e39b2f64c9838ddd733ff77319444a682148aef8f35fd3bb314cff779051dc17

Analysis

max time kernel
135s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 11:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1903315fce48068b045c2e0419ac2b0_NeikiAnalytics.exe
Size

145KB
MD5

a1903315fce48068b045c2e0419ac2b0
SHA1

eb0430b4dcaccd8a679829467e8702ab26d9ac9d
SHA256

e39b2f64c9838ddd733ff77319444a682148aef8f35fd3bb314cff779051dc17
SHA512

417d24caa85c3a747df6bc6f4edc388e2b1b69aa59932eaba4d90891030438b6b70ada621cf06f59bf0e7e2c9172f21d734a615be9cd16da2d3e888eaa6f5ff7
SSDEEP

1536:/bhBXOouJM/xjAHhehxTSeqEy3J30WPrIPrWFFZy6BEVsNo2Ae5JYFnVEyQmEydP:7XOVJckHQaeqD3pFBEV52Ae5aFnVB

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekkkoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ieidhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgpoihnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aafemk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eoideh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Albpkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iidphgcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcfggkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omgmeigd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qodeajbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cohkokgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ioolkncg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcbfcigf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifomll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqhdbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bddjpd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibaeen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnjqmpgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dngjff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phfcipoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boenhgdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eicedn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efeihb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eppjfgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbjena32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcdjbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onkidm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdbpgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emjgim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Boeebnhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iepaaico.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljhnlb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfdjinjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pldcjeia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bakgoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnahdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcmdaljn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojigdcll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Offnhpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfjkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igdgglfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jokkgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qaqegecm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aopemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iedjmioj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oplfkeob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnplfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ieidhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bohbhmfm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dijbno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Goglcahb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klhnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lobjni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Palbgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahdged32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blnoga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bakgoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mebcop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igajal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncnofeof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmmfmhll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdimqm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnjdpaki.exe

Executes dropped EXE 64 IoCs

pid	Process
3832	Mebcop32.exe
4992	Mjokgg32.exe
4628	Mnkggfkb.exe
2140	Meepdp32.exe
992	Mnmdme32.exe
640	Malpia32.exe
4508	Mgehfkop.exe
4816	Mnpabe32.exe
2704	Nghekkmn.exe
2108	Nmenca32.exe
516	Ncofplba.exe
1276	Nlfnaicd.exe
2300	Nabfjpak.exe
3868	Nhmofj32.exe
4808	Nmigoagp.exe
3584	Nhokljge.exe
4164	Njmhhefi.exe
2456	Neclenfo.exe
1720	Nlmdbh32.exe
3588	Nmnqjp32.exe
4492	Odhifjkg.exe
4376	Onnmdcjm.exe
1884	Oeheqm32.exe
2016	Ohfami32.exe
2612	Onpjichj.exe
4960	Omcjep32.exe
1080	Oobfob32.exe
4016	Oaqbkn32.exe
2276	Ojigdcll.exe
880	Omgcpokp.exe
912	Oeokal32.exe
224	Okkdic32.exe
1384	Omjpeo32.exe
1152	Phodcg32.exe
1820	Pknqoc32.exe
3564	Pmlmkn32.exe
1480	Plmmif32.exe
1284	Poliea32.exe
2152	Pajeam32.exe
1904	Plpjoe32.exe
4748	Pkbjjbda.exe
1948	Palbgl32.exe
3280	Pdkoch32.exe
2944	Phfjcf32.exe
4976	Popbpqjh.exe
1188	Paoollik.exe
4212	Pejkmk32.exe
2200	Pldcjeia.exe
4584	Pocpfphe.exe
3328	Qaalblgi.exe
4104	Qdphngfl.exe
456	Qkipkani.exe
1376	Qmhlgmmm.exe
924	Qeodhjmo.exe
4556	Qhmqdemc.exe
2304	Qklmpalf.exe
2624	Amjillkj.exe
2044	Aafemk32.exe
732	Ahpmjejp.exe
2244	Aknifq32.exe
5180	Alnfpcag.exe
5220	Anobgl32.exe
5260	Aefjii32.exe
5300	Ahdged32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jghpbk32.exe	Jcmdaljn.exe
File created	C:\Windows\SysWOW64\Idaiki32.dll	Phfcipoo.exe
File created	C:\Windows\SysWOW64\Omjbpn32.dll	Dkndie32.exe
File created	C:\Windows\SysWOW64\Pdkoch32.exe	Palbgl32.exe
File opened for modification	C:\Windows\SysWOW64\Qmhlgmmm.exe	Qkipkani.exe
File created	C:\Windows\SysWOW64\Bafndi32.exe	Bohbhmfm.exe
File created	C:\Windows\SysWOW64\Chfhllkp.dll	Hpiecd32.exe
File created	C:\Windows\SysWOW64\Lgbloglj.exe	Lcgpni32.exe
File created	C:\Windows\SysWOW64\Cpbjkn32.exe	Ckebcg32.exe
File created	C:\Windows\SysWOW64\Enbjad32.exe	Eppjfgcp.exe
File opened for modification	C:\Windows\SysWOW64\Fmcjpl32.exe	Felbnn32.exe
File opened for modification	C:\Windows\SysWOW64\Ahmjjoig.exe	Qodeajbg.exe
File opened for modification	C:\Windows\SysWOW64\Mjodla32.exe	Mfchlbfd.exe
File created	C:\Windows\SysWOW64\Dkndie32.exe	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Mjknojbk.dll	Qkipkani.exe
File created	C:\Windows\SysWOW64\Ilmifh32.dll	Eiokinbk.exe
File created	C:\Windows\SysWOW64\Pfabjq32.dll	Gfjkjo32.exe
File created	C:\Windows\SysWOW64\Hhjamhbn.dll	Dijbno32.exe
File created	C:\Windows\SysWOW64\Pigbqakg.dll	Emanjldl.exe
File created	C:\Windows\SysWOW64\Hponje32.dll	Oeokal32.exe
File created	C:\Windows\SysWOW64\Phfjcf32.exe	Pdkoch32.exe
File created	C:\Windows\SysWOW64\Lfklem32.dll	Aamknj32.exe
File created	C:\Windows\SysWOW64\Iocbnhog.dll	Mmpmnl32.exe
File opened for modification	C:\Windows\SysWOW64\Nnafno32.exe	Nclbpf32.exe
File opened for modification	C:\Windows\SysWOW64\Oaqbkn32.exe	Oobfob32.exe
File opened for modification	C:\Windows\SysWOW64\Igdgglfl.exe	Iomoenej.exe
File opened for modification	C:\Windows\SysWOW64\Lcnfohmi.exe	Lobjni32.exe
File created	C:\Windows\SysWOW64\Ibknda32.dll	Bohbhmfm.exe
File opened for modification	C:\Windows\SysWOW64\Npiiffqe.exe	Nmkmjjaa.exe
File created	C:\Windows\SysWOW64\Pccahbmn.exe	Pfoann32.exe
File created	C:\Windows\SysWOW64\Aafemk32.exe	Amjillkj.exe
File opened for modification	C:\Windows\SysWOW64\Blqllqqa.exe	Bdickcpo.exe
File created	C:\Windows\SysWOW64\Dhhmleng.dll	Ogjdmbil.exe
File created	C:\Windows\SysWOW64\Offnhpfo.exe	Oplfkeob.exe
File opened for modification	C:\Windows\SysWOW64\Mgehfkop.exe	Malpia32.exe
File opened for modification	C:\Windows\SysWOW64\Fngcmcfe.exe	Fpdcag32.exe
File created	C:\Windows\SysWOW64\Gehbjm32.exe	Fbjena32.exe
File created	C:\Windows\SysWOW64\Mqkiok32.exe	Mmpmnl32.exe
File opened for modification	C:\Windows\SysWOW64\Digehphc.exe	Dfiildio.exe
File created	C:\Windows\SysWOW64\Gflhoo32.exe	Gnepna32.exe
File created	C:\Windows\SysWOW64\Iedjmioj.exe	Igajal32.exe
File created	C:\Windows\SysWOW64\Gqhejb32.dll	Gikdkj32.exe
File created	C:\Windows\SysWOW64\Dckahb32.dll	Komhll32.exe
File created	C:\Windows\SysWOW64\Kcmgob32.dll	Eoideh32.exe
File created	C:\Windows\SysWOW64\Kjeiodek.exe	Keimof32.exe
File opened for modification	C:\Windows\SysWOW64\Pfoann32.exe	Omgmeigd.exe
File created	C:\Windows\SysWOW64\Pjpbba32.dll	Ekaapi32.exe
File opened for modification	C:\Windows\SysWOW64\Mgloefco.exe	Mcpcdg32.exe
File opened for modification	C:\Windows\SysWOW64\Apmhiq32.exe	Akpoaj32.exe
File opened for modification	C:\Windows\SysWOW64\Nlfnaicd.exe	Ncofplba.exe
File created	C:\Windows\SysWOW64\Oeheqm32.exe	Onnmdcjm.exe
File created	C:\Windows\SysWOW64\Pocpfphe.exe	Pldcjeia.exe
File created	C:\Windows\SysWOW64\Bcbbjj32.dll	Eiloco32.exe
File opened for modification	C:\Windows\SysWOW64\Enbjad32.exe	Eppjfgcp.exe
File created	C:\Windows\SysWOW64\Bdimkqnb.dll	Jleijb32.exe
File created	C:\Windows\SysWOW64\Peaggfjj.dll	Mcpcdg32.exe
File created	C:\Windows\SysWOW64\Bkncfepb.dll	Mgloefco.exe
File opened for modification	C:\Windows\SysWOW64\Mebcop32.exe	a1903315fce48068b045c2e0419ac2b0_NeikiAnalytics.exe
File opened for modification	C:\Windows\SysWOW64\Qhmqdemc.exe	Qeodhjmo.exe
File created	C:\Windows\SysWOW64\Bdcebook.dll	Aaohcj32.exe
File created	C:\Windows\SysWOW64\Ghkogl32.dll	Mgbefe32.exe
File created	C:\Windows\SysWOW64\Jjjojj32.dll	Ngjkfd32.exe
File opened for modification	C:\Windows\SysWOW64\Cnhgjaml.exe	Cgnomg32.exe
File created	C:\Windows\SysWOW64\Npiiffqe.exe	Nmkmjjaa.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10720	10432	WerFault.exe	503

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdencf32.dll"	Nmenca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfnbgc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bepmoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dooaoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dngjff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ambfbo32.dll"	Fbjena32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imnocf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdmdnadc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bahdob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	a1903315fce48068b045c2e0419ac2b0_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljhpog32.dll"	Nmigoagp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aefjii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebimgcfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcknij32.dll"	Dpkmal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jebfng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Appfnncn.dll"	Klahfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncqlkemc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baiinofi.dll"	Ncchae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdglhf32.dll"	Njmqnobn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onnmdcjm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojigdcll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qaalblgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oqadgkdb.dll"	Cfbcke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fofdocoe.dll"	Dodjjimm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eicedn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oonnoglh.dll"	Lqkqhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfookdli.dll"	Njmhhefi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odhifjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anqlll32.dll"	Omcjep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eobkhf32.dll"	Ahdged32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnfaohbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mfchlbfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlfnaicd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Copdgb32.dll"	Plpjoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khliclno.dll"	Phfjcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdblhj32.dll"	Fpgpgfmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehkaqc32.dll"	Iebngial.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekbmje32.dll"	Apmhiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gefklj32.dll"	Hekgfj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lflbkcll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iocedcbl.dll"	Aopemh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Popbpqjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amjillkj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Alelqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eoideh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ieidhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apgnjp32.dll"	Pfdjinjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aogbfi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmmfmhll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjjbjd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aaldccip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chflphjh.dll"	Iibccgep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbmdml32.dll"	Qdoacabq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Meepdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oaqbkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebmenh32.dll"	Ddnfmqng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgdgna32.dll"	Iojbpo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oobfob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcmmhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igafkb32.dll"	Pnmopk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cponen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckebcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aoalgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbqpfg32.dll"	Jljbeali.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 3832	4160	a1903315fce48068b045c2e0419ac2b0_NeikiAnalytics.exe	91
PID 4160 wrote to memory of 3832	4160	a1903315fce48068b045c2e0419ac2b0_NeikiAnalytics.exe	91
PID 4160 wrote to memory of 3832	4160	a1903315fce48068b045c2e0419ac2b0_NeikiAnalytics.exe	91
PID 3832 wrote to memory of 4992	3832	Mebcop32.exe	92
PID 3832 wrote to memory of 4992	3832	Mebcop32.exe	92
PID 3832 wrote to memory of 4992	3832	Mebcop32.exe	92
PID 4992 wrote to memory of 4628	4992	Mjokgg32.exe	93
PID 4992 wrote to memory of 4628	4992	Mjokgg32.exe	93
PID 4992 wrote to memory of 4628	4992	Mjokgg32.exe	93
PID 4628 wrote to memory of 2140	4628	Mnkggfkb.exe	94
PID 4628 wrote to memory of 2140	4628	Mnkggfkb.exe	94
PID 4628 wrote to memory of 2140	4628	Mnkggfkb.exe	94
PID 2140 wrote to memory of 992	2140	Meepdp32.exe	95
PID 2140 wrote to memory of 992	2140	Meepdp32.exe	95
PID 2140 wrote to memory of 992	2140	Meepdp32.exe	95
PID 992 wrote to memory of 640	992	Mnmdme32.exe	96
PID 992 wrote to memory of 640	992	Mnmdme32.exe	96
PID 992 wrote to memory of 640	992	Mnmdme32.exe	96
PID 640 wrote to memory of 4508	640	Malpia32.exe	97
PID 640 wrote to memory of 4508	640	Malpia32.exe	97
PID 640 wrote to memory of 4508	640	Malpia32.exe	97
PID 4508 wrote to memory of 4816	4508	Mgehfkop.exe	98
PID 4508 wrote to memory of 4816	4508	Mgehfkop.exe	98
PID 4508 wrote to memory of 4816	4508	Mgehfkop.exe	98
PID 4816 wrote to memory of 2704	4816	Mnpabe32.exe	99
PID 4816 wrote to memory of 2704	4816	Mnpabe32.exe	99
PID 4816 wrote to memory of 2704	4816	Mnpabe32.exe	99
PID 2704 wrote to memory of 2108	2704	Nghekkmn.exe	100
PID 2704 wrote to memory of 2108	2704	Nghekkmn.exe	100
PID 2704 wrote to memory of 2108	2704	Nghekkmn.exe	100
PID 2108 wrote to memory of 516	2108	Nmenca32.exe	101
PID 2108 wrote to memory of 516	2108	Nmenca32.exe	101
PID 2108 wrote to memory of 516	2108	Nmenca32.exe	101
PID 516 wrote to memory of 1276	516	Ncofplba.exe	102
PID 516 wrote to memory of 1276	516	Ncofplba.exe	102
PID 516 wrote to memory of 1276	516	Ncofplba.exe	102
PID 1276 wrote to memory of 2300	1276	Nlfnaicd.exe	104
PID 1276 wrote to memory of 2300	1276	Nlfnaicd.exe	104
PID 1276 wrote to memory of 2300	1276	Nlfnaicd.exe	104
PID 2300 wrote to memory of 3868	2300	Nabfjpak.exe	105
PID 2300 wrote to memory of 3868	2300	Nabfjpak.exe	105
PID 2300 wrote to memory of 3868	2300	Nabfjpak.exe	105
PID 3868 wrote to memory of 4808	3868	Nhmofj32.exe	106
PID 3868 wrote to memory of 4808	3868	Nhmofj32.exe	106
PID 3868 wrote to memory of 4808	3868	Nhmofj32.exe	106
PID 4808 wrote to memory of 3584	4808	Nmigoagp.exe	107
PID 4808 wrote to memory of 3584	4808	Nmigoagp.exe	107
PID 4808 wrote to memory of 3584	4808	Nmigoagp.exe	107
PID 3584 wrote to memory of 4164	3584	Nhokljge.exe	108
PID 3584 wrote to memory of 4164	3584	Nhokljge.exe	108
PID 3584 wrote to memory of 4164	3584	Nhokljge.exe	108
PID 4164 wrote to memory of 2456	4164	Njmhhefi.exe	110
PID 4164 wrote to memory of 2456	4164	Njmhhefi.exe	110
PID 4164 wrote to memory of 2456	4164	Njmhhefi.exe	110
PID 2456 wrote to memory of 1720	2456	Neclenfo.exe	111
PID 2456 wrote to memory of 1720	2456	Neclenfo.exe	111
PID 2456 wrote to memory of 1720	2456	Neclenfo.exe	111
PID 1720 wrote to memory of 3588	1720	Nlmdbh32.exe	112
PID 1720 wrote to memory of 3588	1720	Nlmdbh32.exe	112
PID 1720 wrote to memory of 3588	1720	Nlmdbh32.exe	112
PID 3588 wrote to memory of 4492	3588	Nmnqjp32.exe	113
PID 3588 wrote to memory of 4492	3588	Nmnqjp32.exe	113
PID 3588 wrote to memory of 4492	3588	Nmnqjp32.exe	113
PID 4492 wrote to memory of 4376	4492	Odhifjkg.exe	114

C:\Users\Admin\AppData\Local\Temp\a1903315fce48068b045c2e0419ac2b0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\a1903315fce48068b045c2e0419ac2b0_NeikiAnalytics.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Windows\SysWOW64\Mebcop32.exe
  C:\Windows\system32\Mebcop32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Windows\SysWOW64\Mjokgg32.exe
    C:\Windows\system32\Mjokgg32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\SysWOW64\Mnkggfkb.exe
      C:\Windows\system32\Mnkggfkb.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4628
    - - C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2140
      - C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:992
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4508
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2704
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:516
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1276
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2300
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3868
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3584
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3588
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4492
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4376
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        24⤵
        Executes dropped EXE
        
        PID:1884
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        25⤵
        Executes dropped EXE
        
        PID:2016
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        26⤵
        Executes dropped EXE
        
        PID:2612
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4960
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1080
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4016
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2276
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        31⤵
        Executes dropped EXE
        
        PID:880
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:912
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        33⤵
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        34⤵
        Executes dropped EXE
        
        PID:1384
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        35⤵
        Executes dropped EXE
        
        PID:1152
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        36⤵
        Executes dropped EXE
        
        PID:1820
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        37⤵
        Executes dropped EXE
        
        PID:3564
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        38⤵
        Executes dropped EXE
        
        PID:1480
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        39⤵
        Executes dropped EXE
        
        PID:1284
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        40⤵
        Executes dropped EXE
        
        PID:2152
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1904
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        42⤵
        Executes dropped EXE
        
        PID:4748
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1948
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3280
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2944
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4976
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        47⤵
        Executes dropped EXE
        
        PID:1188
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        48⤵
        Executes dropped EXE
        
        PID:4212
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2200
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        50⤵
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3328
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        52⤵
        Executes dropped EXE
        
        PID:4104
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:456
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        54⤵
        Executes dropped EXE
        
        PID:1376
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:924
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        56⤵
        Executes dropped EXE
        
        PID:4556
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        57⤵
        Executes dropped EXE
        
        PID:2304
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2624
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2044
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        60⤵
        Executes dropped EXE
        
        PID:732
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        61⤵
        Executes dropped EXE
        
        PID:2244
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        62⤵
        Executes dropped EXE
        
        PID:5180
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        63⤵
        Executes dropped EXE
        
        PID:5220
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        66⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        67⤵
        Drops file in System32 directory
        
        PID:5376
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5416
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        69⤵
        Modifies registry class
        
        PID:5456
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        70⤵
        Drops file in System32 directory
        
        PID:5492
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        71⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        72⤵
        Modifies registry class
        
        PID:5576
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        73⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        74⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        75⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5736
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        77⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        78⤵
        Modifies registry class
        
        PID:5816
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        79⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5896
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        81⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5976
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        83⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        84⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        85⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:372
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5208
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        88⤵
        Drops file in System32 directory
        
        PID:5288
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        89⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5404
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        91⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        92⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        93⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        94⤵
        Modifies registry class
        
        PID:5712
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        95⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        96⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        97⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6048
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        99⤵
        Modifies registry class
        
        PID:6132
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        100⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        101⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        102⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        103⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        104⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        105⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        106⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        107⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        108⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        109⤵
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        110⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        111⤵
        Drops file in System32 directory
        
        PID:5844
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        112⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        113⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        114⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        115⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        116⤵
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5884
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        118⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        119⤵
        Modifies registry class
        
        PID:6148
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6184
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        121⤵
        Modifies registry class
        
        PID:6228
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        122⤵
        Drops file in System32 directory
        
        PID:6268
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6312
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        124⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        125⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        126⤵
        Drops file in System32 directory
        
        PID:6432
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6480
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6516
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        129⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        130⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        131⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        132⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        133⤵
        Modifies registry class
        
        PID:6800
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6836
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6888
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        136⤵
        Drops file in System32 directory
        
        PID:6940
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        137⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        138⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        139⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        140⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        141⤵
        Drops file in System32 directory
        
        PID:7164
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6176
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        143⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        144⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        145⤵
        Drops file in System32 directory
        
        PID:6380
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        146⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        147⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        148⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        149⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        150⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        151⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        152⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6980
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        154⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        155⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        156⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        157⤵
        Modifies registry class
        
        PID:6256
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        158⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        159⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        160⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        161⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        162⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        163⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        164⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        165⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        167⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        168⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        169⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        170⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        171⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        172⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        173⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        174⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        175⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7472
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        177⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        178⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        179⤵
        Drops file in System32 directory
        
        PID:7596
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        180⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        181⤵
        Drops file in System32 directory
        
        PID:7668
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        182⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7744
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        184⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        185⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        186⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        187⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        188⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        189⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        190⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        191⤵
        Drops file in System32 directory
        
        PID:8056
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        192⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8136
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        194⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        195⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        196⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        197⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        198⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        199⤵
        Modifies registry class
        
        PID:7508
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        200⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        201⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        202⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        203⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        204⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7924
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8000
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        207⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        208⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        209⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7316
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        211⤵
        Modifies registry class
        
        PID:7460
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        212⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        213⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        214⤵
        Modifies registry class
        
        PID:7832
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7972
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8116
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        217⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        218⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        219⤵
        Drops file in System32 directory
        
        PID:7592
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7804
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        221⤵
        Modifies registry class
        
        PID:7992
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        222⤵
        Modifies registry class
        
        PID:8188
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        223⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7836
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8144
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7696
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        227⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7416
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        229⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        230⤵
        Drops file in System32 directory
        
        PID:8272
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        231⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        232⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        233⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        234⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        235⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        236⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        237⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        238⤵
        Modifies registry class
        
        PID:8588
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        239⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8668
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        241⤵
        Modifies registry class
        
        PID:8704
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        242⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        243⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8816
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8852
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        246⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        247⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        248⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        249⤵
        Drops file in System32 directory
        
        PID:8996
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        250⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        251⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        252⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        253⤵
        Modifies registry class
        
        PID:9160
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        254⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        255⤵
        Drops file in System32 directory
        
        PID:8228
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        256⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        257⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        258⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        259⤵
        Modifies registry class
        
        PID:8476
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        260⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        261⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        262⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        263⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        264⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        265⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        266⤵
        Modifies registry class
        
        PID:9020
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9104
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7152
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        269⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        270⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        271⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        272⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        273⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8688
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        275⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        276⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7956
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        278⤵
        Drops file in System32 directory
        
        PID:8576
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        279⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        280⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        281⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        282⤵
        Modifies registry class
        
        PID:8408
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        283⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        284⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        285⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        286⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        287⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        288⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        289⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        290⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        291⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8604
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        293⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        294⤵
        Modifies registry class
        
        PID:9264
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9300
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        296⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        297⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        298⤵
        Drops file in System32 directory
        
        PID:9408
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        299⤵
        Drops file in System32 directory
        
        PID:9440
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        300⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        301⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        302⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        303⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        304⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        305⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        306⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        307⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        308⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        309⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9852
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        310⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9932
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        312⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        313⤵
        Drops file in System32 directory
        
        PID:10012
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        314⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        315⤵
        Drops file in System32 directory
        
        PID:10092
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        316⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        317⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        318⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        319⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        320⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        321⤵
        Drops file in System32 directory
        
        PID:9380
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        322⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9532
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        324⤵
        Drops file in System32 directory
        
        PID:9592
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        325⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        326⤵
        Modifies registry class
        
        PID:9752
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        327⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        328⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        329⤵
        Modifies registry class
        
        PID:9960
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        330⤵
        Modifies registry class
        
        PID:10036
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        331⤵
        Drops file in System32 directory
        
        PID:10112
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        332⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3356
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5148
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10192
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        336⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        337⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        338⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        339⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        340⤵
        Drops file in System32 directory
        
        PID:9580
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9664
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        342⤵
        Drops file in System32 directory
        
        PID:9764
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        343⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        344⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        345⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10156
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        347⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        348⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        349⤵
        Modifies registry class
        
        PID:9360
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        350⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        351⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10176
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        353⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10108
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        355⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        356⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        357⤵
        Modifies registry class
        
        PID:10292
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        358⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        359⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10412
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        361⤵
        Modifies registry class
        
        PID:10448
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10484
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        363⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        364⤵
        Modifies registry class
        
        PID:10556
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        365⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        366⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        367⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        368⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        369⤵
        Drops file in System32 directory
        
        PID:10736
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        370⤵
        Modifies registry class
        
        PID:10772
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        371⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        372⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        373⤵
        Modifies registry class
        
        PID:10880
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        374⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10952
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        376⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        377⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        378⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11096
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        380⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        381⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        382⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        383⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        384⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        385⤵
        Modifies registry class
        
        PID:10400
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        386⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10528
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        388⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        389⤵
        Modifies registry class
        
        PID:10648
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        390⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        391⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10792
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        392⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        393⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        394⤵
        Drops file in System32 directory
        
        PID:10976
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        395⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        396⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11108
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11172
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        398⤵
        Drops file in System32 directory
        
        PID:11204
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        399⤵
        Modifies registry class
        
        PID:9272
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        400⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        401⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10432 -s 408
        402⤵
        Program crash
        
        PID:10720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1036,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:8
1⤵
PID:6544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 10432 -ip 10432
1⤵
PID:10624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Adkqoohc.exe

Filesize
145KB

MD5
eec7ea291040ed310aff7f1b7d8968d3

SHA1
19b54db71007a7a995b9306fe181a12ad99ae59f

SHA256
cc4c2bfa278474c6d30dfeb106a5b5e9e0fc1f75af5dadf00ccd8038cf122bba

SHA512
13599344148983cac36a9c0144071f3b399b8dc0ec5a715139ec3e17825def6c85308048458279a49ebd3ebfc06310db5519e0df79a747279c8ebd884da2f691

Download Submit
C:\Windows\SysWOW64\Bakgoh32.exe

Filesize
145KB

MD5
e52d8c320871acfc49fe68a79932da5a

SHA1
ff1309e06cc0df8e0eb83f5fc10d10b589721cc7

SHA256
ce1dad4e58857b1f8f92f3e4c9bfcb61b607cfd25f822bd71b272546de3534ef

SHA512
3398acc2f360c8ebc5a9cbb34374dd61cae55e7dfbc4c792eff57c40f78d6cdd178d42835d3b83b3197b57932c769ac3c2898974822f0e698d97003c4318eea6

Download Submit
C:\Windows\SysWOW64\Cnhgjaml.exe

Filesize
145KB

MD5
3c6d20afe8eabfba17ba1c4c7962a976

SHA1
3964ab9f6ebbbb6900ff5772d53c5bc0885a4824

SHA256
ba1c7b5c1f6f2bca8a05c6fc8e2479fbf39aa75a44b3ddf2c1b6803a57097100

SHA512
54c036d26f613d3a7ccce4782b0fddf90c0da411af9d033702f0b5a5ea0e5213d66e1b4feabeffadb92cb2c96566a18f8b8c30e8b5a9982330197d221c474106

Download Submit
C:\Windows\SysWOW64\Cpbjkn32.exe

Filesize
145KB

MD5
c9f79386ac126ba622a248caa8b2091e

SHA1
836b2b9306368d6ddfb8a2217096c3f77bf977c8

SHA256
a18da636856b3e2005775d8a8d56e790fcc8687f8822cd4d577fe8d1ceb0124f

SHA512
739c2bf03b544d9afcd798ca38bf5842b75570deaba86b04856eaff1ba33a94331d6c9c15a1f15f68a3ebd47b5b969c672806f22f002f722ed8a04ab746f3092

Download Submit
C:\Windows\SysWOW64\Digehphc.exe

Filesize
145KB

MD5
59b9f3ba5a0acd3ca93958f8bd820d82

SHA1
46a5dc8f9797c578eef81ccd48b5f2620d239991

SHA256
2b5205a97bc60ab680bef975bbc01fb3c04ae83bf2c304eaa1af1202660c0fdd

SHA512
44e408b60282094149b74f3d29d0baacee3ba266aef2c8f0e38d26213052a894009af8a5cba3017c30d9b02e106ab02c7cc3da466ab98d69b556aedc0da0199f

Download Submit
C:\Windows\SysWOW64\Dpkmal32.exe

Filesize
145KB

MD5
36122968d69798b5c9af7d99652d40c8

SHA1
1af4883a72d843531eb5016b5f3afd3b3ae1a33c

SHA256
65e4546dd4c29dc499c399b11b115b0e827e7bb1eeda774455b1b03ee306c12c

SHA512
2fec89dfc3228d4ef4f20f1d361743a3c82064930b61799a17e9bfe1dc34a77d76f69243d82f4f1d136eb5b356af5cff6eb32e872c543b25c2cc0543ac2228d3

Download Submit
C:\Windows\SysWOW64\Gpgind32.exe

Filesize
145KB

MD5
c059c3439580872dd25b8d5d6fbd0457

SHA1
a6670c36f9a17cc85e3c579732e2945412e53f6e

SHA256
6afb83c17c970370cf26779026d9d4dd8e7f393ddff0c4f4280faf9d7a9bfc72

SHA512
3697bca1f70b2ba00ab16aff1537c01c35c6da8f0a5dbe17c6119cc4024f233351a1995cbc82377c0979453bb35fedb8ce872d2120fc6dd10bf5bb29c7bc05ae

Download Submit
C:\Windows\SysWOW64\Hfcnpn32.exe

Filesize
145KB

MD5
d31f9be3cf7584606880b2f66b22ec95

SHA1
51cd6e3fbbf1bae82f525be46bac5cafc36a8240

SHA256
8bb67e27f0e6e8c3637f837774b59adac2463e2114a237161785937635cf247c

SHA512
f10aa795ce7c0ad268830b7721b335f08d97a0318da0b2e9ca666d5895c8a31dfc3e848db7e290c0f39758f8120ec368af0c37fe8aebccbc293f2aeb4e40b76f

Download Submit
C:\Windows\SysWOW64\Hidgai32.exe

Filesize
145KB

MD5
0d7636351362ecf323accacfdc98cd43

SHA1
bc1c2063fc873a55149a5e991fe72ce894e0fd7d

SHA256
917713f472f79f9ff4ebb22f9e1f7e2c811222ce3278a447e904264a105bb600

SHA512
4a16e196c548478b36dacd66a513edafe202cc734970c83defbdf7e2e7ad6c85568230c9cccae5d1ff6680a0f0b9eb8021691bd6a5cbdf7f3cf93edcf5d5342e

Download Submit
C:\Windows\SysWOW64\Hiipmhmk.exe

Filesize
145KB

MD5
6790c96094705a316f260222c03550f4

SHA1
84448e0704bf4cdcddcb5b3d8c20393a2cf42514

SHA256
8ea95d937f64a95c2f228308e96b343e38d087fa50f52e2838ecd1d06718ff2a

SHA512
b28e7bb883f9c74cbe701ba173f3086e9ea65cc6f316b41140570acb4261e5fa416df3ef61b7b6f84fd6029dba1f706e358ab9b51e6c065949d4c79489e529dd

Download Submit
C:\Windows\SysWOW64\Hmbphg32.exe

Filesize
145KB

MD5
10dcd54a14ecf00b8845094def36d260

SHA1
ca2f0d34dcb0a13412a221e959a370c6da85d718

SHA256
c58ef4107b18bf61b16492aa804eff1e6fadf7695da2cf65caaf017fcec4b13e

SHA512
d6662080221e535ccc5feebe39941185062f731584df314b2e016eec9b2082fa4b9d0ab92198ecdf19af0f2e0d7d2ac7039242f29c081701a5b3d6b2b2e1b211

Download Submit
C:\Windows\SysWOW64\Hmkigh32.exe

Filesize
145KB

MD5
68a9b6872b49a9f966d668f4196c9099

SHA1
1ff7cbbe69909617540150f19c87be629f8e21d0

SHA256
0f0f085206b4295c04563dac18b5b86ec8c3b930dcc0e2277995a86d6fe5043c

SHA512
d411abcf162ae1346502fb71d204647090820060882fa9631af743f6cf61c15356cfe9650468dbf72f0a914dac92230dde90dd4510a32f0df62b491dee20e1da

Download Submit
C:\Windows\SysWOW64\Ioolkncg.exe

Filesize
145KB

MD5
1fdaf7ca4823c02735601518739bfdcc

SHA1
d07a29a80dd4cd288553aa5d230680e4c8b20e30

SHA256
a669cbd15eafa3d84998c179aed7d51c242e67fa4a6ec070109c62ce46324dc0

SHA512
880ccd56d49167671e41678f42c3b34f4963676e7cbe63098dc2116fe93d1b457507fcac3edc46b280d2161debb87c9a3873907b7f70eac244665373f46984f5

Download Submit
C:\Windows\SysWOW64\Jgmjmjnb.exe

Filesize
145KB

MD5
c92bd9b4090d72338f4aa59e0f39ac13

SHA1
ff2278178c67ab943ad0487a8632f9f0d1609428

SHA256
51ac2f82d003df324958e92713d852d0dd09f8a03c7607b830c1cc365c2a3bcc

SHA512
0d24c72a44a4ec8cf9ed80b96bb6d08852dd40fe5504410f54da5b4ffd49f297c10ff56884ecea9c237f2301fa90240964b6dcebcda2108ba84b03c55e2124fa

Download Submit
C:\Windows\SysWOW64\Jiiicf32.exe

Filesize
145KB

MD5
7f52a54981f5e81837009cb1c4cc8909

SHA1
9399cc43a180be4a72353442600f3ec50c4a224c

SHA256
4e7511464d82740d148a243edb4607b4ac6ede6371403f266e0e09fd8d620341

SHA512
ab7e83678ce051d0bd595e1631db7535e92e3e699fc397e05187ea837c78e3e24084e955ae63a070bec7c1ae2cf40691b4ea0cdc1459f84ecf892592bd727ea9

Download Submit
C:\Windows\SysWOW64\Jpenfp32.exe

Filesize
145KB

MD5
438acb4c60fddfba95471f8af9e2e325

SHA1
82f602232a31bed852b6c39dc01b26f0059611fe

SHA256
ea2a55c47afc6c5ce9f74495405ff343db94b457c326d4007a12a784d6ee9659

SHA512
2ec25ae7c0493445e50521d890e4d561eac070fdf8eb511a4271cbbf7f6ae9b4e39c8727f14ae432436e4231dfe28fd68d05cc2282c3ba886e63aea2dece2565

Download Submit
C:\Windows\SysWOW64\Klahfp32.exe

Filesize
145KB

MD5
dc18b232baccdf5dff5661a1894eff85

SHA1
78d958aa6702ac008ae51c2e033abd2d556df3c5

SHA256
49cdfe43763a360e2c835df044ed016f55cb739be045bba2a1739a9ea7d27dd5

SHA512
01e799e0b7b9ae873c246e6083a7c9f0413b473a05a2dcf722767b3770589341b9b95024ed9a1a6f8c0015a4ba86660a99077c7959fae81f702d066f98a8394e

Download Submit
C:\Windows\SysWOW64\Lgpoihnl.exe

Filesize
145KB

MD5
49c415a2d6b2dc4468ada645d1603586

SHA1
1c180d5cf098a80d69f363604add64693531e621

SHA256
5d505474c507ce7b246a124ce03bc8278e2396af6b39a32e418c68278ee75c9b

SHA512
ddb47511a232a6d034c3f13d5005e7dc1ef231bfdc61b0287550745e6c1cf9d9f10ec634a21cbbe25bd9ea364120725a2beff73e5f163d848bb8514334b6ebcf

Download Submit
C:\Windows\SysWOW64\Malpia32.exe

Filesize
145KB

MD5
39ddbc9be07176c0490672218485ee66

SHA1
0a8a8cf1824b61ebfbc7ac60d364e7c3d0eda760

SHA256
07f2f5770e82829b2d8d106c023e0233f008e28867d73161e6ef9020b58f96b2

SHA512
943935fd2f2d9ee34f86db1515404059cdee6a7a2c32bd8709d0133c27742fd1449dc3eedfef0571001b25db77a490a89d48b20825fad82e07892ab6b7ad2dc7

Download Submit
C:\Windows\SysWOW64\Mebcop32.exe

Filesize
145KB

MD5
6675df998260509c47d4ce0523e02123

SHA1
8fe6883901c76889ecb22e0bf1aea8ea3400dfc9

SHA256
e87c6aad277a4b76c5759996f35a5f0ce8edc85c7351c01fc158a088e9476285

SHA512
7437a254a511af9047486a269caaf7090b815e68d4d7bcd46e799bddb2d9271bf57bb1c2c79ff980bb0b87ed93b9a2cbc113e2390bc7b3e2718625378ef0ed6f

Download Submit
C:\Windows\SysWOW64\Meepdp32.exe

Filesize
145KB

MD5
10791fe7a960386e82ffa4c548b7e3db

SHA1
2b7594dd32a2ecf9fcc70c5e9250ed74b77007dc

SHA256
4d0b381e1f12ab9d3d86488e67ca22b2e461922162b56c9ac7a4ebc11ac91622

SHA512
f2df93df16e70d65a34e10fd99434d3fcca6b453cf7750a35e37a314676b3d194897768e5cc80d1d0e67f3ba045ec80440191f11c51275cfefa38cbdbb9de978

Download Submit
C:\Windows\SysWOW64\Mfhbga32.exe

Filesize
145KB

MD5
aa6563a601a020148d575dd2348cc355

SHA1
4d0ea496d972b78d59faf6ec5d461dcf441d82e4

SHA256
41dac65c4fea45c7d9cc5bb70f0c0cfa09e4c70b266e4bf3a0b621904e404d40

SHA512
e8cd5badae5f45564f8c91d33aac44a241e318f8a0725d225e98ab6708ea5332dcca520b7512f3b6f580ec2437bff63bbee3c011788085e49121382e5dc011c7

Download Submit
C:\Windows\SysWOW64\Mfqlfb32.exe

Filesize
145KB

MD5
9a9ef172ce6340a3cfa8cbfd2d7cae64

SHA1
418d606c6bf44fc692e9fb44fa7c1bc1b28e03c1

SHA256
4b9f03d6c1af583034d004508ba38f0b3915f9bb8a4bac3adc004c3b33eb2fc6

SHA512
e0263bc2a4d2352a5d0c0f2d97f9b81a56e987d02a7238f886e1f5dd68ff2a325fadc1d93c1dac22861a2a02185eca774f5f630b61f9abcbd0a88d5a0398e627

Download Submit
C:\Windows\SysWOW64\Mgehfkop.exe

Filesize
145KB

MD5
cbbc1e1e30ae7267b5b2825367bed6f5

SHA1
b01b9b8ae940f36c23a41726d757105c10a5ce9f

SHA256
6be6a13b8b1b96f8cad51c1837960cb3663210f3bfba4d5b7f3ff8caf84f72e8

SHA512
c5463a97883ee37aa9a2c29ca8aafa914adbffac1f81fefd1b62f0bc5ce5dbab0fe9a360cef5b94e525e9266640a41b6de6c325e02e06c638183ac1ccde8caed

Download Submit
C:\Windows\SysWOW64\Mjokgg32.exe

Filesize
145KB

MD5
3acb07d78c5d6d37173c76c67befdab6

SHA1
a4db0b5865836fd14088af73dd820e5313d2fe39

SHA256
270b18cd7337e695db80c265372f01bb1d1fed058456469b39098ece7e5ecd29

SHA512
9d6a1482bbcfcc6bf6770c7156e19b12eed5c1c7fa9e6e57cd15c9b347a0383a6b38aeb3721cb5b669c41d3b659143ef93e94f6514f275d5e5e92332472e3faf

Download Submit
C:\Windows\SysWOW64\Mnkggfkb.exe

Filesize
145KB

MD5
ac80d245f49de749e4682ec72a03c80f

SHA1
25f5a18f0126ac9bd2ffff6474aa55aceb500943

SHA256
86728dca278a485e6d13cf8d6ff759a4b089c86b80b74e9592a1bcb55e264732

SHA512
dbbcf6c2181ba704df0011aaacc3216a28266dc9ddc64fd370f944324562dd17e9067fb9189bb6218b602ecd37f4d37d26bd441a1f365c5563239ad5d3ec94c9

Download Submit
C:\Windows\SysWOW64\Mnmdme32.exe

Filesize
145KB

MD5
97b62c45e9a76d3efc01f320b59b1a27

SHA1
69d2f2f36ea52874cb9f44e71d3db771bc378a1b

SHA256
a29ef2fc18846d3df99ffdb99d149a22c6d55c52ae78103bf012d346d4a05fa4

SHA512
639aaf3d28512741d02685700822df7ac54d2af3b1ec1de05af68ef7c85e434390238c2190cb2eeb4a9b7760a4b9a7e5ed8c0f7806f06a23863a0cdd1e40650e

Download Submit
C:\Windows\SysWOW64\Mnpabe32.exe

Filesize
145KB

MD5
4301ba52714104305ff0622e5485fbbb

SHA1
32050f504cfa553ae69f42a005ef2a345ac3e675

SHA256
001c82d0c0e9c7344b7afb22ba361f041272bc363e1bc609673b2c6642bc9cf0

SHA512
b6b8f1593f421adb6182a23c814edccef7bffda8209b389bd417f3c6dfe4576336ec3704bd1ccf8ceb2db952ca43906c46b520a5da83f00101274bd8ccf636e0

Download Submit
C:\Windows\SysWOW64\Nabfjpak.exe

Filesize
145KB

MD5
8ff7e5758915e958edb0a489c6255825

SHA1
7e69464f7e6a886c694ae818a53b03abcba3bd6c

SHA256
ed50c2a88e6665e2060d2cb880e0af2cf7b50b29560874653ce714d24925c1ed

SHA512
fa57f365802f3b13fa86bca6080837ba5b515c9cda2ad84af5a6f4342c293ed742b4ae19bb7406b0d640f91e2589acfe72a369f1ea33052efb5ffac86eee3db9

Download Submit
C:\Windows\SysWOW64\Nclbpf32.exe

Filesize
145KB

MD5
5af680618cfdb4969c15b76b73801752

SHA1
3473a92e7d418f3d3aece07223fdd74b72c3ee0e

SHA256
99abc7fe60862a75426dd78b783d447530b394d56c90a3cdd03786f7ae0536a5

SHA512
1ccd7dbbce38b711e24319e206c5087ef3c9b8ceb0026003146dc5b303d597e2d43a3f783539142527ae834371bd8b754c6839309041395aeacf6a20d3febf87

Download Submit
C:\Windows\SysWOW64\Ncofplba.exe

Filesize
145KB

MD5
18bff6b89f3aa60f94432a4a7d57f424

SHA1
81bd4b99aad3c7b97a22b45586911139efae321a

SHA256
3cf832b69183505d5961d3c221314d53af145de487cc23256ccb05ca86054da5

SHA512
0c36d9a1f3767108d30a255cf600db1644e2071ba641a5e1e50e10e3902e97c4ce73aa2943f7f5f6f00f8ef891b5a2e3f5e5fa5181c96ae90dd8a294bc1e8d3b

Download Submit
C:\Windows\SysWOW64\Neclenfo.exe

Filesize
145KB

MD5
b50dd5983cf0f7fe948cc2be6590978a

SHA1
8337fa1725948420bbcb06fa419f1367d8e3c961

SHA256
a8ded3264b55cb28f030ff3c097f4ff8c7a0a394f468fb29310db498788381b1

SHA512
73bcfc71c16a0eeaf2f184c09b7ea37faabe0fd8be3bef09c4910e36817063314f58973c5fcdf99edde0fdebd2878bbb736dabf274373a4189dabe1f0a7cfbff

Download Submit
C:\Windows\SysWOW64\Nghekkmn.exe

Filesize
145KB

MD5
3ac64c0bc1fbfbd18106cf3a4f304336

SHA1
4fcd573b7b125b39e5fd930d5340a70ec887ed57

SHA256
3c73fa5524d91f3c5e617c84c9c58f9c04feb83de086b1bc41a6538730476741

SHA512
77d1ad5923bcc989150d5a45b0f0b036e289e956a57e90e4df9302ea6aee38a905f58a31ecd251c232e60664f0f8dd77b9101befec3e916ad7708dd0b1757aa9

Download Submit
C:\Windows\SysWOW64\Ngjkfd32.exe

Filesize
145KB

MD5
186c290e0f521e94daee9c1e41654524

SHA1
c69579648f2dcbe91378e4bd67191067d6f5873b

SHA256
69e3ec8714db844fbd2ee5bd02c19439e9bbf92a424820c6202d5af53d857e4a

SHA512
94415e5b26af27ce1015dc9b3bfc2a16efb3872ded0f327504091cc0c41f8aa96ce82a558611668f1dab366e6d799db514d03801abef3fc4e1a9e0439be2ed7b

Download Submit
C:\Windows\SysWOW64\Nhmofj32.exe

Filesize
145KB

MD5
4f88592bfdf84fd2958b0c1c1fd57936

SHA1
750a16bd1c8c85302c8e70cc5775f12c93d097d6

SHA256
93b73c87621eb36ae838bbba8c400700ce4187a5ea3382e8e5fc151d8bb71de3

SHA512
c3ee2c869506f0ddd2bae49b17b10e76050d7e49b14bfd2fb03b146f8d33d2967924ee8134d7d135b6299a3c86472dc36c731b89624d75e1d49c5cb37849e3d7

Download Submit
C:\Windows\SysWOW64\Nhokljge.exe

Filesize
145KB

MD5
35c2158383307d4c7982a56ecadbdca7

SHA1
62bb3439ed79290e0c8a056db04ed6b5eb4d18b1

SHA256
11416ea75cfb8f5adb8abc2a9f172667b96f40372205cbbe7dff3aca114c079f

SHA512
2547c7fdd6aab64085cab164e2716154784cf1578798f4925013ea5a9646d7caa55a0160146f664b1eb60b36f99dd1194eb691cb3ef32ef0c04ce511eff7e271

Download Submit
C:\Windows\SysWOW64\Njmhhefi.exe

Filesize
145KB

MD5
013f4b224148759464b8da92092e0b28

SHA1
7867d1a0ca4a6dfdd9158c048f0bf087176260c5

SHA256
ab60545ae393a3c5cdc5989bbaec28a2008a2390338ee97c3140332651b29317

SHA512
5cf050e712583a8f74b12078f96454bbbb311cdf5009e6152e3bec997fc54de4e36ef0a4c3d0ca4dc7029dbb4d88b3d20c1a7e66420fe92e3154fa6015ff0449

Download Submit
C:\Windows\SysWOW64\Nlfnaicd.exe

Filesize
145KB

MD5
0a0e90e982e33d8c39ec7bf0bb6b84f9

SHA1
a76cf8ea276cf5f4783110dff47b3b5411f114b8

SHA256
46c8eda88658d55a3fe873ec28bd1f69779422a0cae72805b7e308c9a46af1b9

SHA512
5c1b3aba8fa38877868483f0fed7f883f911de331d9c064128a559664a76464656070d8b061518a880de72ebec39ffd278e5c11e1c316a6a01ad27a2023949c8

Download Submit
C:\Windows\SysWOW64\Nlmdbh32.exe

Filesize
145KB

MD5
5fe1919cd0a3254cdb13ac3c22cc11cc

SHA1
d22c09650ea0406e2d7c072973ecbda2a5c6ce7a

SHA256
8416c166df3bd4366c22d7982d3902a27218888f36e8133512482fab1134e6bb

SHA512
b1d109c8037dae107866318982a9e7b992bd63002afb114afb298cd31998a185fb3cb3e7641a7c2a6f6438c60eb0f381ef4298ecf2d658ba4f29013897ee4fad

Download Submit
C:\Windows\SysWOW64\Nmenca32.exe

Filesize
145KB

MD5
25feaa3e0a8f2b8800659bc448e26835

SHA1
dc37694207e3e7ef19bd155bd9996baab4d56915

SHA256
1570d29180b84de274d7a10a602f80873e3c0791bfd3d2ee0694fc3e0cd5dbab

SHA512
4f063ba4b043f3ac3be1deb7b5712bdaff5f24e85cb31f654b887c62b26743342f7a51e6fce3ed1db93b76b5448c2725898159bab5c533fe9aee4e130ac43d38

Download Submit
C:\Windows\SysWOW64\Nmigoagp.exe

Filesize
145KB

MD5
feda055cbf1ffb7ab6d1a1a4181fe24f

SHA1
9e0f30cf8d6821c53bb4477b283a872cd3f99cde

SHA256
3eb718b529828336b5d42a9c7930b25ffccfd78eb209900623987ab0a6c2976e

SHA512
c2aa8e3c9f1fdd819933c7a35e8e586dad538be88599ee29a642fca59c44b4f1611f3a57dc59edbf50392a1c65c045d6e54c6fd8c5c08758ad03385a5e10ce77

Download Submit
C:\Windows\SysWOW64\Nmnqjp32.exe

Filesize
145KB

MD5
766f1f1b886a09f2d86bbd2c0049c054

SHA1
443e6548222ba00cf305a752c179b8cc42f0eea2

SHA256
700542ba0e36a444b22bf44abe52d673c1e52dbd6401bca06fc4aabd92b88b01

SHA512
7b743af9506c838843d3bc41fde7a77916fbaa8042540eaa48685bf9508ee293c110e214d93c818dbc35688cd70993cbe8d875a48046a35a60175ff0459d6273

Download Submit
C:\Windows\SysWOW64\Nnfpinmi.exe

Filesize
145KB

MD5
467557d5c1d8fa055ee773372e28c0c7

SHA1
cf6f29512c07b57b4fad549f14722594d73b83c0

SHA256
51239becc71cdd172af83e2c2fc27198a1849b9c1cc96b76eff93767029a2a5e

SHA512
a31e8c170e41cf5d683ad0d49834c58239a13bf5ad7abfe84775f340df4093a7fcad27484b6a1d62a35e312cdf04f1102bfc307f7ab5d5b8a63ca8d947e5e51d

Download Submit
C:\Windows\SysWOW64\Oaqbkn32.exe

Filesize
145KB

MD5
77dfcaf156c9ab85a3785398736db8e1

SHA1
6cfeb6a5b60ad4cf8e61d60ea48ccbc8e013f3a8

SHA256
8f051dd5e5e4d6589fa273c46f01bca1896ea4d8110cd55982a15503c2e5b297

SHA512
5b4f64c17e572b53552212e339994fbb9698b4401e52abcb8b995f566e99c7955aa03e33a461cf46003e86e1c0b6bcf9ca4f0c6f4147a5eb3a6496ce4b85d56c

Download Submit
C:\Windows\SysWOW64\Odhifjkg.exe

Filesize
145KB

MD5
eb75aa6c2d4601ba7e9856522907c765

SHA1
515e02e49540afd9454ca9af59889c8f1616b9c6

SHA256
9b03ed7a9311441ddf7d156e0a4d98b03d077e6c5466d50e1055b13204a0c0de

SHA512
5b9fbadd5609ee7e6e4a35d74968c77fd482822b1bc9ee96c5767f1d687bd43800345cdf36e492424c1e38fc956bda871f9eae505e4bae7be659f8f90112fb3e

Download Submit
C:\Windows\SysWOW64\Oeheqm32.exe

Filesize
145KB

MD5
0c73ed5091a17bd9c601f4e49c589d5e

SHA1
af045fba0fabd8a089a95860fad7cf09dbed554f

SHA256
d2651649dd16c230a134d2f01fb390272acb8ed49420c37b523ddbf3afc1e229

SHA512
c61b74ced4d83362a6f5ddc8871f4abd5cd5471a7bbcf6ba2ac3f06b9f029447f3ac75ea396b90f1dd5d49c2e7917dc540adeead0387207b51943d3cb32b28bb

Download Submit
C:\Windows\SysWOW64\Oeokal32.exe

Filesize
145KB

MD5
9b805d2dda4b90a4320c7f8f55454cec

SHA1
c69f65d875762d94d250e00686a4633b2d273867

SHA256
e0939753a954b27648495b1a2d28072d4c387cd4b0a0a929fe8c7714c7f50ad4

SHA512
64c2fe0fbb05013ccf53afaf3f148450cda2801b5a9cd96403e5e0df3e28c8ba2c9411e898f8a0205510b4df190158390efb304dc361c7ebd0a62db6b52e9a4e

Download Submit
C:\Windows\SysWOW64\Ofhknodl.exe

Filesize
145KB

MD5
ff9094aa9a5e5ee3851350ae673158f8

SHA1
6d3e7273a6249370f6cb137070d5cf9c321e9ffe

SHA256
e04f75ef343085fdb4b601cf430d0d303b07a25453231bb96042e636bddd6cd5

SHA512
c1b52ae63f69be26eb6e983101344ff1a72cdc2c749ef83ad1f2361310c0557937e66cd63728e0e8e146e96e5283b95afac8c9c1514205166ed63a3a2cb561a8

Download Submit
C:\Windows\SysWOW64\Ohfami32.exe

Filesize
145KB

MD5
a161a345f9af812ff30bd066510f7890

SHA1
907778f92a8106ec03c77f92367cf2abfff20535

SHA256
9efb9a6d0ad3b4d4b6915053741d58d8ef6996ba41041cedc7be0729f11f9708

SHA512
e2c9eccab1817ed72aa75f0c544d6b5ca08e1073e9ccf56c8361711961e326baad5ed5912a58c6f48ef1925bcd5b2c2297b440e49b86d74b36ed4dc4444817c4

Download Submit
C:\Windows\SysWOW64\Ojigdcll.exe

Filesize
145KB

MD5
978573a1e1eecc39e5146690437f3647

SHA1
9a9f605f71d10fbb82aeeba16697283fd87ec35b

SHA256
bca72e90b0501100f076bb67126e8a4df6427bf31e664a917fa607189b97c2ec

SHA512
aff4a865480fae5cd4a6c7c07d05542d3e3fcddd6c303c0cf5d9a5e33b311f134aa11ad5e3cbc902b649654bc8459da2fb35c05d2b9bc6d901b90941dc4762f8

Download Submit
C:\Windows\SysWOW64\Okkdic32.exe

Filesize
145KB

MD5
5717cdf6256aa917de49198893996da8

SHA1
63f24b27213cda2cad8ce686287e2ae2935e81ff

SHA256
8c442deca77f9cde4857947aadca3dd9968cb29c26122c21750faac0edd7d14a

SHA512
8d3df821b6ee44da2c5f72574e65188db3a44075d23236d80491068b6aeda76b4759a9049ebd4c0d4077fe27669752f1adf8b280d45df7fb5f26d26499c98d8e

Download Submit
C:\Windows\SysWOW64\Omcjep32.exe

Filesize
145KB

MD5
5babe81e3ca28e5c8f69f6fd9326839e

SHA1
38b4329c4548beb269c91c718356946a04621a58

SHA256
7f3e4283cdc8f85ea83ae952f6eea679cfeeac52b5af2d0335a1fe7fa4866430

SHA512
c6639efa338984d375166d522699c82fe8c9d4b827f4d25535d8316297e79b832bec16024fb9467dcc65ed273c7fd781f94426185d4e5c5e24febc46d80291e3

Download Submit
C:\Windows\SysWOW64\Omgcpokp.exe

Filesize
145KB

MD5
a87d6d96d68c3241c6a4a3bb40916271

SHA1
270df5ba44cce2100cf98a45183613fbf057366c

SHA256
16d4df7fe0d3c66b5d08575c631afb08b4a7562f6eedd85ed2619521118312fc

SHA512
89b64f9b412464a2f18aa92c749e87146e5f5589aa5002d4f9c3016d6a6c0d96942dadea4f6fae46553b057f43e1ad6b4e7fdaff4d17b2fccdee913aeab4c064

Download Submit
C:\Windows\SysWOW64\Onapdl32.exe

Filesize
145KB

MD5
f6c034a95cdee981196b7fe17f152336

SHA1
d0fbd79cc7ba0d45d47bc42aea0cb3f492554398

SHA256
930ebb0c0f90c306157196554f7fc57328e4de44c44740b119dc7caa530c635a

SHA512
3afb059a522f7e47e5cf8790379dfe1b564e02483075850af9172ff62305cc943f0bd84ad5b595118e7c0e14630fb1deeeeb845d1ac56c3fdefaa341ce2e43f0

Download Submit
C:\Windows\SysWOW64\Onkidm32.exe

Filesize
145KB

MD5
39ff63dc3bea998a2a3765ddbf27577f

SHA1
90dd55fd8b09d2af17824a35ad037404898f9958

SHA256
823518d0f15ce8f1febfc6f850f1509e2f1ec83e74b5edd1f62f0a71a17a7bc6

SHA512
fe2238020549a26d0bc3629a098f10f92c10e9a42e02bce9ded70a1beb01f74f6e3dde4a503487dc81d3a3d0dfae5014717e0a7e03824744e5cf7d002129ce12

Download Submit
C:\Windows\SysWOW64\Onnmdcjm.exe

Filesize
145KB

MD5
299f1544247a71bd7075f971a6e6b166

SHA1
a15ef9b287cd5284a88f0707c9f0fe08d1526da5

SHA256
976ab1076b3782e83d68740d7dbb01b8973665030e9f2e55126048ead2c17a99

SHA512
f19332f45ddef8cbf7eff15fac80873ba1a544a7bbb5c4b1505efdd6a161c45d5b2c80334a0c601f5916dab18a2a112dca7896ddd33d8a3bafb7f1dd8c3364f7

Download Submit
C:\Windows\SysWOW64\Onpjichj.exe

Filesize
145KB

MD5
3846bc3136d2e74da6e9f608a91b207f

SHA1
003e17ea1765bea817e19845a5c77993d7057284

SHA256
75b0a86bef70cffc9c2ed67078a80b2f8126749f7f919ec0efb8e478b2ec3602

SHA512
5230938c2789004aad427fd882fe65491b6f59bbaf384ccdc2c75cd51aec0fbad11ae32772eb99744a14d096e9f1f3fb0df4929ee9e573247498cb9f4dc2cd5e

Download Submit
C:\Windows\SysWOW64\Oobfob32.exe

Filesize
145KB

MD5
3548435f20f3aaa080ea9c55407a0d7c

SHA1
6620052bb40df3b0d87adb589b93493b4d26da37

SHA256
24ff5331f06180bf2c49ca9512276c506076a04af46bc177f27d8b622ab816a6

SHA512
4f8c8800f533ced6ddd2ce4d3175cc15363e11ef541286395e12a980d806d526812b0bbc01908a3c0a03cc7d5c8d868ab53a7e212c2bfe9662a4d694f69d1b32

Download Submit
C:\Windows\SysWOW64\Pfdjinjo.exe

Filesize
145KB

MD5
ada4494cb0994bfa0e62c37ad6e1004f

SHA1
123f03a2dae564ea91fc1f5e85be50c1c747506e

SHA256
ba26b90170228a44622a7638f6dd7899a8d5fabbf83aee556c998f0e81beec87

SHA512
49928e725683d7b175c222a2c1ec619d838a55f152dfc0b4077f4582429a1d48dcb5abecfdccab8f2b2b6bc885382aa5618e3d0e2d092d19435989becce04fb4

Download Submit
C:\Windows\SysWOW64\Phodcg32.exe

Filesize
145KB

MD5
3d374f0cbc0282204c327445d0fef70f

SHA1
efef11cca8e2f964f27cc47f039697e21f8e2cd6

SHA256
63d4bf5f348622f0edccdc9b24effff6485498b96327de598d7b7aefaacbba04

SHA512
7a5d4fd01f93c410f890662cb9911b264d7ea124ba3178740772562c77f1084c61b370fa53cea312ddcf621cd482a25e55a5d7c82e00ac6ff92bd94c1ee805ca

Download Submit
C:\Windows\SysWOW64\Qdoacabq.exe

Filesize
145KB

MD5
74e7fc10cba9a28c78fa7b1518287ec2

SHA1
13f52c18e2aabf6644c018a05cace5ba9b6a0805

SHA256
a46cee6ac3da290045864ff2f99ca388ed2751763575969ab4c5d79a57b4eaf7

SHA512
4772e1f492387734d78a7e9b1674c0b1bdb90f6f8df7a0d7086e5af46682294cec16230d0877b707ac4e7c76ed3d0aa14866f2aeaefca26f3da4325b5e4a7d50

Download Submit
C:\Windows\SysWOW64\Qjfmkk32.exe

Filesize
145KB

MD5
847acb04ee03197035fd73e3cdc7518c

SHA1
d79b35a4a4399d20a699a4b5ea1df3a87e46501f

SHA256
a5e3779917044ea1fda962039a392917641a575d5ffcf6950acfc2b823e55925

SHA512
d112ef8761eb774c27235b20c65a8eec0db574c121e176e5b4876ba4d1f78ff5bda0e48d4d22c8f13c967c4f0d978ca58a8cf5d216e32ba4bba6d94ce9296a5f

Download Submit
memory/224-260-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/372-564-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/456-372-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/516-89-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/516-606-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/640-570-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/640-49-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/732-415-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/880-241-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/924-384-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/992-563-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/992-41-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1080-217-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1152-268-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1188-343-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1276-607-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1276-97-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1284-292-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1376-383-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1384-262-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1480-286-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1720-658-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1720-153-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1820-278-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1884-185-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1904-308-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/1948-315-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2016-197-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2044-406-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2108-80-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2108-599-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2140-33-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2140-557-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2152-298-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2244-418-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2276-237-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2300-104-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2300-614-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2304-399-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2456-145-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2456-647-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2612-201-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2704-73-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2704-588-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2944-327-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3280-326-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3328-361-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3564-280-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3584-639-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3584-133-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3588-161-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3832-8-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3832-538-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3840-2418-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3868-113-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3868-621-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4016-224-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4160-526-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4160-0-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4160-5-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/4164-137-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4164-645-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4212-344-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4376-176-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4492-169-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4508-580-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4508-57-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4584-359-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4628-25-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4628-551-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4808-121-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4808-628-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4816-65-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4816-586-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4960-208-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4992-545-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4992-21-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5180-424-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5220-430-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5260-440-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5336-450-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5376-453-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5404-589-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5416-463-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5492-474-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5576-486-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5616-487-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5624-608-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5704-502-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5712-615-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5780-513-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5804-2906-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5804-622-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5856-522-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5880-629-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5936-532-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/5976-539-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/6132-648-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/6184-2856-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/6748-2832-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/7744-2730-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/8436-2553-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/8468-2626-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/8564-2551-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/8688-2548-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/8696-2523-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/8768-2547-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/8948-2545-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/9224-2511-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/9284-2429-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/9456-2453-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/9852-2478-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/9972-2474-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/10124-2463-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/10376-2407-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/10700-2398-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/10736-2397-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/10880-2393-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/10916-2392-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/11108-2370-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/11204-2368-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads