1b72d4216b82fd5e71f3fa4c166a4d854c3dfd373f

Download Submit
C:\Windows\SysWOW64\Kinemkko.exe

Filesize
305KB

MD5
450215aedcef8c941e9aae3f4f9d1b8a

SHA1
d5848cba903ddca9e366f886af10cffe905751cb

SHA256
ab97a2c65058bee1fd05cc933cffb60340e05a511acf0839f55ff8d98de69a70

SHA512
bc632a7fedba0cee7cbc7d76c63b19bedc0d99212e9c68db0492af8c0204b62a361ebedccd9f007660e2a3e6d9d026b1223e98014031f3c95a06117417636b34

Download Submit
C:\Windows\SysWOW64\Kipabjil.exe

Filesize
305KB

MD5
59fb4a72442a7769ef12ec1b67d058cf

SHA1
4a1d66fc5f541477745b204f71aeb1e78ef2678c

SHA256
1282a4203c28dd13e81ec863dee9573cdcd21f18aa85b848d6ebe97e8cbf1a7e

SHA512
88a2f87f093e03ee5e73084aff4bb4c52f964eab9a0f71de10406781790aa7d7ce5539fa96942d5d0a7f2dcc675796ee86feebe8265fbd06d7f626b494127764

Download Submit
C:\Windows\SysWOW64\Kkihknfg.exe

Filesize
305KB

MD5
9d9585a4146e4767d34f081db1867c2f

SHA1
ca9b0044292d8b3eb9182a6d06d06469f01435ee

SHA256
8c1f2c1d2daf03d40314a060996fe02c1bef27d76095a09442bd125c6658bfec

SHA512
e347180cbe6bd3603919b4608e623a87b4b8c5adfa0e81952fc5a90dcd30b62c39d5e3cb2756a64ad35ac89f4e972ad975f8638ef2be5d93ee9f670ac9f2a933

Download Submit
C:\Windows\SysWOW64\Kkkdan32.exe

Filesize
305KB

MD5
54d3187609dc6fd4936fa4bb03108a2b

SHA1
d3ce51686005c6cc3a84d931407bdffbd391a11b

SHA256
ae9eff544eee50cbcdd5e8c1108846973168be41bf251628b81194b8b9d510f5

SHA512
970ac2056524c562816238fc3f7a18c7266012e3a1b37d528e1f963ecf7486fc1e64a14d3247ee2111bad1fa0cfbbffe75d1f46dddae12b496020dae3a1103d8

Download Submit
C:\Windows\SysWOW64\Kmdqgd32.exe

Filesize
305KB

MD5
6beb1e2c307500583cae1377ae2c99a4

SHA1
623d3e2042ceec22e1ac495a9831bd4b621f8c24

SHA256
9109329627cda5f13fba61ef1c285d321a2584eca9b7c972a98d3bde12602d44

SHA512
1884e6635da20141804e6d1840c5864197b92dbba63309e2df6fa1b99c1fdb561245f31c1d338fc23517d405a6da14cd85b2f06b453d3018fde4be1325a27984

Download Submit
C:\Windows\SysWOW64\Kmegbjgn.exe

Filesize
305KB

MD5
9521a680e7aa0b565c4173da31df33d3

SHA1
2049760abdc5a8971f3fa3343e8cba132d0dcf7b

SHA256
999edd5f62c2eaa2128d093e12ad9dc23dd967023f364f40f538265b14885264

SHA512
bb141123eda35a0e959ffa60d502f59741da09c8b72b389dbfe27fe6206459a5106cee76e96753ea640e6ce85c5acffe501ec4ac2af862d26128b0ac0de65881

Download Submit
C:\Windows\SysWOW64\Kmgdgjek.exe

Filesize
305KB

MD5
1cd59c203aac9f432053bd8831cf991e

SHA1
4f50ff47df0d0b24d696005d37b9d002c8b7fd6d

SHA256
b6cd3d32700fe54d0c043c28b034a0caed7d64ab94f0026030fecb6029d591b0

SHA512
5be360b3c3bdef08ed7045bdc01a00b230f36a00da33d35c44e6ecc26094dd8d0c049881907331b4f56e65d7f20b3f6490d11f5ef8b3fd2d0af31a7962f30fc9

Download Submit
C:\Windows\SysWOW64\Kmjqmi32.exe

Filesize
305KB

MD5
5039ad4331d56d9cb7c0d1749e2eb2a4

SHA1
9bcd47823d572d716d880aecf0fc7d034a726733

SHA256
0804c1bc2c89413c89c8bfc7bc5324d66a5ee593fedea0d0ce20741258939de8

SHA512
0ae5c8aee504ae00965ca308e61f94d024cd07d5aa57133a135900fe7567e2596d59f67d32be61081a8f7784f88b259625b2591e49af6f4e61383ef4de532efa

Download Submit
C:\Windows\SysWOW64\Kmkfhc32.exe

Filesize
305KB

MD5
21cc88dcd0d0c33854e0a1f01d1d237f

SHA1
d9c4db5ab1b4bb2d132ee633d9eb2b951d796daf

SHA256
ab8323cffaabb834589bed8983f1cedabc295b5f6d01cdc4a882d13747b4dedc

SHA512
3ead53b5621142a309daff851af1c6966e68072a734466f3e8ea07a474a16520f0b4d3ff0fb34c5970340c3e988b31e8b698d945b05b5ae316e6927f58357ce6

Download Submit
C:\Windows\SysWOW64\Kpccnefa.exe

Filesize
305KB

MD5
a6d44ddc5c606c9ed59a84d828c8e325

SHA1
eb5a8e4ee6de69d97375e128c7b1cc2bbe6babea

SHA256
e1bb207cf2c74e800cf43297f6549a4930b262a92739eeadcb49d86499033d84

SHA512
fd935b442064a5e128a24efcd71512a5b4db2dd1f3a0ae53ac8df6d628f5265bea4497e06692c6c16e114b0abca3872399b036fa32deec6884e43f45208c6671

Download Submit
C:\Windows\SysWOW64\Kpepcedo.exe

Filesize
305KB

MD5
2fe8c698c7781f5b4c302eb3c9da79ce

SHA1
8cf09dfbfbc44d9c847cd7243fcc5aa093c5de44

SHA256
ff8bcda471554f89bf8d83fc1bf7b310b16b0d5920382c4433973450c9fea54e

SHA512
0a1caac689830cc64aca25a4863735ff9670f412d5acdac4d144b3b159e31df62bbc4b1a1799b7ce17d72687c63f2613587b3f17292ea660f2fd36d6e6f27d90

Download Submit
C:\Windows\SysWOW64\Lbdolh32.exe

Filesize
305KB

MD5
a4090f3ff7ab1a1f8674319e8a35a52b

SHA1
26897a0f1b95730b0b34b7bd70baf6c5eee15087

SHA256
971353479c83a64311e415e2104274dedca0a4b7c062f4cf99f5216d5c056925

SHA512
def66b0371f6760c5426c8089b1eca02f76d78ab56461980698a6a904fcea34fa9c353c5949f2c3157ae0a78620ea4f737dd2148fdfbc5435f17dbfa707e88e6

Download Submit
C:\Windows\SysWOW64\Llemdo32.exe

Filesize
305KB

MD5
b4a0a1b1370ad975b933c5e423afad3a

SHA1
b7d2860877b94e19a5ee61e2945e4a075264af63

SHA256
4c0e590536ad5f03c3496bd6833a721313724a08e2651aa331ee1d76ee9945f7

SHA512
48d230635988f57b698ff6a64ee7f8f0b351d46156adf7ebddaa93e9218ddbe09c73c98a1bc9b3a2d2ebd5bbf9474bb55f405c5879d436d13b49a54bd1631849

Download Submit
C:\Windows\SysWOW64\Lpnlpnih.exe

Filesize
305KB

MD5
137d61100c6d71bedfb6850f06c6f011

SHA1
eb00c8aa96c7610208de307f76f99f27df91007d

SHA256
9568cd9bff5f92bd470da8ea6744117f5a507838df8bad42b024c641436cabcf

SHA512
80ec5cb8de4419e583cc4832abf3968c68b5d4e683e107509b7665bddfa349a2460d35f3887c7bd4fad06283b6071da688a2474d8594e59ee744d944e344344d

Download Submit
C:\Windows\SysWOW64\Mchhggno.exe

Filesize
305KB

MD5
0881340630c06afa59244caa76b64cef

SHA1
031129adcae0e0409b340453b9cc905111906a85

SHA256
b01faba210b52579fbde169921111d267199906865663955c616d209d1dc0eec

SHA512
7b6d311902e063154a58d1c036db7512d5999aa37dead8e84ae548e89a480f80d0a28fb7c4f83442b19ca00894c2b8a0ad3d1dfaa8c2b90132e30fe6e33f3305

Download Submit
C:\Windows\SysWOW64\Mgkjhe32.exe

Filesize
305KB

MD5
2d7528361982a448723b53e45177c9cd

SHA1
96b30f0b41578742d7780a7afbc52b7cfe2145da

SHA256
3f2317633c099109f23d929ba86d7b7dded7c3417246f8168e8771075e021031

SHA512
01b3f54ff9b067bf7c61d3069944ee77861c9bef06aaafa543891bdf207f0e7bbda6ce19c9f2dc745c963cbd763b525a66019d82623d5da5ecb89b1e0a824eac

Download Submit
C:\Windows\SysWOW64\Mlcifmbl.exe

Filesize
305KB

MD5
033a5dfcc08a4193bd6633a460395042

SHA1
c96ed07abd83ca1a7cfd815274acbfd007d76edb

SHA256
05d2a26ab8b113e78b556bfebd9fc35e3ff86c528878ee70458c7c7ac8df9c60

SHA512
6929fb123da28bde5b1504ac9d47c955af85485bfd98fdd73bef3f49381b2417ea0c2a5f53c061355c40c3877a78ad4196ac0b2f60b3558ba3690149c132e3b8

Download Submit
C:\Windows\SysWOW64\Neeqea32.exe

Filesize
305KB

MD5
1534597719bd0ec8d5e7431301d58c80

SHA1
705eb5b5c12db45de796048eed4c0123de2db83b

SHA256
bd8b3429e5d1a78dc52111688104b93e4c0d34c2167677ff3dc31c35b1af1c14

SHA512
a314f0e23d0aa772c44e76a4831b4afe60c2e53413d26949c3dc20dee3dd55be88296656307c9bf334d10d00020c74714d0ac65251e3bac5786a2c6167b04cc6

Download Submit
C:\Windows\SysWOW64\Ngcgcjnc.exe

Filesize
305KB

MD5
5f86edd98f7e9bb1ec29c85a20f55fd5

SHA1
2ca0aa457c51619c1a3aa5d4867e2a8d0ebe6183

SHA256
b220a7322f28ea472a960616ca4d018e6b6deb8c36c492ad98cc9876804e8d93

SHA512
db4662f4040338b32e709797c9f668a7a1fc6016b2f408bd381cd330b218c026828a5735fa4f480220d27c71e98e2638eccda04a4f8aafd1bdbe763c38c9d476

Download Submit
C:\Windows\SysWOW64\Nnjlpo32.exe

Filesize
305KB

MD5
2fed41f2c23fa2727f2c4847238bf724

SHA1
785a1c3d47b2e2543f991110f1360d979e0a6b35

SHA256
e778f7b5299f0dff223d3d33cbceadcde195413d13df97700491455110ae7446

SHA512
2b19692eee696e9ef7bd538206df02861a04cfc3a8e77e5bc61d51ed4ea4d5dc5d24483ad57a730a845947aef87e9c0086bea4259e046aa57977e829a058f797

Download Submit
C:\Windows\SysWOW64\Pfhfan32.exe

Filesize
305KB

MD5
69f49e842eddc5038b27a9d36385ef29

SHA1
eec1298d5140c988da8e4ab85500a15cbc20bcd9

SHA256
578a2e01b9c16836fabb760d907b27b293958c42662288c3690572bc1bcf3457

SHA512
1653fa8688e2769b780715dacf3e7463551b7421d9ef595e6044fa400b1289fe90e7844e9f168f551b03fedaaeaa66e86d5cf2b79abc8f0595c662906073941b

Download Submit
C:\Windows\SysWOW64\Pfjcgn32.exe

Filesize
305KB

MD5
3efb73b521ef38af1b005f9a1269b26f

SHA1
8d744a8b5c76012b29953c60c92385f93584a300

SHA256
90fbb0c3221ff6b5925353557445d567247221c4d9649ef80456e71f418daa9f

SHA512
24230a592fb3946d67ffbd06809e89506a3bfe339ebb2ac0fb5738b5ae9105d9ff3b21540e69f196ed505e3aa3b08ba46246aabaaab6d5e89c9c2740fc05e04e

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
305KB

MD5
a0738e79b191c857993168e399bc449a

SHA1
9b2d5d9cfac36a5de122582a7f119c7e4d5bf942

SHA256
0a40b7dcaa6c57889abd9c1551e5cbecf2a699869735a68d60153c1536c674f3

SHA512
f7e83da8b5aabb9d5b9269543d63dd42e3040d29c6cbdcf6d823d73cfc1257f421783e0f3dbb99588bccf26bff1fbaa3b826518b5856798d98db8cb9fb2fd1e7

Download Submit
C:\Windows\SysWOW64\Pjhbgb32.exe

Filesize
305KB

MD5
4e415de253f61dc39b707aeb72dff086

SHA1
090924324f954420d38a43e2471b38af0749052d

SHA256
b470acde45ed5783ba1d18eb10f7c2832bcf728bbe299830bf148c0c645ec4a1

SHA512
eb8c1c8cbabc42e5dbd2d2fd2a406886ac14ba262b025de53199b00a4479b5c7a57f427ad6a34b866ef1b2008c1a0811d3bd23a2e630ae3d0399cb45493daff0

Download Submit
C:\Windows\SysWOW64\Qjpiha32.exe

Filesize
305KB

MD5
6ba02ee77cd84bb7646752ce26258314

SHA1
1a5ad7f242e4553a4ff515a7833db483527b532f

SHA256
52037034794230bbd10219fceb8edec6c203da8c52026305c078250bd39832f7

SHA512
249d81aea9cb0ada71c3ce28350060ae30302bd40e1f18cd904da9d6e03f9e63c72dbf1b38e86c8f1bf36d6be5af676abbd6c8121162d2052d7fe9a2bd27a7b8

Download Submit
C:\Windows\SysWOW64\Qqfmde32.exe

Filesize
305KB

MD5
fff9008c5f97d1d9a015cf9a3e1a9f3c

SHA1
70df6e40cf46a98b746e6921e7e9eb03caca2277

SHA256
21dd7453e8861f6998597ea9233cc2e412ebe84727333827fdd8c073e2fbff02

SHA512
10acdf89cc0cd9fb5be843ec5d4b64cd3faf2af3490d3400f21471805b875f6f3ab4a0258691fc5e49f1e35d266e2f3368fc7c0ba7bed3cd46be121bcd01e406

Download Submit
memory/116-484-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/220-527-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/512-322-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/612-8-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/676-452-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/740-400-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1032-497-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1048-563-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1056-378-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1184-562-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1192-387-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1236-338-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1244-454-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1268-580-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1344-508-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1456-44-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1492-406-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1524-334-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1532-36-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1548-429-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1564-536-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1640-328-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1680-345-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1728-520-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1800-336-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1812-379-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1892-394-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1908-395-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1932-372-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1936-333-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2092-28-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2260-354-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2264-350-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2272-352-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2276-355-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2336-340-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2368-545-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2384-591-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2400-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2468-323-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2480-544-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2532-348-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2548-380-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2568-491-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2628-414-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2656-329-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3000-386-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3112-421-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3120-339-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3144-422-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3180-366-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3252-408-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3268-367-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3280-351-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3400-346-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3520-407-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3540-440-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3572-353-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3592-434-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3596-598-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3696-604-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3744-389-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3748-368-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3776-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3780-419-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3864-521-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4000-59-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4052-569-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4068-483-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4172-356-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4240-332-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4280-331-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4316-399-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4388-337-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4412-371-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4488-511-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4524-330-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4544-61-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4616-349-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4640-442-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4644-398-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4740-464-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4840-551-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4880-466-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4888-369-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4928-586-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4936-476-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4968-490-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4996-381-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5036-420-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5052-397-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5168-609-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5212-611-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5256-621-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5296-628-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5340-629-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads