17aceccd63088f05e07cafacd2565ac0127cf051daa9f0660c45256888005138

Analysis

max time kernel
140s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3d083688398e01bcdd8f52770511670_NeikiAnalytics.exe
Size

414KB
MD5

c3d083688398e01bcdd8f52770511670
SHA1

137b97aa9eced0c6e963bf1bada75cde76dd53cd
SHA256

17aceccd63088f05e07cafacd2565ac0127cf051daa9f0660c45256888005138
SHA512

3ba536808e834d336ff2be6da1d80c773b16f55f458a961a42dd0e89d3d5c0ea6a48d8166620e6ad03a9964ca74e1efdb9f14fb6bbab1ff56ff4ba6a72abd670
SSDEEP

12288:z6d8jsL336edOGeKTaPkY660fIaDZkY660ffL:Q8jsLaedOGeKTaPgsaDZgTL

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlcifmbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nlmllkja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ondeac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlednamo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kpgfooop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjffbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfhdlh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpebpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdmnlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Blbknaib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Peljol32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aldomc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odocigqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kemhff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojgbfocc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddbbeade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Migjoaaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oneklm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Edpnfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Npcoakfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ondeac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Demecd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmabdibj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mglack32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fooeif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gicinj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocpgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnlhfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dedkdcie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gomakdcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pbmncp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Febgea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ippggbck.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anmjcieo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqhacgdh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Onmhgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmeobkq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eadopc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqklmpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acjjfggb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dbaemi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcefno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njnpppkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndcdmikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pkaiqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gcojed32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Peljol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlampmdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Beihma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpgfooop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncnadk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocegdjij.exe

Executes dropped EXE 64 IoCs

pid	Process
2924	Kibnhjgj.exe
4280	Kajfig32.exe
2960	Lpocjdld.exe
5064	Lcpllo32.exe
2544	Lcbiao32.exe
1800	Lgneampk.exe
5044	Lnjjdgee.exe
5056	Mnlfigcc.exe
816	Mdfofakp.exe
2756	Mjeddggd.exe
2116	Mjhqjg32.exe
3896	Mglack32.exe
1744	Mcbahlip.exe
3484	Njljefql.exe
384	Nacbfdao.exe
4840	Ndbnboqb.exe
536	Ngpjnkpf.exe
1672	Nnjbke32.exe
5116	Nqiogp32.exe
2340	Ncgkcl32.exe
3908	Nkncdifl.exe
1648	Njacpf32.exe
672	Nnmopdep.exe
4060	Nqklmpdd.exe
5104	Ndghmo32.exe
2360	Ncihikcg.exe
4228	Nkqpjidj.exe
2316	Njcpee32.exe
1952	Nbkhfc32.exe
3540	Nqmhbpba.exe
2828	Ndidbn32.exe
396	Ncldnkae.exe
3176	Nggqoj32.exe
3336	Njfmke32.exe
60	Nnaikd32.exe
4992	Nbmelbid.exe
1628	Ndkahnhh.exe
3196	Ncnadk32.exe
4856	Ogjmdigk.exe
4468	Ojhiqefo.exe
2636	Ondeac32.exe
4464	Oboaabga.exe
4472	Oqbamo32.exe
4440	Ocqnij32.exe
4536	Ogljjiei.exe
3844	Okhfjh32.exe
5012	Onfbfc32.exe
4152	Obangb32.exe
4776	Odpjcm32.exe
2632	Occkojkm.exe
4628	Ogogoi32.exe
1100	Okjbpglo.exe
640	Onholckc.exe
888	Obdkma32.exe
1808	Odbgim32.exe
3500	Ocegdjij.exe
3232	Ogaceh32.exe
2656	Ojopad32.exe
2728	Onklabip.exe
3388	Obfhba32.exe
4548	Odednmpm.exe
3156	Ocgdji32.exe
2868	Okolkg32.exe
4492	Ojalgcnd.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Conclk32.exe	Clpgpp32.exe
File opened for modification	C:\Windows\SysWOW64\Ehimanbq.exe	Eekaebcm.exe
File opened for modification	C:\Windows\SysWOW64\Febgea32.exe	Fcckif32.exe
File opened for modification	C:\Windows\SysWOW64\Mmnldp32.exe	Megdccmb.exe
File created	C:\Windows\SysWOW64\Ladjgikj.dll	Ofnckp32.exe
File created	C:\Windows\SysWOW64\Oomibind.dll	Pqpgdfnp.exe
File opened for modification	C:\Windows\SysWOW64\Fkalchij.exe	Fhcpgmjf.exe
File opened for modification	C:\Windows\SysWOW64\Jcbihpel.exe	Jlkagbej.exe
File created	C:\Windows\SysWOW64\Glgmkm32.dll	Olcbmj32.exe
File opened for modification	C:\Windows\SysWOW64\Qgcbgo32.exe	Qqijje32.exe
File created	C:\Windows\SysWOW64\Nhgaocmg.dll	Kfckahdj.exe
File created	C:\Windows\SysWOW64\Ogbipa32.exe	Oqhacgdh.exe
File created	C:\Windows\SysWOW64\Ondeac32.exe	Ojhiqefo.exe
File created	C:\Windows\SysWOW64\Fklfdo32.dll	Oboaabga.exe
File created	C:\Windows\SysWOW64\Pjmehkqk.exe	Pgnilpah.exe
File created	C:\Windows\SysWOW64\Papbpdoi.dll	Qfcfml32.exe
File created	C:\Windows\SysWOW64\Pkejdahi.dll	Anogiicl.exe
File created	C:\Windows\SysWOW64\Ihidlk32.dll	Bmngqdpj.exe
File created	C:\Windows\SysWOW64\Gpamgn32.dll	Okhfjh32.exe
File created	C:\Windows\SysWOW64\Oqkdcn32.exe	Onmhgb32.exe
File created	C:\Windows\SysWOW64\Jfoiokfb.exe	Ibcmom32.exe
File created	C:\Windows\SysWOW64\Ooajidfn.dll	Jfoiokfb.exe
File created	C:\Windows\SysWOW64\Agocgbni.dll	Ncbknfed.exe
File created	C:\Windows\SysWOW64\Ocljjj32.dll	Ngdmod32.exe
File created	C:\Windows\SysWOW64\Nnneknob.exe	Njciko32.exe
File created	C:\Windows\SysWOW64\Qgppolie.dll	Ojaelm32.exe
File created	C:\Windows\SysWOW64\Pqpgdfnp.exe	Pnakhkol.exe
File created	C:\Windows\SysWOW64\Gpnkgo32.dll	Mjeddggd.exe
File opened for modification	C:\Windows\SysWOW64\Nnmopdep.exe	Njacpf32.exe
File opened for modification	C:\Windows\SysWOW64\Clpgpp32.exe	Chdkoa32.exe
File created	C:\Windows\SysWOW64\Jmpgldhg.exe	Jehokgge.exe
File created	C:\Windows\SysWOW64\Kedoge32.exe	Kbfbkj32.exe
File opened for modification	C:\Windows\SysWOW64\Eofbch32.exe	Ekjfcipa.exe
File created	C:\Windows\SysWOW64\Cnaijinl.dll	Gbdgfa32.exe
File created	C:\Windows\SysWOW64\Qgcbgo32.exe	Qqijje32.exe
File opened for modification	C:\Windows\SysWOW64\Bjokdipf.exe	Bganhm32.exe
File created	C:\Windows\SysWOW64\Ocqnij32.exe	Oqbamo32.exe
File created	C:\Windows\SysWOW64\Gdeahgnm.dll	Ajfhnjhq.exe
File opened for modification	C:\Windows\SysWOW64\Andqdh32.exe	Afmhck32.exe
File opened for modification	C:\Windows\SysWOW64\Mglack32.exe	Mjhqjg32.exe
File created	C:\Windows\SysWOW64\Qgphkcho.dll	Ogaceh32.exe
File opened for modification	C:\Windows\SysWOW64\Fohoigfh.exe	Fljcmlfd.exe
File created	C:\Windows\SysWOW64\Bqhimici.dll	Fljcmlfd.exe
File created	C:\Windows\SysWOW64\Acpcoaap.dll	Onjegled.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Flceckoj.exe	Fdlnbm32.exe
File created	C:\Windows\SysWOW64\Panfqmhb.dll	Pfhfan32.exe
File created	C:\Windows\SysWOW64\Beihma32.exe	Bnpppgdj.exe
File created	C:\Windows\SysWOW64\Jcbldglg.dll	Demecd32.exe
File created	C:\Windows\SysWOW64\Mdmann32.dll	Gdqgmmjb.exe
File opened for modification	C:\Windows\SysWOW64\Hkkhqd32.exe	Hodgkc32.exe
File opened for modification	C:\Windows\SysWOW64\Ngpccdlj.exe	Ndaggimg.exe
File created	C:\Windows\SysWOW64\Mcbahlip.exe	Mglack32.exe
File created	C:\Windows\SysWOW64\Mlhblb32.dll	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Ceacpg32.dll	Iiaephpc.exe
File created	C:\Windows\SysWOW64\Donfhp32.dll	Ocbddc32.exe
File created	C:\Windows\SysWOW64\Nkqpjidj.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Okhfjh32.exe	Ogljjiei.exe
File created	C:\Windows\SysWOW64\Camjdd32.dll	Oqkdcn32.exe
File opened for modification	C:\Windows\SysWOW64\Flceckoj.exe	Fdlnbm32.exe
File created	C:\Windows\SysWOW64\Lmbmibhb.exe	Lekehdgp.exe
File created	C:\Windows\SysWOW64\Pcpopjlq.dll	Bhkhibmc.exe
File created	C:\Windows\SysWOW64\Adecfl32.dll	Ipnjab32.exe
File opened for modification	C:\Windows\SysWOW64\Ipbdmaah.exe	Ilghlc32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10712	10528	WerFault.exe	511

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ffkjlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiclgb32.dll"	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qopkop32.dll"	Bagflcje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chmeobkq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amhpcomb.dll"	Lmdina32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndfqbhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqckln32.dll"	Oqhacgdh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ojaelm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmoahijl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qalnjkgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ckedalaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lpnlpnih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pcjapi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olfdahne.dll"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcjlfqa.dll"	Anmjcieo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Obdkma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Odbgim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Demecd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hodgkc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hmjdjgjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mgimcebb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leqcid32.dll"	Bjokdipf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncgkcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ipnjab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnlhfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhbepcmd.dll"	Pdifoehl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qmkadgpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gbdgfa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cbefaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fcckif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ceacpg32.dll"	Iiaephpc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lfkaag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Liimncmf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qqijje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qbimoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ocqnij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Meknidfo.dll"	Qbimoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cefoce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mplhql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljfemn32.dll"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhgaocmg.dll"	Kfckahdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Medgncoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgepdkpo.dll"	Npmagine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmannhhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pbkamqmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lfhdlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlddhggk.dll"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Acmflf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gofkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elogmm32.dll"	Jcbihpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojhnmh32.dll"	Kmijbcpl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	c3d083688398e01bcdd8f52770511670_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fhemmlhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncnaabfm.dll"	Jianff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Migjoaaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ekjfcipa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmmjhgem.dll"	Pbmncp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhkhibmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcfmgfde.dll"	Dkljak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Higchddh.dll"	Dahode32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3592 wrote to memory of 2924	3592	c3d083688398e01bcdd8f52770511670_NeikiAnalytics.exe	85
PID 3592 wrote to memory of 2924	3592	c3d083688398e01bcdd8f52770511670_NeikiAnalytics.exe	85
PID 3592 wrote to memory of 2924	3592	c3d083688398e01bcdd8f52770511670_NeikiAnalytics.exe	85
PID 2924 wrote to memory of 4280	2924	Kibnhjgj.exe	86
PID 2924 wrote to memory of 4280	2924	Kibnhjgj.exe	86
PID 2924 wrote to memory of 4280	2924	Kibnhjgj.exe	86
PID 4280 wrote to memory of 2960	4280	Kajfig32.exe	87
PID 4280 wrote to memory of 2960	4280	Kajfig32.exe	87
PID 4280 wrote to memory of 2960	4280	Kajfig32.exe	87
PID 2960 wrote to memory of 5064	2960	Lpocjdld.exe	88
PID 2960 wrote to memory of 5064	2960	Lpocjdld.exe	88
PID 2960 wrote to memory of 5064	2960	Lpocjdld.exe	88
PID 5064 wrote to memory of 2544	5064	Lcpllo32.exe	90
PID 5064 wrote to memory of 2544	5064	Lcpllo32.exe	90
PID 5064 wrote to memory of 2544	5064	Lcpllo32.exe	90
PID 2544 wrote to memory of 1800	2544	Lcbiao32.exe	91
PID 2544 wrote to memory of 1800	2544	Lcbiao32.exe	91
PID 2544 wrote to memory of 1800	2544	Lcbiao32.exe	91
PID 1800 wrote to memory of 5044	1800	Lgneampk.exe	93
PID 1800 wrote to memory of 5044	1800	Lgneampk.exe	93
PID 1800 wrote to memory of 5044	1800	Lgneampk.exe	93
PID 5044 wrote to memory of 5056	5044	Lnjjdgee.exe	95
PID 5044 wrote to memory of 5056	5044	Lnjjdgee.exe	95
PID 5044 wrote to memory of 5056	5044	Lnjjdgee.exe	95
PID 5056 wrote to memory of 816	5056	Mnlfigcc.exe	96
PID 5056 wrote to memory of 816	5056	Mnlfigcc.exe	96
PID 5056 wrote to memory of 816	5056	Mnlfigcc.exe	96
PID 816 wrote to memory of 2756	816	Mdfofakp.exe	97
PID 816 wrote to memory of 2756	816	Mdfofakp.exe	97
PID 816 wrote to memory of 2756	816	Mdfofakp.exe	97
PID 2756 wrote to memory of 2116	2756	Mjeddggd.exe	98
PID 2756 wrote to memory of 2116	2756	Mjeddggd.exe	98
PID 2756 wrote to memory of 2116	2756	Mjeddggd.exe	98
PID 2116 wrote to memory of 3896	2116	Mjhqjg32.exe	99
PID 2116 wrote to memory of 3896	2116	Mjhqjg32.exe	99
PID 2116 wrote to memory of 3896	2116	Mjhqjg32.exe	99
PID 3896 wrote to memory of 1744	3896	Mglack32.exe	100
PID 3896 wrote to memory of 1744	3896	Mglack32.exe	100
PID 3896 wrote to memory of 1744	3896	Mglack32.exe	100
PID 1744 wrote to memory of 3484	1744	Mcbahlip.exe	101
PID 1744 wrote to memory of 3484	1744	Mcbahlip.exe	101
PID 1744 wrote to memory of 3484	1744	Mcbahlip.exe	101
PID 3484 wrote to memory of 384	3484	Njljefql.exe	102
PID 3484 wrote to memory of 384	3484	Njljefql.exe	102
PID 3484 wrote to memory of 384	3484	Njljefql.exe	102
PID 384 wrote to memory of 4840	384	Nacbfdao.exe	103
PID 384 wrote to memory of 4840	384	Nacbfdao.exe	103
PID 384 wrote to memory of 4840	384	Nacbfdao.exe	103
PID 4840 wrote to memory of 536	4840	Ndbnboqb.exe	104
PID 4840 wrote to memory of 536	4840	Ndbnboqb.exe	104
PID 4840 wrote to memory of 536	4840	Ndbnboqb.exe	104
PID 536 wrote to memory of 1672	536	Ngpjnkpf.exe	105
PID 536 wrote to memory of 1672	536	Ngpjnkpf.exe	105
PID 536 wrote to memory of 1672	536	Ngpjnkpf.exe	105
PID 1672 wrote to memory of 5116	1672	Nnjbke32.exe	106
PID 1672 wrote to memory of 5116	1672	Nnjbke32.exe	106
PID 1672 wrote to memory of 5116	1672	Nnjbke32.exe	106
PID 5116 wrote to memory of 2340	5116	Nqiogp32.exe	107
PID 5116 wrote to memory of 2340	5116	Nqiogp32.exe	107
PID 5116 wrote to memory of 2340	5116	Nqiogp32.exe	107
PID 2340 wrote to memory of 3908	2340	Ncgkcl32.exe	108
PID 2340 wrote to memory of 3908	2340	Ncgkcl32.exe	108
PID 2340 wrote to memory of 3908	2340	Ncgkcl32.exe	108
PID 3908 wrote to memory of 1648	3908	Nkncdifl.exe	109

C:\Users\Admin\AppData\Local\Temp\c3d083688398e01bcdd8f52770511670_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\c3d083688398e01bcdd8f52770511670_NeikiAnalytics.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3592
- C:\Windows\SysWOW64\Kibnhjgj.exe
  C:\Windows\system32\Kibnhjgj.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\Kajfig32.exe
    C:\Windows\system32\Kajfig32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Windows\SysWOW64\Lpocjdld.exe
      C:\Windows\system32\Lpocjdld.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5064
      - C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2544
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5056
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:816
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2116
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3896
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1744
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3484
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:384
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4840
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3908
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1648
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:672
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4060
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        26⤵
        Executes dropped EXE
        
        PID:5104
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2360
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        28⤵
        Executes dropped EXE
        
        PID:4228
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        29⤵
        Executes dropped EXE
        
        PID:2316
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1952
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        31⤵
        Executes dropped EXE
        
        PID:3540
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2828
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        33⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        34⤵
        Executes dropped EXE
        
        PID:3176
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        35⤵
        Executes dropped EXE
        
        PID:3336
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        36⤵
        Executes dropped EXE
        
        PID:60
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        37⤵
        Executes dropped EXE
        
        PID:4992
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        38⤵
        Executes dropped EXE
        
        PID:1628
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3196
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        40⤵
        Executes dropped EXE
        
        PID:4856
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4468
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2636
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4464
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4472
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4440
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4536
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3844
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        48⤵
        Executes dropped EXE
        
        PID:5012
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        49⤵
        Executes dropped EXE
        
        PID:4152
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        50⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        51⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        52⤵
        Executes dropped EXE
        
        PID:4628
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        53⤵
        Executes dropped EXE
        
        PID:1100
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        54⤵
        Executes dropped EXE
        
        PID:640
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:888
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1808
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3500
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3232
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        59⤵
        Executes dropped EXE
        
        PID:2656
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        60⤵
        Executes dropped EXE
        
        PID:2728
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        61⤵
        Executes dropped EXE
        
        PID:3388
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        62⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        63⤵
        Executes dropped EXE
        
        PID:3156
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        64⤵
        Executes dropped EXE
        
        PID:2868
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        65⤵
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3876
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        67⤵
        Drops file in System32 directory
        
        PID:3248
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        68⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        69⤵
        Modifies registry class
        
        PID:884
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4948
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        71⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        72⤵
        Modifies registry class
        
        PID:5000
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        73⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        74⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        75⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        76⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1616
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:424
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3276
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        80⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        81⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        82⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        83⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        84⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        85⤵
        Modifies registry class
        
        PID:5088
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        86⤵
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5164
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        88⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        89⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        90⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        91⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        92⤵
        Modifies registry class
        
        PID:5352
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5444
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5616
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        95⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        96⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        97⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        98⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        99⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5820
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        100⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        101⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        103⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        104⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        105⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        106⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        107⤵
        Modifies registry class
        
        PID:116
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        108⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        109⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        110⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        111⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        112⤵
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        113⤵
        Drops file in System32 directory
        
        PID:5336
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        114⤵
        Drops file in System32 directory
        
        PID:5344
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        115⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        116⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        117⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        118⤵
        Modifies registry class
        
        PID:5492
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        119⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        120⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        121⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5816
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        123⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5952
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        125⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6128
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        127⤵
        Modifies registry class
        
        PID:768
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        128⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        129⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        130⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        131⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        132⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        133⤵
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5516
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        135⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        136⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        137⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        138⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        139⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        140⤵
        
        PID:848
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        141⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        142⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        143⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        144⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        145⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        146⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        147⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        148⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        149⤵
        Drops file in System32 directory
        
        PID:5160
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        150⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        151⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        152⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        153⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6188
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        155⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        156⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6272
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        157⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6356
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        159⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        160⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        161⤵
        Drops file in System32 directory
        
        PID:6496
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        162⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        163⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6620
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        165⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        166⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        167⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        168⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        169⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        170⤵
        Drops file in System32 directory
        
        PID:6884
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        171⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        172⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        173⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        174⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        175⤵
        Modifies registry class
        
        PID:7088
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7132
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        177⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        178⤵
        Drops file in System32 directory
        
        PID:6236
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        179⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        180⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        181⤵
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        182⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        183⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        184⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6836
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        186⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        187⤵
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        188⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        189⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        190⤵
        Modifies registry class
        
        PID:6364
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        191⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6492
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        192⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        193⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        194⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        195⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        196⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        197⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        198⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        199⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6488
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        201⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6412
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        203⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        204⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7180
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        206⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        207⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        208⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7308
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        209⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        210⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        211⤵
        Modifies registry class
        
        PID:7440
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        212⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7488
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        213⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        214⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        215⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7616
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        216⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        217⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        218⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7788
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        220⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        221⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        222⤵
        Drops file in System32 directory
        
        PID:7920
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        223⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        224⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        225⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        226⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        227⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        228⤵
        Drops file in System32 directory
        
        PID:8172
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        229⤵
        Drops file in System32 directory
        
        PID:7188
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        230⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        231⤵
        Drops file in System32 directory
        
        PID:7332
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        232⤵
        Modifies registry class
        
        PID:7388
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        233⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        234⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        235⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        236⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7744
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        238⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        239⤵
        Modifies registry class
        
        PID:7860
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        240⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        241⤵
        Drops file in System32 directory
        
        PID:8000
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        242⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        243⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        244⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        245⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7436
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        247⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7684
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        249⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        250⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        251⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        252⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        253⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        254⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        255⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        256⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        257⤵
        Modifies registry class
        
        PID:8040
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7368
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        259⤵
        Drops file in System32 directory
        
        PID:7644
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        260⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        261⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        262⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        263⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        264⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7888
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        265⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        266⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        267⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        268⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        269⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        270⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        271⤵
        Modifies registry class
        
        PID:8516
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8560
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        273⤵
        Drops file in System32 directory
        
        PID:8604
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        274⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        275⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        276⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        277⤵
        Modifies registry class
        
        PID:8824
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        278⤵
        Modifies registry class
        
        PID:8864
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        279⤵
        Modifies registry class
        
        PID:8916
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        280⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        281⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9040
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        283⤵
        Modifies registry class
        
        PID:9080
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        284⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        285⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        286⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        287⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        288⤵
        Modifies registry class
        
        PID:8332
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        289⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        290⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        291⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        292⤵
        Drops file in System32 directory
        
        PID:8632
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        293⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8812
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        295⤵
        Modifies registry class
        
        PID:8888
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        296⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        297⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9076
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        299⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        300⤵
        Modifies registry class
        
        PID:8236
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8304
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        302⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        303⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8808
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        305⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        306⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        307⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9148
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        309⤵
        Drops file in System32 directory
        
        PID:8204
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        310⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        311⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        312⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        313⤵
        Drops file in System32 directory
        
        PID:8984
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        314⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8464
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8860
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8412
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        318⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8456
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        320⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        321⤵
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        322⤵
        Drops file in System32 directory
        
        PID:8704
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        323⤵
        Drops file in System32 directory
        
        PID:8316
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        324⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        325⤵
        Modifies registry class
        
        PID:6872
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        326⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        327⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        328⤵
        Drops file in System32 directory
        
        PID:9348
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        329⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        330⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        331⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9528
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        333⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        334⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9656
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        336⤵
        Drops file in System32 directory
        
        PID:9692
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9736
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        338⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9820
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        340⤵
        Drops file in System32 directory
        
        PID:9860
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        341⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        342⤵
        Modifies registry class
        
        PID:9944
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        343⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        344⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        345⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        346⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        347⤵
        Drops file in System32 directory
        
        PID:10152
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:10196
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        349⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        350⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9248
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        351⤵
        Modifies registry class
        
        PID:9344
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        352⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        353⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        354⤵
        Drops file in System32 directory
        
        PID:9564
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        355⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        356⤵
        Modifies registry class
        
        PID:9688
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9760
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        358⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        359⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        360⤵
        Drops file in System32 directory
        
        PID:9976
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        361⤵
        Drops file in System32 directory
        
        PID:10052
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        362⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10204
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        364⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9320
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        366⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        367⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        368⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        369⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        370⤵
        Drops file in System32 directory
        
        PID:9964
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        371⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        372⤵
        Modifies registry class
        
        PID:10216
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        373⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        374⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        375⤵
        Drops file in System32 directory
        
        PID:9560
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        376⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        377⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        378⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10236
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9424
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9848
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        381⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9844
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        383⤵
        Drops file in System32 directory
        
        PID:9308
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        384⤵
        Modifies registry class
        
        PID:10044
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        385⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        386⤵
        Drops file in System32 directory
        
        PID:10292
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        387⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        388⤵
        Drops file in System32 directory
        
        PID:10364
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        389⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        390⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        391⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        392⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        393⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10544
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        394⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10616
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        396⤵
        Drops file in System32 directory
        
        PID:10652
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        397⤵
        Modifies registry class
        
        PID:10688
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        398⤵
        Drops file in System32 directory
        
        PID:10724
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        399⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        400⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        401⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        402⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        403⤵
        Drops file in System32 directory
        
        PID:10904
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10944
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        405⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10984
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        406⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        407⤵
        Modifies registry class
        
        PID:11056
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        408⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        409⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        410⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        411⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11200
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        412⤵
        Modifies registry class
        
        PID:11236
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        413⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        414⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        415⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        416⤵
        Drops file in System32 directory
        
        PID:10468
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        417⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10528 -s 216
        418⤵
        Program crash
        
        PID:10712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 10528 -ip 10528
1⤵
PID:10636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ajfhnjhq.exe

Filesize
414KB

MD5
36d661176e50a2e4e595a130983360ea

SHA1
57eab344d33ce3885bbe2a2f7f23e04181809529

SHA256
e2eeec96323dfc81f6a4017833546aefea52b3a17957effd2e2c57b4aa6f4006

SHA512
c70a25255a251a35e7db835dbf18e155b037d4e3ceb385971df2e899252e9d3636c14fc8ad852893cb7eb620ceb351335ea5255ad12ccc197d852368a24af2d1

Download Submit
C:\Windows\SysWOW64\Aminee32.exe

Filesize
414KB

MD5
2e8b671c2bd5305dfa01234fb5bea811

SHA1
5f890d43e0644a736fc064d6c64b6d615e0e3395

SHA256
018ec993413440d027e913a1134c0814d9a28607d3baebe611f6b6c3266c8288

SHA512
0fc75895a3eeac25423184dfe38384a4edd1a1a038fbbcb4dd58919c32e49cfa110665783517ec83bd9ed4d9b56a48ae488a3a3e918b6f41e9c5a8fb7aa27ba8

Download Submit
C:\Windows\SysWOW64\Anogiicl.exe

Filesize
414KB

MD5
f81e474c75bdd7ede443903e9a9aa1a0

SHA1
316f9ad96bdba66c318085b4ee8582469d9c4ebc

SHA256
1a7a05ef5379ab38162b8d68470cdbdb4b6f399dd8ce9f9e8899de6e5e8bc411

SHA512
7f20e7f5ac6ce0d45960fb58f8d9a848291408c86d23a67990f8d5d2f6a7546aa4fd4eeefa9f154f6b9270b46e105f5ce7c1307bb10c50bb59a8c03aa6e0fa57

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
414KB

MD5
c1f132c0742d6ddf1c9131262751eff1

SHA1
e0ba0026ea84ecd9b4c55b84dc8adc0b045c0f82

SHA256
0d03a6a7fd4073039acc6c3f64727dd274a9c0e33a7ca1a5586802f8d332526b

SHA512
443c7742c453812a69523ab9b6ec315871762dae00bf67078344c2719cd5a2b9a5565bddef028f0056e42593906cc9fe566e9f13cbe0fe78d8b9e95e028138cc

Download Submit
C:\Windows\SysWOW64\Balpgb32.exe

Filesize
414KB

MD5
d3ac8e09a74fd1954b14f5e5bfc6523a

SHA1
4350ddaf77d12bf4708c56f67c41dae4d5bc4760

SHA256
2db22c6c7367a1e24d65998458400ec0c0ff66d41975a59f34053b0eaeff6e16

SHA512
1ca2d88eea9f52c2adec6097804472fd70aebc787305e1244f2b959b5d63a5213af223e68b994f3d4496412213e267da1fd5d5fbede435456347012c3fcb0117

Download Submit
C:\Windows\SysWOW64\Bejogg32.exe

Filesize
414KB

MD5
1c2c20678619093635530bffbf36098d

SHA1
5fc56aac6d1dc2bb26f681c67f43cfc3fb7b8aeb

SHA256
6378be8c118395c657241f22960939f1838c468d5b3f632a2afe275da69a83ac

SHA512
fd7118afc24874990089d8ea598d729dcddbebb93c1dfc5ad0aef2aa8f5606ed02c315415c775f85befd11f34c286a444d6c39c7a87f8cc09223e116752dd5cc

Download Submit
C:\Windows\SysWOW64\Bjagjhnc.exe

Filesize
414KB

MD5
2013205c0a2c1866f7ac90e68a6bc65c

SHA1
b55196ca85829a01bb38ab0ce933632549ec8e97

SHA256
957c0bfabe5791690317a25d9c0c636857508c4646c2001d19ffe0f6d6b17e93

SHA512
fc6b9084a74340a17e9a299dee5258ed70a37f011dbea39b723f91564474c49d0b892bd6df982421477ede1c350304b96a92fc42c700435eb95a7b1ce9d992c5

Download Submit
C:\Windows\SysWOW64\Cafigg32.exe

Filesize
414KB

MD5
ff8a76d7de12b77fa436f23d689a78d4

SHA1
516a43f5cb39a7c88972e499f4c932cae172c4db

SHA256
03a669256c898b0b664bf8670991b34c87e2531399da4b68cdbfe6bb5d91b8da

SHA512
087edc1882e85207e1f96d9f71d655fbebf437d4cf4c34ebbe79ff0c0fc8c18f0d6bc31cf8211c807584599526729924bac71e0d0932203a9909f0676b62bd87

Download Submit
C:\Windows\SysWOW64\Cdabcm32.exe

Filesize
414KB

MD5
71e21fc5fd5f27c637409212386e4deb

SHA1
b2035cdd2c0bd76ad0997d2c39930659ceb8ddfd

SHA256
77cb5e3e93ffeb11d94122cd64323fc166a551072e6d9edc0eddab5284d66be9

SHA512
8f12b1c9e1f42c0ffb7a4cb33a0693afe68d7c969e1eb047d67c9a821b1982121684b4d9eebc02ce391909a21ce5ef634432d82fbdbd5052ed37f6dbda250929

Download Submit
C:\Windows\SysWOW64\Ckedalaj.exe

Filesize
414KB

MD5
26a3086b346863945c8f71e3aee0ccc2

SHA1
1223d0e36ef3ad0933563dc87a92edc1ed00b63d

SHA256
780a4554f0e2e86b7b3bf086d680e79b47286b1b1442706b854d425995c8f102

SHA512
61e261344e2d3107f3bf14536da21e5634909fa7529537a56ae3578d083ea4724e04a8fe85cf93478b67785fbbdac705050122baf5ac468918cf2ebcc440f602

Download Submit
C:\Windows\SysWOW64\Cnkplejl.exe

Filesize
414KB

MD5
8aa852bc585ff5bc694bd7fb31a9609e

SHA1
7141f0817f8df0281a4da3d7ec6603648fb9cf12

SHA256
b6c730db5caea3f56a06ec106a11a14e4ae52d59e8704819e3cfe1ba3335b141

SHA512
54a86f6302000887102b012631e69cda11f4630f2ec0852804b01f366680b0edfeedffc992f83d8e350627c5e53a5a76436a12cf76b8cc3fab95f74c36bd0805

Download Submit
C:\Windows\SysWOW64\Dhkapp32.exe

Filesize
414KB

MD5
7f2514b5718dd9efe0eb756daae46b83

SHA1
4c6ac65485df49ff59366ebdf0c2567bf96308e6

SHA256
bbfdb4c0b7c9a6fbfd8ac396aa2a50189ae715d69b71f17529d3190e21f85a51

SHA512
b61f796dbe7d76f2feb06167435f88339696441631050a0455d24da0c4d82436f16136503e4a20c84671f72412647ddd6d996bfb7df447e97d3054c874df6845

Download Submit
C:\Windows\SysWOW64\Djdmffnn.exe

Filesize
414KB

MD5
23d37b389d8944acca07a3993677f675

SHA1
fb9d7e315c1e83cf8349079cc48f527fc731b488

SHA256
e0e9e1a5e15450f531722977205a197b71f6f87c1e0ab3426afeadd6cc24f108

SHA512
fcb70ec92e0752368e112cbd716b05cbede12b54194e4c1ced570c7dec9db5d7df1c107f40af12ac8f868cc80f82ec37c7aab7065b79b675cf7e27b1cf99bb98

Download Submit
C:\Windows\SysWOW64\Flceckoj.exe

Filesize
414KB

MD5
2110111951adbf103ac8eb2dabe78793

SHA1
b243aedb732ef4477cf5d3569e62a7f17e8802a6

SHA256
28ad3b27723a920afe2017ec9f9fa0e2a154dd179c5e75c696385e69ff961fd4

SHA512
508222d37e143783d3683082081624051dd62cf5dae1c6ee3fb364859e427e96df870b41153860d8470828d382d072e9368fdfc311dee73467fa7c6f47153590

Download Submit
C:\Windows\SysWOW64\Gbiaapdf.exe

Filesize
414KB

MD5
1d684765ae649fcedb0edd31de55dc93

SHA1
9c285c4167badc84159a64b9d9fbecb8db7a5ab8

SHA256
aa0e0f0460f982583368f65d9213869fded8a6bce99209afe560debd45dcdd62

SHA512
69052a9eb19c0b0320be911eaa49c9fe49fcc5daa11dc852e63b8d18a37cdf72e2af3ef5cb26f0f8bb36f27ea9255ea3fd092f3411f5b202371bb98af26e0a9a

Download Submit
C:\Windows\SysWOW64\Hodgkc32.exe

Filesize
414KB

MD5
387f6ff17c9c38b7d0906d0d36862211

SHA1
f99557f5f5461bd8d06efcd20ca3f94b515f8f0e

SHA256
c08ba77f9141dc1f36af54805f6933eeb7496c23dcae60ed547c986e24bec2c4

SHA512
ccd2d43409d344085d3f5f7db2b96d6790f2d2f2c23f2ac26085e295bfbbc38cf8c2165c0a0f3d86276c2c97b6ccc2056774f06b75ef4742787984b3258eea92

Download Submit
C:\Windows\SysWOW64\Ibqpimpl.exe

Filesize
414KB

MD5
a273973c4396819f79597d5b78659d1c

SHA1
d1abcfdd15f4ecf867b8ded849c1060cf58ead64

SHA256
63473330c0b77646434d6db5186c626bea8702d5f07375df70719b2b002351d4

SHA512
6f006568f41d091329bc7ad61923f94738db41626ced35a46af8675aaa3c408c99c197237d349b4945f7a8176c75ae8d18c1ffdd0b08371b9136be1a80874f42

Download Submit
C:\Windows\SysWOW64\Iiaephpc.exe

Filesize
414KB

MD5
18b498293d05f18cb9906ddb81e082f8

SHA1
c897d0012dfc484ba2bc80667344d2689968bacd

SHA256
7c2308779d4c170397b98fbaa4e61d1d468ae8fa26031347269805f1ca34ad8d

SHA512
4fe017fc35a8baf2e88716cb5b418b111e8a60d31a9e1f33ad7f6b2170adfe6e5b454c509cd53d56a1beea89e9641692ab780d60f4340643ab515b2809489e6e

Download Submit
C:\Windows\SysWOW64\Ippggbck.exe

Filesize
414KB

MD5
eb0ad4942be75ca81aaffac3b85c62ad

SHA1
bbd42cc587fc356c5f5eb9acc6f16b623590576e

SHA256
a98e0cfbabf930c8556bee62603de0ae1dc04b4180217ebd7d8c58fe30be9085

SHA512
bc41183628f5963f988d21bffc5aabb9a22bb069f9706e5d273c0bd009e51199020d597be0099c1cec3ac0fe54900511321413c24c77068e6ecdcf5653b4758a

Download Submit
C:\Windows\SysWOW64\Jianff32.exe

Filesize
414KB

MD5
a2b6c370c585d647cbc186f31a8be063

SHA1
231998d58da2ee3b80822bdb7ff2ac49d5cafcc4

SHA256
75304462fc4dd2d4a6fefacbfd599c70d7b6e06304ae11056beb280f8075f602

SHA512
b9e3335fcab8e7494d05cf37500575c56991da7ef8a0fd7cf75fbf5a277bbaebc928a0be22df925bd9169bf185898fd0d3ea7432ab8d7ba62b938fbfaecbfef7

Download Submit
C:\Windows\SysWOW64\Jimekgff.exe

Filesize
414KB

MD5
3240e87f01c7228a90f2f387b1298910

SHA1
404d3823c77e03698d1f3a6929cf104b051c87a1

SHA256
d0222e468bd596a34cfae912442572b0a38dc392005c4ef9cbaf4f47f2f59369

SHA512
4fbf42cd58dee80c1491501e48b0392e8e7125075417ee3d17c026b98def302589fb6bd6bae25e2871542808dce87fc067a92164a6a5eb182deafb95f931d314

Download Submit
C:\Windows\SysWOW64\Jpnchp32.exe

Filesize
414KB

MD5
aacd7da103b37b79f0372565e0efd0a2

SHA1
2d97b4787704ae9085950a5e4e200b2031e2f0bd

SHA256
44f1f6a375e5ab3b59f1f7b536dbeb3faf618043735f88393f07170e56263da3

SHA512
448ba7b7bd5c7a20169d443df92e0016fb605d7ec3c47b0df44f1b6fdd9d7c36ecd1734068b174bd20b6deff5b7d9ef6f256abf6b09e85b0edd6f439312a6053

Download Submit
C:\Windows\SysWOW64\Kajfig32.exe

Filesize
414KB

MD5
cc785aeaf15ded8147a170a3c428b996

SHA1
e5b352e4903e8018b2169922ca15644387e28fb5

SHA256
8596162b07522916a6761dfe3bf8c8ec4886f694bd1c0f540a3ced067c267959

SHA512
efe2155e65059b9f58c3875e530a4e75865989eb9156265d1314a53730511ebbc314a5e034215f5dd5a54eb90d6f3a02b8f9de64b06c750f9108757197a184d4

Download Submit
C:\Windows\SysWOW64\Kibnhjgj.exe

Filesize
414KB

MD5
9711349ee223b6cdc986970bb9294cfb

SHA1
7f1fe0bc0529fe6ebe20cb26bee1e05d73ad5944

SHA256
e27cb33d06b612f99c7e086ce55b428a9b6de61962e40b14acf7ea8b082fe9a6

SHA512
52654a932b9cf1db2212062027756715c48311599a6127be35af19a4a824f4fe1f9ca25b226a8b9f02857ea083d01182012eaa35794c19bb09f5951455d70d5a

Download Submit
C:\Windows\SysWOW64\Klimip32.exe

Filesize
414KB

MD5
26f722edb0cdcac5ce14cd12e9875b4d

SHA1
ca039b29f085a0f587ffcfb235b0e86ced42b1ba

SHA256
5f688678b1b8096cf578a31518472e0927d3cbb55b08fe069e53468a848f364a

SHA512
185ab27a9729f2ed9a77758927816b74e5308b2249e144360be72ebec29fb70aa4bd44b541e0222b10657dbd9458fd6e6b8745c68b2951417b82013b52913abe

Download Submit
C:\Windows\SysWOW64\Lcbiao32.exe

Filesize
414KB

MD5
a2d869bae7b8b5b0a841f9cb74556602

SHA1
2e24c686878b59fe6ee6dff8663131769d480bd7

SHA256
391147f5aac57b9caed81c2122bc60e6ff04f4332d9d1baacfadffd53330137e

SHA512
a769d95786f8b6d5f179f2fa81fa4c159c9e00b96e4e8251faa0e47d399f499d4194c37dc02a8c5cd35e0e0a962414e085c01e85d65c6ea1db91008b10107de5

Download Submit
C:\Windows\SysWOW64\Lcpllo32.exe

Filesize
414KB

MD5
158a3290b6c8787ce38496b17365035b

SHA1
213a948ae34444f9faf941be4fe0d047fee35601

SHA256
a0321509c6b2dfcd609e42f43db96409404a106a5ee8c6330936cc05840647ae

SHA512
20fde2984fae05fce4dfcd3de5dd3bd5028e2ac975caf5a61024d158260649fac3299eb4c3744fe30758a6b6160b237d7da40548c1e95ac3711fee4773d54216

Download Submit
C:\Windows\SysWOW64\Lgneampk.exe

Filesize
414KB

MD5
77b993cbe84ffd1661eee9bf2cf62d35

SHA1
b2121f9866c0ca49e012aca4c1284c5df354e44e

SHA256
cfe07189018eb1a227713c30c80c5c996590692bcdfb007c0c3584d082f443bc

SHA512
677eb99483e044b58006e8b9fc7e8e131629d633fc35d70644e1b40b81dcbbd8757666a68e0b542995f145b3b822cd46c1988f86e1a2854034443391961222ec

Download Submit
C:\Windows\SysWOW64\Lidmdfdo.dll

Filesize
7KB

MD5
888b1179bf773d7f5c29aaf67292bfc3

SHA1
bcba9fec2e7403c63f85cde914b8a344be85a4c2

SHA256
38b59d124edb9ab40c37651664a50dc4432be5af8d90124d5f337f68dcaa1506

SHA512
123986719d0bcecc26ce191a1bbdb390ae4fe293f1ed7de9e6a2364888e7d6238abd683bf81704c6d451ee68e12c7d70d3f9058b6e2d24c05dac26b97de9c314

Download Submit
C:\Windows\SysWOW64\Likjcbkc.exe

Filesize
414KB

MD5
e2d8e3f03f4f079cd742688b7220b772

SHA1
780d4bc20532cde969137ddd3a75e5e6ff78a00b

SHA256
93e72a644985849af898bd4891f3e6111c0728945f0c891946785ac5285a7299

SHA512
88163af3fd14f545aebe77bf68d7990c8eb24553807c6c02ceb0bd894ebf4a340333ae5a7151e7ab3030c2071858b4c988b50ffa482a363cd80143e1d52ea040

Download Submit
C:\Windows\SysWOW64\Lnjjdgee.exe

Filesize
414KB

MD5
1ebbf36cb7fbeca62fc2a1d59db6cb2d

SHA1
e183549e747e3a1c30763a9d6d5edfed577f9f6e

SHA256
13590b6cf45f37fb3130cc2293584d3fa853c21b78b29acaf0b9ba57a6c41666

SHA512
3fdfc513e58d21405f7dcdb7c2ce4cadac519382d27f1f8f01cbb4e552944712b91f5ae33806bf5b6f6fdc6ca93b102e10f5949d5831e4b4cc5ad82642aa8df2

Download Submit
C:\Windows\SysWOW64\Lpnlpnih.exe

Filesize
414KB

MD5
81d29554e12b27e023b3d5c59932fea9

SHA1
87fe20106a5459e7afad0e2012614e8c7fa5205d

SHA256
10309d6f07854b29df107d424b57d53d362c40b95d09aa7d70893c5914117e75

SHA512
fe55519371117652d5cae14977673565f584cc4d9aa83c97590be34d2f13f66029d0c56c31dc3d8102a93454317bccd4709bc264986b482fc2eb7956d71aa567

Download Submit
C:\Windows\SysWOW64\Lpocjdld.exe

Filesize
414KB

MD5
9084893b4578d134fb3598299b5c3bd1

SHA1
a26d2f9417127d9cac587ac72a00a7ad894ad9c2

SHA256
f749fd76731588ed199843f4ff72b7b9b201ad1849dab7bf7bebb10745c9b4e1

SHA512
9234826f9f8171459cd0ae23cbddcbf4ba5a72f1868a25039ba6aaa47d07eb135f850eebce11de19839511beb9e6522e2f1b104dac170bbdfb8830e004e6fa3a

Download Submit
C:\Windows\SysWOW64\Mcbahlip.exe

Filesize
414KB

MD5
daa89331e5e91889a6c8ec57b6d9c5aa

SHA1
6484e0047de1eac977ee298a095a1afc2e5d5840

SHA256
2197082003799920ef2c1a9b8538b61ad1e4447c09280546df9d9ae59288682d

SHA512
2004407d2a456aea4dc8635b2024b690ae8eda724a1cdac6205e531285dca6a615a10d414633403fe36eb5cfcf2855baf5ca6e0c1605dc92b6739777995ebbd1

Download Submit
C:\Windows\SysWOW64\Mdfofakp.exe

Filesize
414KB

MD5
9f805f4307dfa4da6e5f15d6f0303a01

SHA1
c5064aeec7a6803840e57ed1437a4109d2a667f1

SHA256
f4302697460f71d164bbf09f7183340ba8fd655d9aef6ff7532f7e1aba436297

SHA512
f858317f5e5d12d5bac65752ee79f8491dd127b28ecb1e4a133d15c657a10beb43e86ec6051c8c7d7a0401b1640d7015ecf72d64a5d245176d52bd3cba8c25f0

Download Submit
C:\Windows\SysWOW64\Mglack32.exe

Filesize
414KB

MD5
4f428c95b7c58b02e9fac88935d8a141

SHA1
cacaeffd285b366ececf49263e031f921c81a12d

SHA256
de0073a0d6545e36334b4bffc80f7247f0d122c16756d6ee6a6b51cf6fc6f972

SHA512
db4886dbe1d597449a025d387eda506f5337ccaa2966ca85695602857a367aa9cba8245e84c33eac04b26843b37d634f5861d658fe51d57c8e76eb7a594668be

Download Submit
C:\Windows\SysWOW64\Mjeddggd.exe

Filesize
414KB

MD5
1893fee33dc81a7968eb5f1308a2088d

SHA1
755ddc529141216c5563fed214f52e261e0b89f4

SHA256
e994662693e8ae4f6ebeea5a53bc58568c09e0558bcbe07d2823645cc17e6262

SHA512
30a43bd0a76d67f15444edd029279a221b7e72255af718b440ee9077ffa520ee59952118f7a17af16ded258e53be6b737fceb301e515d6cea76ef5de86762a6d

Download Submit
C:\Windows\SysWOW64\Mjhqjg32.exe

Filesize
414KB

MD5
94013a291813945fc6f8ee34a0762707

SHA1
0d0386bf86ee4a04629439eb5f43b03530674084

SHA256
366416120a57a949084948be0d4128aee6b08cc58a980a23f8e36c1c741e039a

SHA512
bd2d98373f962ea1b13aa80dd37766d6a0cca0c6e0ba275787c86574dccbbbec0025be1724a0fd52089a4e579beb35bd7fe52ba56e6f5142da2f79bf936f4f2f

Download Submit
C:\Windows\SysWOW64\Mnlfigcc.exe

Filesize
414KB

MD5
dfc1fcd017dfafd33c8b4fd3fbe8f3d9

SHA1
51a5058bee7f86d5be23843fbc6dc55594536eb6

SHA256
308162c931e8f086932e436c1624f2b64c18af5e2dd66d884008ba59247734d7

SHA512
c6486b8b10cce9eff39c0faef2ef05f111fc12839fe025c6df6ad311789d81cb41cfe1bd8da5ed7a8574f79ab02e0b5aa45c6d346db95f39d46b05d2f78472e1

Download Submit
C:\Windows\SysWOW64\Mplhql32.exe

Filesize
414KB

MD5
26cc05038d327fe15d933e4f339d1d0a

SHA1
f4a8b4e6ead1cf84fed05644514b709ea3961fd1

SHA256
678cb62372175bb7b09aa4caec32857d9244c7b821ec896b6109aad440fac097

SHA512
2c037e0e20aa131be67bc9d312ec5d47f4cfc6b40ec0427cb4d6ed10593b416d3e8e807341c5bdab9da8f2e531b3594c1d5302f4b8f927d993568efd910beae7

Download Submit
C:\Windows\SysWOW64\Nacbfdao.exe

Filesize
414KB

MD5
9fa60bfb420e0f8d7cec23675ba7f4f0

SHA1
a5c0fa1e0d99d32212e0727af96ce0fb04439f93

SHA256
6dc30d573a10fa5bfe0877f655eb1309aa986492320b58724167c540f836492f

SHA512
d32e5b30423e6a1b6b1244aba1aa9a4b21204a4218358aa3799705cb139ee3a481258ba4b9ba85aac1ec3679b03f415849f5d5c33fb2ddc22c88f89601d709c4

Download Submit
C:\Windows\SysWOW64\Nbkhfc32.exe

Filesize
414KB

MD5
ff4a1e3cdbdd28de8df2c7080b9e4ceb

SHA1
4a53b0360d07393a5f762ccd90ff0255aa6d8d79

SHA256
7682478cd61fefe9e93a797891f7cf501421df57488098a38dbab968ee137b49

SHA512
bc315c7f486b0d6c705d9062ff91d4a6053384e12137a3b5ec9f43d61e79b683c41c3fe5b1b12d331ef5e61d56101944eab893af19149c8cc86d1436280d0a52

Download Submit
C:\Windows\SysWOW64\Ncgkcl32.exe

Filesize
414KB

MD5
8138486a74fa655faf043092d434665f

SHA1
214b52fe4cde6021ab6595f9b46936040bb216ee

SHA256
20b75a0b30c42a8ddb77d10f95bfa757dfce90b9db642022d41570b9a18398cb

SHA512
5ef710d8488a5ba20ff110d84c3210c726f472eaf782982f6c9d0e03a263d03be39d6e0007c7c54a9319bf6d4018b7a9b273f0b6f3a5f5fdb8d470ad1f1921af

Download Submit
C:\Windows\SysWOW64\Ncihikcg.exe

Filesize
414KB

MD5
53e63926cf36a9107ba07d3be962abf9

SHA1
13f32d58f91b2939f36a31089fc0fe900a60a715

SHA256
e1f6ec9ccc95351d5b2054c6348896c8635b6550aaaf305db44a751217f15ac9

SHA512
8e47462efaaedf5927b52ca10d394f293e874683471c36c9b04925a46fd0405f66ffa56b2ff6a616c9f582504f16c9cc1b2b896d85f8244e4593a279dc7ff643

Download Submit
C:\Windows\SysWOW64\Nckndeni.exe

Filesize
414KB

MD5
e9560df4c430811fd60aeee872bf3587

SHA1
129386030caa43564359487b01a3b9a24c23b07e

SHA256
35cfed2dad08f1c78afdb2ab5687ac21feffe4bb1d0e7556fb296b1fa6ef10b7

SHA512
b47759e46d5458922384b187340b4c6b8367f6e752166dcedb0081457044a66bc98e056989c0fe4d291aad04569a884110d33e74b56e685870f6664b866d59e9

Download Submit
C:\Windows\SysWOW64\Ncldnkae.exe

Filesize
414KB

MD5
8549b23ea26375fe3673349e62c8b1c2

SHA1
0b81c2a0276707e9c607b8abffea234a30ac4cc9

SHA256
e44c208c5509d1611bffd685a090e62fc99452ef839ca6a366c6892cc7fd7bd9

SHA512
980e7824f1857eac66235f0b37b54abb5d0c6e10f7c9c5a572f565b81998340bf0c0da66ee44ed89fff65c0b4f2eaedc19078ad23e868fe9dabd08122716a9ed

Download Submit
C:\Windows\SysWOW64\Ndbnboqb.exe

Filesize
414KB

MD5
b21ef9a90782f23206d147f2872f8c60

SHA1
555b518ea604fae70d64d64e98a1238f3c6cae8d

SHA256
3805443ab081d4d75a5877491cf3fce1fe455a56cf329437b49a0adb59da505f

SHA512
a2154689b7afee41946f7ac8a6cceaa4e3c9197edcb067c7d57509f17c5be53e3bc8becb8c40f60111b67a732eea98e941b5da78ec3a7641aba266bca078a319

Download Submit
C:\Windows\SysWOW64\Ndcdmikd.exe

Filesize
414KB

MD5
4736c8729a4e915312a1c75eac839f17

SHA1
626410c58df3e09b926828ec168358727dec58c4

SHA256
932d0477dc5fced27453837647b789f38e99d7a0aecbee67c40ad25b890a67b8

SHA512
3d817dfec8f2b012468d40427500642d43d7b63297c9794988f917d2b9f12c3449f41c3404d3e8a7d711dbbdb1fdfee25c68da79e516408c05fbcd19faa9bdc2

Download Submit
C:\Windows\SysWOW64\Ndghmo32.exe

Filesize
414KB

MD5
f10894cddf165e1cadfd73913fefeb46

SHA1
6a2119c1624be272efe6c85d2ab35e620185747d

SHA256
7de353561b2924e74c7902d4aae03f8c9eb06b23389d7b379a33ad0b4ba721ce

SHA512
312793084fc5296243820a851ac4c6eb1ac3b9dc266a485d461f81fe59f468b0c0b23c7597a68131a4a7c800f83e4363c2ea9deae1671711bfd6ec0a25a3c46c

Download Submit
C:\Windows\SysWOW64\Ndidbn32.exe

Filesize
414KB

MD5
a16eddb9e6541c9e367dbb53fb2d4e80

SHA1
12c458c2092199416783af5e7e307ff76ac1b03f

SHA256
a05027624d8dbc8b43e336e04611f7204635ad79e7c4080c6268de661905c2b4

SHA512
0ac8073325f88c4155d015e92b3b3ccf669b8f4311e999429bc13b43e4f95f27f96315fb08fc986821692efe5e105dd31532dd38967ff622888d81db40e8d8a5

Download Submit
C:\Windows\SysWOW64\Ngmgne32.exe

Filesize
414KB

MD5
6cb4ab5f054d792f21768402f06a4cc6

SHA1
e9100b2a14a8cad5fefc7a1d9db65cad4caba290

SHA256
afb8a9b3a81184d13edcc4fcc3ac6b9cb74d927cba2af678b08be813dfe6355d

SHA512
ac9f1b0573785dae5be03cd723e67325670a20f52f9c4ab4fff6d837714deab6308aa0998e6ea8c2c18f81825a26a569ef07e9d724866502ebbdbbbb8ce37931

Download Submit
C:\Windows\SysWOW64\Ngpjnkpf.exe

Filesize
414KB

MD5
9287f99849b44ea046461f4a6452adac

SHA1
e33909ccdd2a1f0f3dc281d9a665911ce331098c

SHA256
bde92fb35fb3042a0ba5eb2b7241c085f809b786d8441c44897207d6e56a9f1f

SHA512
316d9541886d8737eea3533d38876d712100bb9fdb8f2ada69fe8fe34272ae2777cd56d07fcd167e0ba6cecd81d75693c6494485ba76665afb65ab0fbabfd209

Download Submit
C:\Windows\SysWOW64\Njacpf32.exe

Filesize
414KB

MD5
6a1010e4b7f8f497755538fef6c19360

SHA1
1490cb0e7a50143301ba96271263205636fb3361

SHA256
e287b67dd84aa7078cf0b95edbeefe8cd5741e29b178aa710a05dbd63ad97df8

SHA512
421617478f0c4c6168387aea0f4534c5b08029890bbfc40d929794d912a08f2cda7abd3494ee8fd36f9ade7e49c1522da5f3fb889564faef05685747e9df0fd4

Download Submit
C:\Windows\SysWOW64\Njcpee32.exe

Filesize
414KB

MD5
85be4922469d9dd609e161f721eb026a

SHA1
5e68e402573c077d783c9dd03f6e19a3c5101ccf

SHA256
8dec1b73d5c346df3434bf6e85646738a954ab0cfdffdc5bd47c9a314d0bc22e

SHA512
8cd96866b4fd45aed41c2066c49317f2a639341c823b8a595e47929aaa459e9ba731eb6447418a8b65a6d915a8ef6059726fdbabc458dba398b983fa554ea18d

Download Submit
C:\Windows\SysWOW64\Njljefql.exe

Filesize
414KB

MD5
875524b0367c714446de94a7c4702fec

SHA1
7a81e58205f56540290513b0437a0d8b998f6cf1

SHA256
79df233f6d93999034154ba005a10e564e8c7b24f0c8fb9c7bbb02a02d8c524c

SHA512
6b16e1b00a32bb955002940b4458a7f4ca295afd778a1d1158215b426b81e70e1cc2530184e76c9b6336a17f291c2218647f7115f7f1f636fb3b5adee13c80a3

Download Submit
C:\Windows\SysWOW64\Nkncdifl.exe

Filesize
414KB

MD5
7bec28e16820e4a13cbdadb093c6c269

SHA1
a474bc452018e11c51280d27243b22a4828c88a5

SHA256
db46042d7b7161a43871e68a938e2298c07b80da5fc77ae961618231317a07f8

SHA512
83aa9410aba0ad1c61d26e6a38a0e7e58ae0a6ef403c3dbdebe0a09d5550a23abfa467e838e7b99284a96848fb638407e74520befb0e868759f5342b430cf13c

Download Submit
C:\Windows\SysWOW64\Nkqpjidj.exe

Filesize
414KB

MD5
eac1ef5d6387003a994f754862fd7fde

SHA1
1a9067ddae04a252a526eb300a6ecd0e68c910c2

SHA256
200bffdd18ef01bc8feb3b8461b0c02e79ec61554f61e82dbeb08c5850dab347

SHA512
8e9c60ea0740d9eaca80919e1884a5e378084f217386480a3e1ebf42c883e162296f18fcd9c96ab7e5b01b3b84d677cd8c5923f4612183d5be1a731c832d9c30

Download Submit
C:\Windows\SysWOW64\Nngokoej.exe

Filesize
414KB

MD5
9a8934196668c7bca6a516c661e13f2d

SHA1
474d0bf545a6e03a630b8e593c5aa44e71d58c64

SHA256
588b403b4dd413809725bacd9c9bf327631e97885da93ee4e13cd3bf1997ad96

SHA512
bd605500c916e1d809b9aff359ab49ea14e60c6b439425ab77eedc4da566bad06bd25ca8f1d0888259c8733a8f04463fb06daa16e3eb2115cb67d1db9ea61a8b

Download Submit
C:\Windows\SysWOW64\Nnjbke32.exe

Filesize
414KB

MD5
5b297bf749745bfd193fdee857572b56

SHA1
05cd2dc03be776eeb273a101fcb6316b31160f9a

SHA256
550f5cc8846ab4cf2dca8451fbd61793e9cba7c7a8d2ec6909bced244406a7d2

SHA512
d712e917c64eedc4bf4dedab86ea7b19bf7e7658e9e5df1e918c4e5f877007b101bb830a86b0665cf4d541fcf1e93dfe667276d1cfdf1bdca2425c6534741c9c

Download Submit
C:\Windows\SysWOW64\Nnmopdep.exe

Filesize
414KB

MD5
38edc0da5fde73ee5bcfa753c9e4927a

SHA1
00a951e0aa5c0292e0847ac56641a8ce1346a8d0

SHA256
fb347bc371a85479d7e461dc46efcdca3a2c20ba2bde695ad097f94214aada14

SHA512
2e6324c91f586fe9ab443a1f40596c4614f46547c1013d46a02c0c6051654110dada906c7dec5b9d695bcee9e48c141e4f8f58d6cb4b072b4d925950c89da382

Download Submit
C:\Windows\SysWOW64\Nqiogp32.exe

Filesize
414KB

MD5
6d45ace4b71c573e849276ab517460e9

SHA1
5a52a80d96d69c628bb9489cd773eb9851b98b9d

SHA256
d472b11c737fa7489eb3e949f14016913f0444a9bd5fcdf4dadd65904bf1093f

SHA512
8a54683226edf97a7e0ac549ec691ef9b4099f30bd9b1c90c20d80f87a39f32714f44dd8164dac928a091e3eaa1bfed32c0f07e822463670213b46fec9b754ff

Download Submit
C:\Windows\SysWOW64\Nqklmpdd.exe

Filesize
414KB

MD5
2869feb65b2003cc0fa9e100442928e0

SHA1
0ec92257da0cfe91ac157779edc5f89d2b44dca6

SHA256
25ed2eb21a785e56619250e0d80cf21a04270a58b86a291b950600893c88881f

SHA512
bd214f523ffeadb83dd0def5fd5f221d623356a3231255d3417e4cbdc183510377251958dc0f9431362eb587dede109ffb978f875d3d0d205b91e540fa524605

Download Submit
C:\Windows\SysWOW64\Nqmhbpba.exe

Filesize
414KB

MD5
c1aa999d22693eef349db97ffd1d6b8d

SHA1
bca5ca35ae86ca212bd5a7ac7108b51a56844627

SHA256
76f77bcdcfc2395eb012a699fd11d82c00d422abcf961952a98c701bcd648b04

SHA512
ccdb060a5347deb7f7dd4fd5c7939f7f2037aaef7fd8bf87f7a8303cb925af5373535bcafb6f7db75d9739fe328bf7111ae13c69d1f190fb46eeff1fa5289045

Download Submit
C:\Windows\SysWOW64\Oqhacgdh.exe

Filesize
414KB

MD5
af319dcda87ac70faf484be65aefc34b

SHA1
564d271cb28892420ca94c480ff3941fe74a600f

SHA256
6b587d98a7e2a3c84f96c33c2833681534ab0b5f8502c4d75f42d3d77a5d2657

SHA512
fc2bf780dd0647c6b37dec938462267374beaf6a94979bb092e2398631467a14e8e128825da8146e3293aec14272befd3b8869b11591c25ce4c7411d5df1e065

Download Submit
memory/60-494-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/384-125-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/396-491-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/424-600-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/536-140-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/640-572-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/672-482-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/816-72-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/884-591-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/888-573-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1100-511-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1184-595-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1616-599-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1628-496-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1648-481-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1672-477-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1692-614-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1744-103-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1800-48-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1808-574-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/1952-488-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2032-590-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2116-88-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2316-487-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2340-479-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2360-485-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2544-40-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2632-509-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2636-500-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2640-615-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2656-581-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2704-596-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2728-582-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2756-79-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2828-490-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2868-586-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2924-8-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2960-24-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3156-585-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3176-492-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3196-497-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3232-576-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3248-589-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3276-601-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3336-493-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3388-583-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3484-117-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3500-575-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3540-489-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3592-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3724-597-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3776-593-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3780-603-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3844-505-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3876-588-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3896-95-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3908-480-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4060-483-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4152-507-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4228-486-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4280-16-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4316-598-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4440-503-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4464-501-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4468-499-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4472-502-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4492-587-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4536-504-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4548-584-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4628-510-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4776-508-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4840-133-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4856-498-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4904-604-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4948-592-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4992-495-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5000-594-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5012-506-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5040-605-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5044-56-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5056-64-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5064-32-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5088-606-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5104-484-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5116-478-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5132-607-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5164-608-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5200-609-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5240-610-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5284-611-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5316-612-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5352-613-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5444-616-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5616-626-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5660-628-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/5700-634-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads