c0efe705eaa9d1f68a5a1db2d0ecdea26f5c4913da36e6bb9ca22134b9249a6b

Analysis

max time kernel
139s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 05:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b23986151e592548cb41409f44cd2aa0_NeikiAnalytics.exe
Size

78KB
MD5

b23986151e592548cb41409f44cd2aa0
SHA1

fb7c4090eb38e0eb9baa615eaff4fb447d4fa225
SHA256

c0efe705eaa9d1f68a5a1db2d0ecdea26f5c4913da36e6bb9ca22134b9249a6b
SHA512

bb3294039aa4529341ed6c7a88ac3490bb9af362615aee75f7911ccf71cf7d8d1acb84bda12cf4a67d05781c45105a8b0b7db1685c2948c81352b027f090606e
SSDEEP

1536:r/i40b77LSbutBteBeuMt+FMLij6yf5oAnqDM+4yyF:jyLLDerLaijCuq4cyF

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bajjli32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdgljmcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lljfpnjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cogmkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clnjjpod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddgkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdlnbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Flceckoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agffge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffgqqaip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhcpgmjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogjmdigk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbaipkbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eoolbinc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Elgfgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbiaapdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mchhggno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkopnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iblfnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lebkhc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odnnnnfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdegandp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iifokh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aegikj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dllfkn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghlcnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dafbne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fljcmlfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmlpoqpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbhfjljd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbpjhp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdegandp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkmefd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icplcpgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edpnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffddka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kebbafoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Miifeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njnpppkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anpncp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lphoelqn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlefklpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcefno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflgep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocpgod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgefeajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cojjqlpk.exe

Executes dropped EXE 64 IoCs

pid	Process
4412	Nafokcol.exe
1412	Nddkgonp.exe
3352	Ngcgcjnc.exe
1184	Nkncdifl.exe
1420	Njacpf32.exe
1500	Ndghmo32.exe
2724	Ngedij32.exe
4036	Njcpee32.exe
2424	Nqmhbpba.exe
1276	Ncldnkae.exe
3284	Njfmke32.exe
1688	Nbmelbid.exe
4132	Ogjmdigk.exe
2180	Okeieh32.exe
2000	Oboaabga.exe
3360	Odnnnnfe.exe
2624	Ogljjiei.exe
4724	Onfbfc32.exe
2392	Oqdoboli.exe
776	Occkojkm.exe
1004	Ojmcld32.exe
4368	Obdkma32.exe
2904	Ocegdjij.exe
1824	Obfhba32.exe
3972	Odednmpm.exe
2380	Ojalgcnd.exe
4196	Oqkdcn32.exe
2852	Pgemphmn.exe
4568	Pjdilcla.exe
2860	Pqnaim32.exe
1788	Pclneicb.exe
4300	Pjffbc32.exe
4812	Pbmncp32.exe
956	Peljol32.exe
4156	Pgjfkg32.exe
3948	Pbpjhp32.exe
2768	Pabkdmpi.exe
3560	Pgmcqggf.exe
2120	Pkhoae32.exe
3308	Paegjl32.exe
4480	Pcccfh32.exe
3676	Pkjlge32.exe
2376	Pnihcq32.exe
2888	Qgallfcq.exe
4512	Qjpiha32.exe
4352	Qbgqio32.exe
5092	Qeemej32.exe
5056	Qgciaf32.exe
3516	Qnnanphk.exe
5064	Qbimoo32.exe
4544	Aegikj32.exe
2932	Agffge32.exe
764	Anpncp32.exe
3436	Aanjpk32.exe
540	Acmflf32.exe
4356	Aldomc32.exe
3832	Abngjnmo.exe
1304	Acocaf32.exe
1232	Alfkbc32.exe
2896	Andgoobc.exe
1144	Aacckjaf.exe
4472	Adapgfqj.exe
4688	Ajkhdp32.exe
4344	Abbpem32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Miifeq32.exe	Mgkjhe32.exe
File created	C:\Windows\SysWOW64\Oqhacgdh.exe	Ogpmjb32.exe
File created	C:\Windows\SysWOW64\Naekcf32.dll	Olkhmi32.exe
File created	C:\Windows\SysWOW64\Bebblb32.exe	Bnhjohkb.exe
File opened for modification	C:\Windows\SysWOW64\Andgoobc.exe	Alfkbc32.exe
File created	C:\Windows\SysWOW64\Colffknh.exe	Clnjjpod.exe
File created	C:\Windows\SysWOW64\Ffgqqaip.exe	Fchddejl.exe
File created	C:\Windows\SysWOW64\Nnlhfn32.exe	Neeqea32.exe
File opened for modification	C:\Windows\SysWOW64\Pmoahijl.exe	Pnlaml32.exe
File created	C:\Windows\SysWOW64\Bjfaeh32.exe	Beihma32.exe
File created	C:\Windows\SysWOW64\Dboigi32.exe	Dldpkoil.exe
File created	C:\Windows\SysWOW64\Mdmann32.dll	Gfngap32.exe
File created	C:\Windows\SysWOW64\Glccbn32.dll	Iehfdi32.exe
File created	C:\Windows\SysWOW64\Benlnbhb.dll	Lbmhlihl.exe
File opened for modification	C:\Windows\SysWOW64\Febgea32.exe	Fohoigfh.exe
File created	C:\Windows\SysWOW64\Iaheeaan.dll	Jedeph32.exe
File created	C:\Windows\SysWOW64\Ndhkdnkh.dll	Beihma32.exe
File opened for modification	C:\Windows\SysWOW64\Obfhba32.exe	Ocegdjij.exe
File opened for modification	C:\Windows\SysWOW64\Aldomc32.exe	Acmflf32.exe
File opened for modification	C:\Windows\SysWOW64\Kbceejpf.exe	Kpeiioac.exe
File created	C:\Windows\SysWOW64\Acpcoaap.dll	Ogpmjb32.exe
File created	C:\Windows\SysWOW64\Jpppnp32.exe	Jmbdbd32.exe
File created	C:\Windows\SysWOW64\Lqnjfo32.dll	Qnhahj32.exe
File created	C:\Windows\SysWOW64\Acqimo32.exe	Amgapeea.exe
File opened for modification	C:\Windows\SysWOW64\Ocnjidkf.exe	Njefqo32.exe
File opened for modification	C:\Windows\SysWOW64\Ocegdjij.exe	Obdkma32.exe
File created	C:\Windows\SysWOW64\Clpgpp32.exe	Cdiooblp.exe
File created	C:\Windows\SysWOW64\Melnob32.exe	Mcmabg32.exe
File created	C:\Windows\SysWOW64\Qfbgbeai.dll	Odapnf32.exe
File opened for modification	C:\Windows\SysWOW64\Qgcbgo32.exe	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Gogiek32.dll	Ehgqln32.exe
File created	C:\Windows\SysWOW64\Ffddka32.exe	Faihkbci.exe
File opened for modification	C:\Windows\SysWOW64\Fhcpgmjf.exe	Ffddka32.exe
File created	C:\Windows\SysWOW64\Djkahqga.dll	Kepelfam.exe
File created	C:\Windows\SysWOW64\Mjipjg32.dll	Qeemej32.exe
File created	C:\Windows\SysWOW64\Dpqdba32.dll	Bhikcb32.exe
File created	C:\Windows\SysWOW64\Nngokoej.exe	Nilcjp32.exe
File created	C:\Windows\SysWOW64\Ofqpqo32.exe	Ognpebpj.exe
File created	C:\Windows\SysWOW64\Njacpf32.exe	Nkncdifl.exe
File opened for modification	C:\Windows\SysWOW64\Ajkhdp32.exe	Adapgfqj.exe
File opened for modification	C:\Windows\SysWOW64\Ngmgne32.exe	Ncbknfed.exe
File created	C:\Windows\SysWOW64\Lafdhogo.dll	Miifeq32.exe
File created	C:\Windows\SysWOW64\Nilcjp32.exe	Ngmgne32.exe
File created	C:\Windows\SysWOW64\Ogqnnn32.dll	Dhkapp32.exe
File opened for modification	C:\Windows\SysWOW64\Hihbijhn.exe	Hckjacjg.exe
File created	C:\Windows\SysWOW64\Ildkgc32.exe	Iifokh32.exe
File created	C:\Windows\SysWOW64\Kmkfhc32.exe	Kedoge32.exe
File opened for modification	C:\Windows\SysWOW64\Ckedalaj.exe	Cbjoljdo.exe
File opened for modification	C:\Windows\SysWOW64\Edihepnm.exe	Eaklidoi.exe
File created	C:\Windows\SysWOW64\Flceckoj.exe	Fdlnbm32.exe
File created	C:\Windows\SysWOW64\Amhpcomb.dll	Liimncmf.exe
File created	C:\Windows\SysWOW64\Iblfnn32.exe	Ipnjab32.exe
File created	C:\Windows\SysWOW64\Ieolehop.exe	Ibqpimpl.exe
File created	C:\Windows\SysWOW64\Flpafo32.dll	Kbaipkbi.exe
File opened for modification	C:\Windows\SysWOW64\Lphoelqn.exe	Lmiciaaj.exe
File created	C:\Windows\SysWOW64\Ccgldidg.dll	Oboaabga.exe
File opened for modification	C:\Windows\SysWOW64\Bhikcb32.exe	Baocghgi.exe
File opened for modification	C:\Windows\SysWOW64\Cefoce32.exe	Colffknh.exe
File created	C:\Windows\SysWOW64\Ckedalaj.exe	Cbjoljdo.exe
File created	C:\Windows\SysWOW64\Pemfincl.dll	Nlmllkja.exe
File created	C:\Windows\SysWOW64\Najmlf32.dll	Njefqo32.exe
File created	C:\Windows\SysWOW64\Ogfilp32.dll	Chjaol32.exe
File created	C:\Windows\SysWOW64\Ldanqkki.exe	Lljfpnjg.exe
File opened for modification	C:\Windows\SysWOW64\Acnlgp32.exe	Anadoi32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10264	9696	WerFault.exe	481

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhnnep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehimanbq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dgbdlf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpfgd32.dll"	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odnnnnfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aegikj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiaefcan.dll"	Dhnnep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcmfk32.dll"	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdfkolkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmhjbhod.dll"	Agffge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmogab32.dll"	Dkjmlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocdfloja.dll"	Kfjhkjle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhkngh32.dll"	Klqcioba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiclgb32.dll"	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Donfhp32.dll"	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijnlbk32.dll"	Cecbmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocpgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pggbkagp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npfhbbpk.dll"	Ddmhja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leedqpci.dll"	Lpnlpnih.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Likjcbkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gijlad32.dll"	Mmnldp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlnpomfk.dll"	Nafokcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qgciaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nggdeh32.dll"	Acmflf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdolhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcmnpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jianff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmmjgejj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjkolmml.dll"	Ffgqqaip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hofdacke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcdgpfak.dll"	Jlnnmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnieoofh.dll"	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceehho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fohoigfh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flnlhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lfkaag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lphoelqn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncianepl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acmflf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gogiek32.dll"	Ehgqln32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kepelfam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aanjpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnqmalhn.dll"	Daolnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckijjqka.dll"	Mbfkbhpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Melnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlaqpipg.dll"	Pqpgdfnp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lommhphi.dll"	Anfmjhmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gelaijjp.dll"	Ogjmdigk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cafigg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Flnlhk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ligqhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ligqhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njnpppkn.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 4412	4504	b23986151e592548cb41409f44cd2aa0_NeikiAnalytics.exe	83
PID 4504 wrote to memory of 4412	4504	b23986151e592548cb41409f44cd2aa0_NeikiAnalytics.exe	83
PID 4504 wrote to memory of 4412	4504	b23986151e592548cb41409f44cd2aa0_NeikiAnalytics.exe	83
PID 4412 wrote to memory of 1412	4412	Nafokcol.exe	84
PID 4412 wrote to memory of 1412	4412	Nafokcol.exe	84
PID 4412 wrote to memory of 1412	4412	Nafokcol.exe	84
PID 1412 wrote to memory of 3352	1412	Nddkgonp.exe	85
PID 1412 wrote to memory of 3352	1412	Nddkgonp.exe	85
PID 1412 wrote to memory of 3352	1412	Nddkgonp.exe	85
PID 3352 wrote to memory of 1184	3352	Ngcgcjnc.exe	86
PID 3352 wrote to memory of 1184	3352	Ngcgcjnc.exe	86
PID 3352 wrote to memory of 1184	3352	Ngcgcjnc.exe	86
PID 1184 wrote to memory of 1420	1184	Nkncdifl.exe	87
PID 1184 wrote to memory of 1420	1184	Nkncdifl.exe	87
PID 1184 wrote to memory of 1420	1184	Nkncdifl.exe	87
PID 1420 wrote to memory of 1500	1420	Njacpf32.exe	88
PID 1420 wrote to memory of 1500	1420	Njacpf32.exe	88
PID 1420 wrote to memory of 1500	1420	Njacpf32.exe	88
PID 1500 wrote to memory of 2724	1500	Ndghmo32.exe	89
PID 1500 wrote to memory of 2724	1500	Ndghmo32.exe	89
PID 1500 wrote to memory of 2724	1500	Ndghmo32.exe	89
PID 2724 wrote to memory of 4036	2724	Ngedij32.exe	90
PID 2724 wrote to memory of 4036	2724	Ngedij32.exe	90
PID 2724 wrote to memory of 4036	2724	Ngedij32.exe	90
PID 4036 wrote to memory of 2424	4036	Njcpee32.exe	91
PID 4036 wrote to memory of 2424	4036	Njcpee32.exe	91
PID 4036 wrote to memory of 2424	4036	Njcpee32.exe	91
PID 2424 wrote to memory of 1276	2424	Nqmhbpba.exe	92
PID 2424 wrote to memory of 1276	2424	Nqmhbpba.exe	92
PID 2424 wrote to memory of 1276	2424	Nqmhbpba.exe	92
PID 1276 wrote to memory of 3284	1276	Ncldnkae.exe	93
PID 1276 wrote to memory of 3284	1276	Ncldnkae.exe	93
PID 1276 wrote to memory of 3284	1276	Ncldnkae.exe	93
PID 3284 wrote to memory of 1688	3284	Njfmke32.exe	94
PID 3284 wrote to memory of 1688	3284	Njfmke32.exe	94
PID 3284 wrote to memory of 1688	3284	Njfmke32.exe	94
PID 1688 wrote to memory of 4132	1688	Nbmelbid.exe	95
PID 1688 wrote to memory of 4132	1688	Nbmelbid.exe	95
PID 1688 wrote to memory of 4132	1688	Nbmelbid.exe	95
PID 4132 wrote to memory of 2180	4132	Ogjmdigk.exe	96
PID 4132 wrote to memory of 2180	4132	Ogjmdigk.exe	96
PID 4132 wrote to memory of 2180	4132	Ogjmdigk.exe	96
PID 2180 wrote to memory of 2000	2180	Okeieh32.exe	97
PID 2180 wrote to memory of 2000	2180	Okeieh32.exe	97
PID 2180 wrote to memory of 2000	2180	Okeieh32.exe	97
PID 2000 wrote to memory of 3360	2000	Oboaabga.exe	98
PID 2000 wrote to memory of 3360	2000	Oboaabga.exe	98
PID 2000 wrote to memory of 3360	2000	Oboaabga.exe	98
PID 3360 wrote to memory of 2624	3360	Odnnnnfe.exe	99
PID 3360 wrote to memory of 2624	3360	Odnnnnfe.exe	99
PID 3360 wrote to memory of 2624	3360	Odnnnnfe.exe	99
PID 2624 wrote to memory of 4724	2624	Ogljjiei.exe	100
PID 2624 wrote to memory of 4724	2624	Ogljjiei.exe	100
PID 2624 wrote to memory of 4724	2624	Ogljjiei.exe	100
PID 4724 wrote to memory of 2392	4724	Onfbfc32.exe	101
PID 4724 wrote to memory of 2392	4724	Onfbfc32.exe	101
PID 4724 wrote to memory of 2392	4724	Onfbfc32.exe	101
PID 2392 wrote to memory of 776	2392	Oqdoboli.exe	102
PID 2392 wrote to memory of 776	2392	Oqdoboli.exe	102
PID 2392 wrote to memory of 776	2392	Oqdoboli.exe	102
PID 776 wrote to memory of 1004	776	Occkojkm.exe	103
PID 776 wrote to memory of 1004	776	Occkojkm.exe	103
PID 776 wrote to memory of 1004	776	Occkojkm.exe	103
PID 1004 wrote to memory of 4368	1004	Ojmcld32.exe	104

C:\Users\Admin\AppData\Local\Temp\b23986151e592548cb41409f44cd2aa0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\b23986151e592548cb41409f44cd2aa0_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\SysWOW64\Nafokcol.exe
  C:\Windows\system32\Nafokcol.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\SysWOW64\Nddkgonp.exe
    C:\Windows\system32\Nddkgonp.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Windows\SysWOW64\Ngcgcjnc.exe
      C:\Windows\system32\Ngcgcjnc.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3352
    - - C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1184
      - C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4036
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1688
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4132
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2624
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2392
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:776
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4368
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2904
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        25⤵
        Executes dropped EXE
        
        PID:1824
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        26⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        27⤵
        Executes dropped EXE
        
        PID:2380
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        28⤵
        Executes dropped EXE
        
        PID:4196
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        29⤵
        Executes dropped EXE
        
        PID:2852
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        30⤵
        Executes dropped EXE
        
        PID:4568
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        31⤵
        Executes dropped EXE
        
        PID:2860
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        32⤵
        Executes dropped EXE
        
        PID:1788
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        33⤵
        Executes dropped EXE
        
        PID:4300
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        34⤵
        Executes dropped EXE
        
        PID:4812
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        35⤵
        Executes dropped EXE
        
        PID:956
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        36⤵
        Executes dropped EXE
        
        PID:4156
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3948
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        38⤵
        Executes dropped EXE
        
        PID:2768
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        39⤵
        Executes dropped EXE
        
        PID:3560
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        40⤵
        Executes dropped EXE
        
        PID:2120
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        41⤵
        Executes dropped EXE
        
        PID:3308
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        42⤵
        Executes dropped EXE
        
        PID:4480
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        43⤵
        Executes dropped EXE
        
        PID:3676
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        44⤵
        Executes dropped EXE
        
        PID:2376
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        45⤵
        Executes dropped EXE
        
        PID:2888
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        46⤵
        Executes dropped EXE
        
        PID:4512
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        47⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5092
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5056
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        50⤵
        Executes dropped EXE
        
        PID:3516
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        51⤵
        Executes dropped EXE
        
        PID:5064
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4544
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2932
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:764
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3436
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:540
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        57⤵
        Executes dropped EXE
        
        PID:4356
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        58⤵
        Executes dropped EXE
        
        PID:3832
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        59⤵
        Executes dropped EXE
        
        PID:1304
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1232
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        61⤵
        Executes dropped EXE
        
        PID:2896
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        62⤵
        Executes dropped EXE
        
        PID:1144
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4472
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        64⤵
        Executes dropped EXE
        
        PID:4688
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        65⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        66⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        67⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        68⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        69⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        70⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        71⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1352
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        73⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        74⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        75⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        76⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        77⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        78⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        79⤵
        Drops file in System32 directory
        
        PID:5048
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        80⤵
        Drops file in System32 directory
        
        PID:1900
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        81⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        82⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        83⤵
        Modifies registry class
        
        PID:4556
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        84⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        85⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        86⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        87⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:220
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        89⤵
        Modifies registry class
        
        PID:1324
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        90⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2720
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        92⤵
        Modifies registry class
        
        PID:4860
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        93⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4280
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        95⤵
        Drops file in System32 directory
        
        PID:4492
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        96⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        97⤵
        Drops file in System32 directory
        
        PID:5132
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        98⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        99⤵
        Drops file in System32 directory
        
        PID:5236
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        100⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        101⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        102⤵
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        103⤵
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        104⤵
        Drops file in System32 directory
        
        PID:5492
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        105⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        106⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        107⤵
        Drops file in System32 directory
        
        PID:5624
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        108⤵
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        109⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        110⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        111⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        112⤵
        Modifies registry class
        
        PID:5844
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        113⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        114⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5992
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        116⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6100
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        118⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        119⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5244
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        121⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        122⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        123⤵
        Drops file in System32 directory
        
        PID:5532
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        124⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        125⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5720
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        127⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        128⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        129⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        130⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        131⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        132⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        133⤵
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        134⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        135⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5700
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5816
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        138⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6136
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        140⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        141⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6000
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5504
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        144⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        145⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6196
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6244
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        148⤵
        Modifies registry class
        
        PID:6288
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        149⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        150⤵
        Drops file in System32 directory
        
        PID:6384
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6428
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        152⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        153⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        154⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        155⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        156⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6720
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6764
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        159⤵
        Modifies registry class
        
        PID:6808
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        160⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        161⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        162⤵
        Drops file in System32 directory
        
        PID:6936
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6980
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        164⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        165⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        166⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        167⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        168⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6236
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        170⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        171⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        172⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        173⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        174⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        175⤵
        Drops file in System32 directory
        
        PID:6716
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        176⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        177⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        178⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        179⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        180⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        181⤵
        Modifies registry class
        
        PID:7140
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        182⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6328
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        184⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        185⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        186⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        187⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        188⤵
        Drops file in System32 directory
        
        PID:6880
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        189⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        190⤵
        Drops file in System32 directory
        
        PID:7112
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6212
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        192⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6600
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        194⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        195⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        196⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        197⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        198⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        199⤵
        Drops file in System32 directory
        
        PID:6160
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        200⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        201⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        202⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7180
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        204⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        205⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        206⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        207⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        208⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        209⤵
        Drops file in System32 directory
        
        PID:7464
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        210⤵
        Modifies registry class
        
        PID:7508
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7552
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7592
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        213⤵
        Modifies registry class
        
        PID:7632
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        214⤵
        Modifies registry class
        
        PID:7676
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        215⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        216⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        217⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        218⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        219⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        220⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        221⤵
        Drops file in System32 directory
        
        PID:7988
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        222⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        223⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        224⤵
        Modifies registry class
        
        PID:8144
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        225⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        226⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7344
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        228⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7408
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        229⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        230⤵
        Drops file in System32 directory
        
        PID:7548
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        231⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7672
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        233⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        234⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        235⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        236⤵
        Drops file in System32 directory
        
        PID:7948
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        237⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        238⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        239⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        240⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        241⤵
        Modifies registry class
        
        PID:7460
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7576
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        243⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        244⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        245⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        246⤵
        Modifies registry class
        
        PID:8028
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        247⤵
        Drops file in System32 directory
        
        PID:8172
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        248⤵
        Modifies registry class
        
        PID:7276
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        249⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        250⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        251⤵
        Modifies registry class
        
        PID:7856
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        252⤵
        Drops file in System32 directory
        
        PID:8136
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        253⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        254⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        255⤵
        Modifies registry class
        
        PID:7924
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7292
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        257⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8180
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7220
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7660
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        261⤵
        Modifies registry class
        
        PID:8204
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        262⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8292
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        264⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8380
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        266⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        267⤵
        Modifies registry class
        
        PID:8468
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        268⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8552
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        270⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        271⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        272⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        273⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        274⤵
        Drops file in System32 directory
        
        PID:8760
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        275⤵
        Modifies registry class
        
        PID:8796
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        276⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8884
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        278⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        279⤵
        Drops file in System32 directory
        
        PID:8976
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9008
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        281⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        282⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9172
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        284⤵
        Drops file in System32 directory
        
        PID:8200
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        285⤵
        Drops file in System32 directory
        
        PID:8244
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8324
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        287⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        288⤵
        Modifies registry class
        
        PID:8456
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        289⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8624
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        291⤵
        Drops file in System32 directory
        
        PID:8700
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        292⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        293⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        294⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        295⤵
        Drops file in System32 directory
        
        PID:8892
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        296⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        297⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        298⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        299⤵
        Modifies registry class
        
        PID:9152
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        300⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        301⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        302⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        303⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        304⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        305⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8808
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        307⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8952
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        309⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        310⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        311⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9136
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        313⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        314⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        315⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        316⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9044
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        317⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        318⤵
        Modifies registry class
        
        PID:8444
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        319⤵
        Drops file in System32 directory
        
        PID:8668
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        320⤵
        Drops file in System32 directory
        
        PID:7204
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        321⤵
        Drops file in System32 directory
        
        PID:9204
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        322⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        323⤵
        Modifies registry class
        
        PID:9068
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        324⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        325⤵
        Drops file in System32 directory
        
        PID:9240
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        326⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        327⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9368
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        329⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        330⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        331⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        332⤵
        Modifies registry class
        
        PID:9536
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        333⤵
        Modifies registry class
        
        PID:9580
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        334⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        335⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        336⤵
        Modifies registry class
        
        PID:9704
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        337⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        338⤵
        Drops file in System32 directory
        
        PID:9792
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        339⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        340⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        341⤵
        Drops file in System32 directory
        
        PID:9924
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        342⤵
        Modifies registry class
        
        PID:9968
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10012
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        344⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10104
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:10148
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        347⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        348⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        349⤵
        Drops file in System32 directory
        
        PID:9272
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        350⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        351⤵
        Modifies registry class
        
        PID:9404
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:672
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        353⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        354⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        355⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        356⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        357⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9688
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        359⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        360⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        361⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        362⤵
        Drops file in System32 directory
        
        PID:9952
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        363⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10112
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        365⤵
        Modifies registry class
        
        PID:10184
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        366⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9312
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        368⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        369⤵
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        370⤵
        Modifies registry class
        
        PID:9476
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        371⤵
        Modifies registry class
        
        PID:9568
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        372⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9780
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        374⤵
        Modifies registry class
        
        PID:9860
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        375⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        376⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10216
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        378⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        379⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        380⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        381⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        382⤵
        Modifies registry class
        
        PID:9908
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        383⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        384⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        385⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        386⤵
        Modifies registry class
        
        PID:10004
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        387⤵
        Modifies registry class
        
        PID:9320
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        388⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9696 -s 404
        389⤵
        Program crash
        
        PID:10264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 9696 -ip 9696
1⤵
PID:9480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acmflf32.exe

Filesize
78KB

MD5
fbaced1b7af7511f6ca63184b040d598

SHA1
8a6cdf311c5bf947cb1644b9b1916fccb4ae03bb

SHA256
16ce630eb68ac25a4f20803f1ef0191a50a6d11aa40b13245df03982dca1f496

SHA512
8f5b30e5dd5cdebafa053d5125dbc370ef8350239f9b128e452146f146409203eaa386e5347e975bbbc87da83bef4557da48b6a5ecfba2d63b003f18d2d27e57

Download Submit
C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
78KB

MD5
4f0c0ab76fcbd3589c35817bd70f3104

SHA1
4e9094b1717d8b1d4161bab2add52568445ff134

SHA256
31f9c667e9b1b101bfc0dc3464a3fbd12560775d0c47bca2377531a8634b7fb3

SHA512
6e205e5e080a51bf00b9d5668f3e430891ba19c21a31fe68917953624091d8ad0bbce93c1d4d4848c4a8e313a74e2083b05f1dd7072f8309102cdfcc1db05c2b

Download Submit
C:\Windows\SysWOW64\Aealah32.exe

Filesize
78KB

MD5
9e1ff9d2cf71e79acf019f4ece661aca

SHA1
c6353c6dea1ca5e3f34399a61da64bb18b0ba462

SHA256
02396c2dec6135107fa5bde597d6f6051177adc3d38cc401ec2bf1c825257f9b

SHA512
30070d1f44f2306a8ecfb9b6f18cadb68151fbfa566b67c0691feb89b0e6ef8f93d8e7b228b3642996b122e9550e210e3cf79d6eb7e4d44aa2a2232ab8467ccd

Download Submit
C:\Windows\SysWOW64\Amgapeea.exe

Filesize
78KB

MD5
7beded123b093db8e2227b0090f11677

SHA1
4575552c838b049fdb47d9360af985465ae35ead

SHA256
b3f1cf08a88d2b82631cc43d0f4aea70765e6e52b1cd826198687d85a01311f1

SHA512
25f713f8b3e7f60f9e0dec31f9e1c4b3d258b5879183cf91fceab8e2dabedf059424a2c059a16099612a8f6bcd3dc3f09d8f9e3463a18dd9185f49baaa9ff21c

Download Submit
C:\Windows\SysWOW64\Anfmjhmd.exe

Filesize
78KB

MD5
5bd33aef54727fda230756893e5c691c

SHA1
e29a95f00cbb28c4c8c7d07911f80e6c5c58e416

SHA256
16b8b07c7cdc6e4ef662b98518342d3cf6ff3b25fd0d8246e9f8d0c3f113f222

SHA512
2cf3e382fea2061f3d50783f1b4425de18aaf968c7415b4c1782b5987d4340efa632d43f1350a069ec3f40fe0150a1c1b0043232a9eb6e5bd02f0d1146e8eb66

Download Submit
C:\Windows\SysWOW64\Anmjcieo.exe

Filesize
78KB

MD5
3e8ce656009cc71d9152ea85fbe691f2

SHA1
a3b408cbb38990c8da5720250c5f2da1cbbd4c3b

SHA256
7af8afcafcd552bd346a4635d0c7cec5776fafd0a60af9fde35f0b4a53aa1acd

SHA512
d87ed0cf00851f10d9c8304cecb1ee112b200324a434022157aa85fcb8656cf5e20f9ea8f9ffe4d06c577d72c6859f4344d84994c0606c852546e07ffc48f577

Download Submit
C:\Windows\SysWOW64\Bajjli32.exe

Filesize
64KB

MD5
bcf9b25865df20808fcd3a00e0e146a4

SHA1
9f8491749006e2fab9faa657e9ff7beef752c37c

SHA256
9a765691d70d982222b86cbe7a08048250f5649a898746386680639776094d3f

SHA512
298d22a67f03428295beddf155238b1e50ac231641029bcdbae32bd30e1d264c93c5ef5c816338d26f0db317394cae5539929a596436749dd90c6d262177dba6

Download Submit
C:\Windows\SysWOW64\Bjfaeh32.exe

Filesize
78KB

MD5
f0452a32392aec847858ab0ec85764d0

SHA1
5bebdf493028286f5593e2e64a33b6cfea3ed43a

SHA256
04306bac91a5fecec5a59c5b6a8b2cd9bcec6ba563164d0f19f4627db61f19d0

SHA512
4fe3721e8350bf55fbbde86c102e57591e85a494d8322cddbbaf53ba5dedcd535c211c268b8b7e7779485c05c7c2e44688aa2f4efd89682626d18809d6c1a705

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
78KB

MD5
44de8364d399e9dca722f648112eaee1

SHA1
511a78092f3dffe880968a85a8f486c54278f116

SHA256
0b15afc1c119b6ec2ddc131c9411982c839bd3aa5e8a76ca1b570562dde91c2a

SHA512
52ef916cc3fd65e737f9168919d5f2c1a4ace91c9378e6f436bc79fd20d59773c2ffdeaa09c616fcbdc897c09ccc9e7e81bafd2400276730b6c850788e6f1b52

Download Submit
C:\Windows\SysWOW64\Cajlhqjp.exe

Filesize
78KB

MD5
7fd73acba0917371ca92c2a609fa948e

SHA1
b0e86c5af371d49f77cf37072ba28fb3d3a07daa

SHA256
e5529f5a7bbc147f47dc1cda7b92a113e56fc2cfc01587206673e8c46f84d126

SHA512
eb7f045ed1227943d957842add67e7da11e233a49b511694b7b179bbedb8c7d342f7bffbb52464c5804640c3feca7728a519bc776c763ddf2ee18f16267de439

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
78KB

MD5
8960ae92bca3bf171890507573541192

SHA1
5e764041db091d003fff91c6a7ed7f49bdd62902

SHA256
b852beaa173424550a723c53f012dd4b9789e0f0f3eef7bcaf324a8a33b3381f

SHA512
5c8c71696166a4d7ca59b88397fc1560f9d496051d9b6c831f2b28479aedc029cbc4f204ce452352bc52c72ec6a492344d253525700bf1a3518a98700f888e3d

Download Submit
C:\Windows\SysWOW64\Ddgkpp32.exe

Filesize
78KB

MD5
c4c4ddfb2dbd0e86c72f7cd112e1c46c

SHA1
5dad8207605fcb8785a959e8c9e3ca8cdbfbca41

SHA256
6eea86658f96c382bafc5b54945b65eee7344a73b08ec3d85e7687cd5750d017

SHA512
f5d1871601c1355779c541322295869cf798079316d244fe9814f7057b6444ab540dc2d0aa845eb1cfd37e9a7295c49faf016ea74b833b04cb6f72d974cebd5f

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
78KB

MD5
bacd132729fe5a7cd4e80ec62b6582a9

SHA1
c479bb7624d5bb50da75ae0be874c2d52953c3e5

SHA256
e5f19e2f47e3e0c0008eaa5f553fd6936170575392c282636b67a941b33188eb

SHA512
fea1da5320e868a2ea196034b404f87b79a5974968bcb60ca68351cb63f71d684aa2c23c58a24a1f8747d6ec4c840d4eb677373386fc36da6ae0c57801d9df1b

Download Submit
C:\Windows\SysWOW64\Dllfkn32.exe

Filesize
78KB

MD5
653cbbfa51d3a270e78c208fb1e27bd0

SHA1
beb263b1e75387c393cfc9249e5f59cff908838e

SHA256
724430b314454018fe9a285b83939e82a15d61041fc18995849fa79425161685

SHA512
21906f4c94f00b123abf16f7d89a2759931fc8455b99131868f543d1eed46f734595b65a391967392d98f42cf0468f960beb6377b9453d966df394cbdcb5a115

Download Submit
C:\Windows\SysWOW64\Eeidoc32.exe

Filesize
78KB

MD5
ab173de25c2618f0ab4b96ba762f704d

SHA1
356ce2a51dcff65fbd62f7bd270a2f85f1c11677

SHA256
fb04ee4ab7c86e8966519d73013292882c7033f26bebdd249ce6669442c26330

SHA512
af788e95fa7772c307594ac23f4a58ea4cee834fb2c6e216ac6c98ab436c4e628c16f741296bf914331e9aefdc6762eca090ad7240888bece3b223fcbfe5e010

Download Submit
C:\Windows\SysWOW64\Ekhjmiad.exe

Filesize
78KB

MD5
d25420e2f6944b7818dea7277bc2816c

SHA1
9a1c0fb039ca65a94557ed2c20c55dce0a449bdc

SHA256
e7852c73ff9c930bc5d0e182ae4fbfd6e4c79548fedc35168c0f280e6155167c

SHA512
f47d2a79470d46ad5d42ab83a06e96d0dddff4c687ca8c075e91d7260a12ad41e84f6ca623e0d2d742509ad8a01d8f9291b8a5dbb67c73d80da8e33b07bd4e66

Download Submit
C:\Windows\SysWOW64\Eolpmi32.exe

Filesize
78KB

MD5
d1e4014adb71fb7170e15d57d236b725

SHA1
a6dab304f1c00f74c900fee18e0a2d50d9dee14b

SHA256
762c45071e75382d0a108dc609117d0053cdbd585ad15e4329d71ad86b16e0ff

SHA512
e7e0cbcb388401ced57eddf2db74a1c414e68c95bb3b6eac861e39d64e248b4ae8524d41cd2f28bb225a753d0fc585da36df0b6eb732b91301005433daf84359

Download Submit
C:\Windows\SysWOW64\Fdlnbm32.exe

Filesize
78KB

MD5
07ac4c561f8a594ceeec47df0eb2b33d

SHA1
266fb496439b83b7ef47dd9b4260610e7829fa7f

SHA256
5d8e67fa06264341ccba32482a418c9f1af285f166e039369ed8e2537562ecd3

SHA512
439f69ce7e129111fcd701bf04398d83b619df4bf3f0e5c9995b0132515a6d6803076ece45ccad6eb852c2ea8c18749f4633e6757ce0468050a7c103ab03cab2

Download Submit
C:\Windows\SysWOW64\Gbdgfa32.exe

Filesize
78KB

MD5
5cabb97eb0fbceabf82c66b5dacb7ee3

SHA1
e8317adb2d1fed36cfb8fb7650cf876c4a9848b0

SHA256
c2088d86ff47a030f81ed7fc94155fa329da4588c8637d890f04c17ddc1546e6

SHA512
422b1fd308d88edea0fbaaee25c125fd06f019de8a07a2865399736930a11fd613351a3817bd6c564cac907c59acf68a98b809818b9c54daa945aac37df943fd

Download Submit
C:\Windows\SysWOW64\Gmoeoidl.exe

Filesize
78KB

MD5
78f159b8467ecda014fe5a2a045c59e3

SHA1
6d235c5b1e4a0bceb854b892593605673b37b7fd

SHA256
3fb40fd3703b63903013db48a006c0229dec13817e706848cf08d69793e90679

SHA512
1c6290bf35e720dac22390e2fea27117079815886f62166d425b1480404b343ac5b42d13e7bff6048882e96f9763379769e378f33e3509a4456bb5d3f8c7bd02

Download Submit
C:\Windows\SysWOW64\Hkmefd32.exe

Filesize
78KB

MD5
b2e345066a4c6e033e3cecd98eb8b211

SHA1
27516697bb61e1f822477ee94ae614cf10922d1c

SHA256
dd6920370d428670bf01e5338f8f2872eaba9afcb8db455d5cb65292e2582fc0

SHA512
871c512ee126094dd0596d7734d648f0ee3f2785320121bde025fc6702d3dd874bc4ce389c8dc981d3c42ce6e2cb828604a3af88ff53b85327eb50749384e9d2

Download Submit
C:\Windows\SysWOW64\Ildkgc32.exe

Filesize
78KB

MD5
529113aa9e06a8d265c08565f394001e

SHA1
f57844f5954e56c01da78eb3c2e1c8157cdb671f

SHA256
2c5f198594c6e8f491d172b1fb4017a57e6d0fc51f7d30fca3a47d781f7bbb30

SHA512
3b6ab127f6c42c27312082a16f42170f27415bfd71cc84604701ecce2fd4cfe2bb9ba12ffb16c3a22094a3137932428834d9ff8fa7bf820630a9a8b9490b3a42

Download Submit
C:\Windows\SysWOW64\Ipbdmaah.exe

Filesize
78KB

MD5
53a547118b502f825d1723d127991480

SHA1
c51346186efffcb7c9aca3ceb8e6fb8db852b697

SHA256
2d483f2ffec58fd40d14d563835679bf6227128c725a5f9a4fef3a5ffd103cf7

SHA512
64acd71da1b0b90890ead394f0c14163e92795d0caa0760203a5dc0928f8c931e84364206bc3f6363e6ef82662d6c504ef28ec353d80fff29cde70c0cab4a3c1

Download Submit
C:\Windows\SysWOW64\Kdgljmcd.exe

Filesize
78KB

MD5
30ad1e148a7f4a59a3fa610705343f27

SHA1
f334a05c2f61de69f44cd30ca640702c52cedcd8

SHA256
6543f4e10cae27d6f969f7e266e87df41a802fee95b08d792fdf0445cde0b37c

SHA512
82ee5cbf4bc9d6d396fb7d5ffd1e4f63a402f8173639305deb43c525e6aac97fbaefce4a5d5e8c54945da9fac5c3a06f34610090f791f7fe899edf48041be297

Download Submit
C:\Windows\SysWOW64\Klgqcqkl.exe

Filesize
78KB

MD5
9b806c16a3acd841d631ab50b4488245

SHA1
40a4ead7098ea1ebf4f8e4cfdba53a5da93fc0f6

SHA256
e6105255293f8a5e2016e7bf7b116bf7eed5ad16f10eec8d969ba58154e0978d

SHA512
09de46b824be16b4231104f51ea1b45f50f29958444b7986fb8bbaacf76ef1064de6b1e4ccb2007fe6e97cd19a5c4f36a3f35b7d4ad25ccf3c0aa352d90355cb

Download Submit
C:\Windows\SysWOW64\Lbmhlihl.exe

Filesize
78KB

MD5
a33b7bcfc40e531c8322f9cd6665135a

SHA1
2c182b96f67f74ae2e327d45ef90c1cff4acb121

SHA256
8d31a7e17c199b433e4113dbc24e39b15679ade5b332c54abd8ab37a2f03902b

SHA512
7f3416ff1d884a8f04a2bdbf309b4e04ec12da5316c3a237852ade87e16993980bd9a28d16b4b10b5b341d5c3d4d2f844607791b660c43dc04bd46f0aa9d6c5f

Download Submit
C:\Windows\SysWOW64\Ldleel32.exe

Filesize
78KB

MD5
5694ddaf288acdc69d17ef1605d3e85a

SHA1
5f25c7b8a85a0bda5b76a21c9e4ca6705aacc247

SHA256
c4e89098dff0f6d4194dc8e7d46c4f54e67b792c77e883fa9e8162f38685e514

SHA512
ecec62054b384b8230bde1a61a619d803a25f2a0052b9f024d94b4a17495d0ff7b708510a0deec4479d058b287893ae475ec46db8234ff6f181576a7aa90ca05

Download Submit
C:\Windows\SysWOW64\Liimncmf.exe

Filesize
78KB

MD5
20dd3595cfdce13d5b9aeb89bf613ce3

SHA1
48bc2627bd3eb3d680eba94cead0e429f0c3887c

SHA256
4bf182e05ade67878915e2b31d3a3ffcc52d8b9b8d5c15538bb03952a0163aff

SHA512
b08bc0927a358a99c3a4ef0ac9de15b5015dea8c04170fc8621c1e619b3da9472e2b2aa6d967ad12d7f51b2ed47720aaf61e244c69954b04afcf76ef91b84ea1

Download Submit
C:\Windows\SysWOW64\Lljfpnjg.exe

Filesize
78KB

MD5
be7e5491c2eb42eaec0e915ece68416e

SHA1
d1dc1edb7a6d8bc9805b352d271d1d8a37fc09be

SHA256
faaafb56f27dd9337c9e727479ef6afc469031c73e5242f56cd1b083b71a37c7

SHA512
b9fcdeaf68cd06bd24b2579cc3e5144020b41331c5a1a6ae2baa9ba4a848c25b248b2b440733b2f615012cb45664d6c2f6ebec6d9db1fd9258e74a467878b669

Download Submit
C:\Windows\SysWOW64\Mgkjhe32.exe

Filesize
78KB

MD5
924968e3979564ec35be7f2bd25c55bd

SHA1
aefa3c988eb28af88eb1a87be045e4a429277375

SHA256
e12b63ad254231afbe0a59f2298f246aae42abdd94e1e78501197461efdebe77

SHA512
2656e64dc8353086e629407f70d5ab0037bc09c6aa3fbe202abbb4e4b12fe426163ea35fa84563e27924a188f0d80ee37679792c14c7c547d237cadad7077ce6

Download Submit
C:\Windows\SysWOW64\Nafokcol.exe

Filesize
78KB

MD5
521ce6c6835bd260d7bac2c5c0de6145

SHA1
b11a39a631776aabe04f88c980e198aecb121b72

SHA256
b78696f5a2b704822c11cd47929ec8bb8ea6fb7fdf9d2606c25d58100f4ef465

SHA512
b25f499db256ab2a6170e170682a7f7cde8e075ac9878f85ac5aeeda2cf5a79e909f320c513a6b9402c17f08ffc4bcea95a1ea827a029a4e94230790c5e493ae

Download Submit
C:\Windows\SysWOW64\Nbmelbid.exe

Filesize
78KB

MD5
316a689ebbedd875f60221f6a0df402b

SHA1
2b118711faf238d4c484ae2521fc4f2d64c19633

SHA256
7a8fbfb4d5fe367daf55291d77460431e7a6fe8c4b4e69a99303dd0d2249a0b0

SHA512
80f854ab46e70596de188bb5b50c7f168955a2ff757270c38a64f934127d8cc04b4219b0c8da127fd19a9f19d26831475e724944af3cda18feb933ce59189096

Download Submit
C:\Windows\SysWOW64\Ncldnkae.exe

Filesize
78KB

MD5
c4e0af5c9afc686daa4c7075ff30d699

SHA1
20e1b4a6136658f31bc38bd31f33c9d5d8f36b5c

SHA256
9c85b66b29c18cb9a1228f5d94f4550c87f837edf5176d182328febe9eee0138

SHA512
5a0ed2d662903131409d285ae831aed0403050c1361950e731fad7968db7db19214320ada2f3507ceae4d1377b7c4e725b8d3909bdfbda20880a683ee9e9e354

Download Submit
C:\Windows\SysWOW64\Nddkgonp.exe

Filesize
78KB

MD5
02d5bf775193b16309539d27004a48b9

SHA1
f4ba2221be3fc143d85905948622077dd40b7110

SHA256
d2adc068f752cd4093fbf98609abbf5dda0f266749aeb1f6503ac5cdee12deb8

SHA512
8e1bc49512585836aa720c74870ec5a8d17ebded5513fb057b6956b848564d63fc187f34827369f57e79a94fdb22572ec1e04b7e3126e2687971b7df46e4228c

Download Submit
C:\Windows\SysWOW64\Ndghmo32.exe

Filesize
78KB

MD5
a938772fa0b4ecf2f9f9810a427b65be

SHA1
ab3c86d0d1437e0d3a3b0e172505983e583c2948

SHA256
8406056e1b1330330319ad167992702d972e6c97e4e22cd20c05d9dcb47b81ae

SHA512
9c3ada66ad4a2ae0781f0cfa878bccb6a4b9209470a50f00f8388d07c52c37528e6a5a8e21dc0362842ef63db8d61212678180f05fa2b4f677159598d10947aa

Download Submit
C:\Windows\SysWOW64\Ngcgcjnc.exe

Filesize
78KB

MD5
44e85f11d94cac1a773e47a7cb8406f2

SHA1
0f167418efd0596153780fd43ea3c94d29a01079

SHA256
13d9c47fd605c81a5a355b4f502426638ed39324f9c928b96621a0ad69592a19

SHA512
7a94d3cd1fd5eebd0e1ad3016d4e1cf118eba0550c2c351cbf06b87088dd7eee5ff273a9f322374284866adfaf2d73537a2912f5834d93b562bbdf9de5ac41b4

Download Submit
C:\Windows\SysWOW64\Ngedij32.exe

Filesize
78KB

MD5
203a8bfe002e8896aba3beece719592b

SHA1
47134a171fd5c4d61ddec00842f281aca829f77a

SHA256
ad578e6fbf5f57e0155b8dee02627ce896c6f373bb457cd405d77cafc4534bbe

SHA512
1656504c0eff17a97eb84a477e32dfb5ef8b82a8a42b7ef37b2820f18af889cefdbabdb63f29e3ed10ce518141f99af3d2836bd7480ca35ae85ce71f748b5ac9

Download Submit
C:\Windows\SysWOW64\Njacpf32.exe

Filesize
78KB

MD5
385fd47d15abe398ba5a2f63a00c8cea

SHA1
2587ad910570cf7ba6e1107b8a3c6801b2d78d67

SHA256
fcf5c8195e68f7ed4187fa8e84080c6b2737eca4975298bf9d7e8ae9e7a7a1a0

SHA512
83af6a4e6f77ff6a8dacece03844ba059ede1da96ac96353eb2302e41315539bc88d2b852001560d455f04f59d3ec4495a3add8542a644fa90a535b56771542a

Download Submit
C:\Windows\SysWOW64\Njcpee32.exe

Filesize
78KB

MD5
125fe688ddec0d456bef5003474c9531

SHA1
0b754fedab424b6cd62583bb244c1331cce7f90d

SHA256
2931880af7ead0276cb29fc8e6da8287919fa56a020eff59c27da53a42567795

SHA512
b0635f4f20ae717cf6c0851ce0c56866085aee1264a6cfe1a393988b5917b6cecf0ba5f92aed3db264782f503f845d4b600be3f8cc72c8aad1251e157b8fa686

Download Submit
C:\Windows\SysWOW64\Njfmke32.exe

Filesize
78KB

MD5
2d08e65824a992c8f800032a91e0416d

SHA1
3fd255a99ed982b1b08bcc639add3b9ba4c2132d

SHA256
3dee408fc16291dd5d9aa3d784171fd90e69bb732253f0f0b1c88df3c831d3ce

SHA512
7e928b9d472360f5999cdcd19025052e9d65e6242b3919fda182d15132919ffe8b848d760d80053a3ab0b5e2650498ca98b4b6caa611c5b0a1096ecbaa42eba8

Download Submit
C:\Windows\SysWOW64\Nkncdifl.exe

Filesize
78KB

MD5
be6117b95cf73ed751941964d254b90e

SHA1
da0cda4636aa1e804ea40b3ff1063b92f10422a1

SHA256
0849b9e95a2d02388ea9a10e4d619e4f02c8235a737816828d4f1a47c3ebc949

SHA512
7b4890d5325ec683532b6b089f64c3021655cf9affbcb5f85b569a621c7890ec09c7b5d02a573bee3eaf96f3caf3e6b5b0bb5c1b1dbe780e340cd2fd4a4897fb

Download Submit
C:\Windows\SysWOW64\Nqmhbpba.exe

Filesize
78KB

MD5
af47517ea94bb1b8756f44b527f56255

SHA1
35576bf0bd070d64a014a18f43e1d8a42d1c286f

SHA256
7984765be8ddbb8364c118e2cbdf4cb8b63f9186df3ec9d2a1e5de88e396ee10

SHA512
1f305c042ae4f018d7644880449f1432f6de9d849772f2c417a0d3bb838f4623c47abdb7ebdb332a6e2e831de34cb573ea6149dd8a85b04df4c258720d0fbb64

Download Submit
C:\Windows\SysWOW64\Obdkma32.exe

Filesize
78KB

MD5
b36bd817674af722f76e0cf61de0f163

SHA1
7a38633e429cc7901a990911911346a30d0c6336

SHA256
a22d9fe90176569367fadc001318b9d7d44df607a8b050fd118ab6da41699bca

SHA512
ce08f2b5fc8d4f884723126cc61ae236fa0d8bf0565c45d1f66dd121c36802f80c9769cdea3b995d2d335425ca3513307650f54f4f3759dff042bdb374739b33

Download Submit
C:\Windows\SysWOW64\Obfhba32.exe

Filesize
64KB

MD5
3a2f6d6e605c2f7ac5e0a829c560bd82

SHA1
4001a1986a290cf994ddd590cb5d112e96179a72

SHA256
f1b36b707d02fc0c44758808e7e273519cc71a4157e26cafde19fe9c1cc4e08c

SHA512
707f5b38c7f444b067cca17128074e56d9b4be9886c894806a653e820dd4a6075ba4f1dae89a3f835d84903db0dc94ed1deb985c9f197115a6f01f206bb7bc29

Download Submit
C:\Windows\SysWOW64\Obfhba32.exe

Filesize
78KB

MD5
89c8142d9e5c9b8041859bd941511e18

SHA1
14ac116f266ddc22b404b307eb02c49601e6df0e

SHA256
4bd5d45d1356bf5817e4accc4e9b893c9d2b644c5b215bc07e33e05e6b698c22

SHA512
5d09146bbf8ada58980751cc6987de6586ed731523df0d0ff782c9739104bdbcfe4497e9c17221f54c6b0c40e56cb3a02c480c7061550da9610a08bc7d67d926

Download Submit
C:\Windows\SysWOW64\Oboaabga.exe

Filesize
78KB

MD5
c3acc7bc1701a3f3f6d7f3fc38afdbac

SHA1
d947f2a75101e2ba0213b74b3a4828ed8bc0c249

SHA256
17c96b592ac787e627577bf6a355853128f8e11483e6887fe17c5bb7a5ca0e75

SHA512
3c138b9596b297b1c70c403404fe0c04237389fd0f28cebe89894c723145d0ce74904f43095788c1e2ddefd4804b7d66266b7c1c672e7dd9f1a3d84d1d780e88

Download Submit
C:\Windows\SysWOW64\Occkojkm.exe

Filesize
78KB

MD5
66665f7d4bb67188fc65992e69677cb1

SHA1
451d00bf5e703ea25b87652fbf2d187cec32b1df

SHA256
bfef0883c290d8a0a2375f3cb1f5f44a92fc6b584b6e0eb2884223f3057a5a77

SHA512
b1859edde804f2dd8441a0e4ab3056327f379a8ee9f7e3673bd14d69e131cfad06681afadcbb0403a352e6766be151da64440d1931e708fa14a65b56556b74aa

Download Submit
C:\Windows\SysWOW64\Ocegdjij.exe

Filesize
78KB

MD5
80fb62bcc2b5112d44bfc8d94f987d49

SHA1
6a3ecae8bf0a11ab62552ee9d790d435913e7fc9

SHA256
10db6dc1196950024d3902f771293bc1d2f1bc06c36703cc6501d3ae75112754

SHA512
243abea6dbda6490ae07607c588f4d4db397ac48524ea84405e38b07c0b9f4de0959d8ba266cf165f706cd2d4c3b647a7b10e3daf5bea574fc6c720ca46ec843

Download Submit
C:\Windows\SysWOW64\Odednmpm.exe

Filesize
78KB

MD5
e8a3d5bc0224d9e2ff7f21dca3ab80b6

SHA1
7b8773f1694370f8ccbee6d0ca7fa7053a16ab0a

SHA256
2e13e7364fafc07da3d153887baa741ebaf69229bcd3dcee10599021e49d878c

SHA512
fcde5e41bc236939104ae15d4b0ab0e156066b37d2d3a0654a9f4ad722027bc9287046595ced242745b363b966970ac00f42a4603b84fb3923b696712f0073a0

Download Submit
C:\Windows\SysWOW64\Odnnnnfe.exe

Filesize
78KB

MD5
087f99096d1a0a3d485d182365a30e1b

SHA1
1c660fda5b1512218e51624e13a1114004c98aca

SHA256
c68ce451403fe1aeb8d592aa17616d7d8458a40005e3bcb95ebdb9dd78f1ea89

SHA512
d42b59d1c44a0ada14ede8ebd54a3b579934e1431688a1784e1ec8d5bb5a624611a4d37a2a82ca3ba75445b25697ffc80e65dfde5f4c1e314ab94c5bed814210

Download Submit
C:\Windows\SysWOW64\Ogjmdigk.exe

Filesize
78KB

MD5
a84632ee5c196c41388f4963a465a4c9

SHA1
e150655eeb120706c00bb6e86513a4ae63f4399b

SHA256
cac258b481b366024ba11d33a3902a65c98acccc453d8ae3d4c8c7e8d57b85f6

SHA512
0fc4f24ba0da6c3a793904ca8939570935feef489c4dd4c3289fb657ccf7b078cd4b526c567a3da4606899134b4255363f368e9d0373d13ac011a0b14a931378

Download Submit
C:\Windows\SysWOW64\Ogljjiei.exe

Filesize
78KB

MD5
39077de6bf4c6ceb11e3c0d8e0f2d8f4

SHA1
305a257ccb653d84a9b52cf689de58d9e625cb1e

SHA256
49f8b9fc5f1c4ae521b70bc02a8d593724f7bb563124c9d3d6750377dbe1d5a8

SHA512
f5c8259431efdfb1e053bff4ee9dd0f384f73dbeef2f4be03521c7b09f3f5157aad3411dc26d765de27a72efeb76701f2104917fa5c25f744cb11f2c083d0096

Download Submit
C:\Windows\SysWOW64\Ojalgcnd.exe

Filesize
78KB

MD5
f63c98c39bb303b33fab7424eee6f7cd

SHA1
fc6ae63151ea4598e640e32ebd3a9c3efccee810

SHA256
9bb0bf0b5896d06365ab20d9a17066ea155b8fe8f1a5716d6bddb29b7970569f

SHA512
55f008837ec23f2428c251a0c6a58137f1ec60cf9bc92c981ddb8e0d38343858e8b7c282e6015368abcfafe8ccbc4bace0cc2c1e32cd91fb9ae41f6e8a78beea

Download Submit
C:\Windows\SysWOW64\Ojmcld32.exe

Filesize
78KB

MD5
6ce2af01a7d0d457a38e6b6f97bc61dc

SHA1
eca8bc390d622271e96058f2d5db928b9b6521a9

SHA256
3e802b117b1a90f0f32d7959e80a1fdc757d3bb862b30a62e6c13a70b49699e3

SHA512
69a2d4f67d3d05f29534cb7aadcdf75e7b72ca43af12169e550a6d84410ebe9b9b362b69af8bce466304835ddeb22be39b8e237a1fc21c28f3d6c17ecd8a292f

Download Submit
C:\Windows\SysWOW64\Okeieh32.exe

Filesize
78KB

MD5
5b9608f8bc09f2f4cfae7d56fa0d2704

SHA1
9c52567b91148b82232f18a91d0314de35598f39

SHA256
9ef6e1068c884ad34c079e56c93b9e82191ae8d2b50772a1acb2f98bf6856348

SHA512
e7faa08266d4de512f2566bae91cb01f5cce2cc4cd919d2c4c26b74a4d94d823be32692debffe2217df3f3bcdabe611426668a07e2f5b94e124c36df65072b22

Download Submit
C:\Windows\SysWOW64\Onfbfc32.exe

Filesize
78KB

MD5
cd7d21c8ff651cf31a7f9eb5b2524cea

SHA1
9b0d07acd566d336416592cf98a0a23547312b0b

SHA256
fbf00cfe641a187a0a7938e9f77c8900a18d635220880010054255a81a52506c

SHA512
8e5eefd13aece30d71e840782666bba49df5ae582b52433343beaa47a44bcbfe530d26fce0661b1c6ffda6806792dca6ef38d8031587a6e284c1b8ffeb7922d1

Download Submit
C:\Windows\SysWOW64\Oqdoboli.exe

Filesize
78KB

MD5
fa45db6f442d2fb7ec5d4e6142ff852b

SHA1
abc8c5588e8c060506122be93771ce97a7728dc6

SHA256
1ebc24f583931b55c6b3827c3db966a4019e91b7b861549c2e6029b1431b5a4c

SHA512
8235b76a2d41e1ebf92a028279153db20d108bcd5389dcf9d25f9c5f42071abb59b3d46b7c94cfbdec3816746ce960a8715a9f85d12159562b345b3847a25592

Download Submit
C:\Windows\SysWOW64\Oqkdcn32.exe

Filesize
78KB

MD5
5b2dbbc81472e7806567b5563f354c53

SHA1
e96c98de2650f8cfdf86d1c14813df3a2570e918

SHA256
692981e43f5f49d1a67a2b8d98df088a602b9e0f3b750c7f1d19df35d3af57ab

SHA512
0573041de9db6aa789286aab3a4d59aadba06bfb64fd18a4d07d85c7cc6818511ca3efb920f2652fe8d55fcce7d311409e29c749901e916d23ab3c8d860685c7

Download Submit
C:\Windows\SysWOW64\Pclneicb.exe

Filesize
78KB

MD5
ebcad7bdd2165f7c3b947ed703017372

SHA1
3f0457be6016f34c71471f77882e57f91265dd89

SHA256
8758828254e5bf85524fe504fd11d81261f4cb71c919e1c790a024105d945eb3

SHA512
09bd2bf622b562266c555a781b983d6ba709f7066d633ede108f16372db945f10f43bc2be353bbfc3ccd652e1b079ad3ef0d085e7c00d61f43482f37562e0df0

Download Submit
C:\Windows\SysWOW64\Pgefeajb.exe

Filesize
78KB

MD5
8d29d72a1d4e20145528d746aa786ae9

SHA1
08d1b9ff4c54e8dbb5507ec65109aa477baf1dc4

SHA256
50c2cd0e89f0084fbcef0e4326f0a2e7da0ea667bed9e6940e6bab5295da81ed

SHA512
ded4cbdca91a1150e3049d33591843e96e1b3f043713225c7378bd3371559bfd1387ac11fd3f371315abff26dcd7ea9f6844ee86a65975aa6ac6204f719ce6d9

Download Submit
C:\Windows\SysWOW64\Pgemphmn.exe

Filesize
78KB

MD5
c082d99acbd882a58b59f38783f5df7e

SHA1
5d01970ec4cb2804f66b16eaa1dc00d43e3ae9a1

SHA256
2a969e2359e5fad8ce1004b7bdee60390fbf28e3f1f724cdf037fc914d1a8e6a

SHA512
d3799f6891b09bd8382b84f304ffaeb4fc90f6388cd75a1cfa74a5e4093b71d91f8a93379a8db488311fd6d4f2942cecd52c3cb3df10f39952bd2eddc2fc9f2f

Download Submit
C:\Windows\SysWOW64\Pjdilcla.exe

Filesize
78KB

MD5
b3de64da0f053108a5c9fdee7e418d1e

SHA1
b368e0ce85efca434678dc6bce0bea31bd603d63

SHA256
7eca4dc9f9c994706b0f48b2a3b52e91570d8bb63dba2c27c5a4076f1179fbe6

SHA512
93308ad2643d92427f4ebf6b407d4656c60b15be8826a6f4a73f7428f62ae9c00fcd94e7262e87b47134002f2757c2287e67322bc0d0845714c7d5907c4569a3

Download Submit
C:\Windows\SysWOW64\Pjffbc32.exe

Filesize
78KB

MD5
72b869725580fac5cb79f01a58b95576

SHA1
9348a26d359f660883d193700bbb3670ef7a67a8

SHA256
59650e51f5b5769ce8761bd8900c106996f0297c845afa8da29452e2241f90f8

SHA512
4478cb4ba4c01ef975a2336257083ca11842e70047b4d5d5c5b1b3cd4bd651e386b5aa893abec250ea9573e3b74fdd08cff4c1ed0214f9fb8380aae0bb421346

Download Submit
C:\Windows\SysWOW64\Pjhlml32.exe

Filesize
78KB

MD5
8685384efda4032ff4418a18a325aaa3

SHA1
28f725dcb4ab35550e66b2fa63ccd27fc62f71eb

SHA256
43ab39bc815005d1f87798b8352f6907b806141e1351449ef798ed17afb15622

SHA512
507ac6bdd6ed72ceca027981928537c3b8781464d93319160f730432af1477bb6484e7ca2d4031a36f7a3b06271e9e33d2179c9415ead7c64d39815d39bb759f

Download Submit
C:\Windows\SysWOW64\Pmoahijl.exe

Filesize
78KB

MD5
79a60b6090ae70ba9c4ca59af4e55b91

SHA1
a86794e3d74bd7480913c041e8d702cbeb15873b

SHA256
1908cd7288d2d9b57972c31df8200086dcc8a7c7214babeaa4c8789c9391fde3

SHA512
3af847dac61d7012d4324b9af2fb2712788609dd171b1af7cd7954a3b02b6ec72d299511d3b3b122f0b861393c778ce8118709ef0cde3eae68367b24e50d1ee0

Download Submit
C:\Windows\SysWOW64\Pnonbk32.exe

Filesize
78KB

MD5
f125c276575699905f5f1210d6c25f5a

SHA1
ae6a6259a49bc613b09dcda3f18f5649d0c860be

SHA256
0cf5d0d2eae2d73a04678965234ef3fad933deef67311aa81388d2a7034ab743

SHA512
a7b76816df6add01a1aa93751a4744d0c08d6ab5d07e770964e36647f4a2d390a15f652a1901a36ee0fb5cdbe4a57e9116919642c138e694f9d22916f55116cc

Download Submit
C:\Windows\SysWOW64\Pqnaim32.exe

Filesize
78KB

MD5
f9a88d0cc16db3bd0a85f27223f913fe

SHA1
419c022f1971d9b5299ab00b2b047b2380f3637d

SHA256
9d39294817bec7f876fcbf2a3fafb768b4b329fc5bb1c19e17e468438a1e9666

SHA512
9937d873aa802bfb92ca29d09fdf5eaa4059d072d3ac50ecba84633c6cb32a16116f9d45b53b99d3db55b6110b39a1e5d8fbfb194dd305547c3595ea20848186

Download Submit
C:\Windows\SysWOW64\Qnjnnj32.exe

Filesize
78KB

MD5
f96590b36b90600ae96ec66295e1ad92

SHA1
6d14b0251a49cc26408321a32a799fc929a4cc57

SHA256
94e0f6c5296b235a67105c54b3a02870440abb238aa1caa9442690ca50fc6e89

SHA512
b9b5220225b9f615dd2fe317b383eeb91281c38800215d1e906bc1d520da2badbd387b8d2eecdeff96c107df05fff224ad4487a2a9fca0328d54d1b5362a6926

Download Submit
C:\Windows\SysWOW64\Qqfmde32.exe

Filesize
78KB

MD5
34feb2c334f22471b71a1f4d43e30fcb

SHA1
31f7714e8cb590470b16e185ffb42dec62ad7023

SHA256
48ef6b7d257b4263334d65102ff4e94622152e1e86fb54cd06155986f6a94f26

SHA512
8962862ad23b7a6905bb1150afe5f31fa8c46b4cb51977a51fc964e86f7f55533dc15cbc9fd7387585d6e96160a65d5e76b83fc8d6203305014dc11b23603f0b

Download Submit
memory/220-596-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/540-399-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/764-387-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/776-160-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/956-269-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1004-173-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1080-586-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1144-432-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1184-37-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1232-420-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1276-85-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1304-417-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1324-599-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1352-496-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1412-21-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1420-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1420-581-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1500-49-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1500-584-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1688-96-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1788-249-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1804-521-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1824-196-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1900-544-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1924-569-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2000-121-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2120-299-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2148-503-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2180-113-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2256-477-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2376-323-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2380-209-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2392-153-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2424-73-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2480-546-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2500-497-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2624-137-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2656-531-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2724-591-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2724-57-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2768-292-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2852-225-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2860-241-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2888-329-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2896-425-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2904-185-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2932-377-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2960-571-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2980-557-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3256-515-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3284-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3308-305-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3352-564-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3352-25-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3360-128-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3436-389-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3516-363-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3560-298-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3676-321-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3832-411-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3908-483-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3948-285-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3972-200-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3996-461-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4036-598-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4036-65-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4132-109-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4156-275-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4196-217-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4300-261-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4344-449-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4352-345-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4356-401-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4368-182-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4412-13-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4472-439-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4480-311-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4504-539-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4504-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4504-1-0x0000000000432000-0x0000000000433000-memory.dmp

Filesize
4KB

Download
memory/4512-335-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4544-371-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4556-558-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4568-232-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4584-582-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4684-513-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4688-443-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4724-147-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4776-455-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4784-485-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4812-263-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5048-533-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5056-353-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5064-370-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5092-347-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5108-467-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads