4a01b1e7e13981bcefcb6629e635359ffbe814663155229b0bd308de204322d5

Analysis

max time kernel
125s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20/06/2024, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4a01b1e7e13981bcefcb6629e635359ffbe814663155229b0bd308de204322d5_NeikiAnalytics.exe
Size

80KB
MD5

83181465501517d31692852a07712560
SHA1

cf429f84ccda9145a998c3d3c50d09ba1a780145
SHA256

4a01b1e7e13981bcefcb6629e635359ffbe814663155229b0bd308de204322d5
SHA512

42cf89f18ca43bb358914aa4e23692a4b9f32131ac9e87641bf204dce77f1868b625d842e67e991aaeb60f4b96a0a56785679843a2839e986c0cd9fffc65dea5
SSDEEP

1536:uWgo97cnsRji/wdUqii22LbS5DUHRbPa9b6i+sIk:uWgIceiYPzbbS5DSCopsIk

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngjkfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phajna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhmbqm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndflak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkbjjbda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdmkhgho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efblbbqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljqhkckn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Koaagkcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nglhld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfcabp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmgjia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glgcbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gimqajgh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jilfifme.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnlkedai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdhkcb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chnlgjlb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhclmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnjqmpgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Monjjgkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oeehkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oacoqnci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnkbcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bebjdgmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cleegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjpfjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omgcpokp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebdcld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgeakekd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnbnhedj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pefabkej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adndoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eejeiocj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcpcdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnmmboed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnafno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Offnhpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pddhbipj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkegpb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fngcmcfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fngcmcfe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqkqhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adhdjpjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljceqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqpcjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odjeljhd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dokgdkeh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnqfcbnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlbcnd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljnlecmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgbld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olanmgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qoelkp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckmonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilnbicff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgmjmjnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogjdmbil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmnbfhal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aekddhcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnahdi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckhecmcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dodjjimm.exe

Executes dropped EXE 64 IoCs

pid	Process
3068	Mjokgg32.exe
1632	Mnkggfkb.exe
1048	Mgclpkac.exe
1396	Mjahlgpf.exe
3016	Mmpdhboj.exe
536	Malpia32.exe
1652	Mcjmel32.exe
4456	Mkadfj32.exe
436	Mjdebfnd.exe
1888	Mmbanbmg.exe
4612	Manmoq32.exe
4196	Nghekkmn.exe
1440	Njfagf32.exe
4392	Nnbnhedj.exe
1460	Napjdpcn.exe
920	Ncofplba.exe
2372	Nlfnaicd.exe
1340	Nmgjia32.exe
3556	Nabfjpak.exe
3060	Nhmofj32.exe
3568	Nlhkgi32.exe
696	Nnfgcd32.exe
3036	Naecop32.exe
2736	Neqopnhb.exe
4688	Nhokljge.exe
4336	Njmhhefi.exe
3784	Nagpeo32.exe
1216	Ndflak32.exe
3392	Nhahaiec.exe
4760	Njpdnedf.exe
4296	Nmnqjp32.exe
3408	Oeehkn32.exe
1564	Ohcegi32.exe
968	Ojbacd32.exe
2404	Omqmop32.exe
3680	Oeheqm32.exe
3632	Odjeljhd.exe
892	Olanmgig.exe
4916	Ojdnid32.exe
1504	Omcjep32.exe
3648	Oejbfmpg.exe
4412	Odmbaj32.exe
4352	Oldjcg32.exe
4860	Oobfob32.exe
4108	Oaqbkn32.exe
3492	Ohkkhhmh.exe
1044	Ojigdcll.exe
4884	Omgcpokp.exe
3448	Oacoqnci.exe
512	Odalmibl.exe
3536	Olicnfco.exe
3652	Oogpjbbb.exe
224	Paelfmaf.exe
1176	Pddhbipj.exe
3444	Poimpapp.exe
2780	Pahilmoc.exe
1548	Pdfehh32.exe
4792	Plmmif32.exe
2480	Pkpmdbfd.exe
400	Pmoiqneg.exe
1624	Pefabkej.exe
1664	Pdhbmh32.exe
2604	Plpjoe32.exe
1520	Pkbjjbda.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Blielbfi.exe	Bdbnjdfg.exe
File opened for modification	C:\Windows\SysWOW64\Njmhhefi.exe	Nhokljge.exe
File created	C:\Windows\SysWOW64\Ahgcjddh.exe	Aehgnied.exe
File created	C:\Windows\SysWOW64\Aekddhcb.exe	Anclbkbp.exe
File created	C:\Windows\SysWOW64\Dmlkhofd.exe	Chqogq32.exe
File opened for modification	C:\Windows\SysWOW64\Gejopl32.exe	Gnqfcbnj.exe
File created	C:\Windows\SysWOW64\Llgmeiqa.dll	Mgclpkac.exe
File created	C:\Windows\SysWOW64\Fkemhahj.dll	Nlhkgi32.exe
File created	C:\Windows\SysWOW64\Mhelik32.dll	Kjeiodek.exe
File created	C:\Windows\SysWOW64\Bpdnjple.exe	Baannc32.exe
File created	C:\Windows\SysWOW64\Plmmif32.exe	Pdfehh32.exe
File opened for modification	C:\Windows\SysWOW64\Aoalgn32.exe	Albpkc32.exe
File created	C:\Windows\SysWOW64\Dapgni32.dll	Adhdjpjf.exe
File created	C:\Windows\SysWOW64\Ahpmjejp.exe	Addaif32.exe
File created	C:\Windows\SysWOW64\Pjbcplpe.exe	Pffgom32.exe
File created	C:\Windows\SysWOW64\Efeihb32.exe	Ennqfenp.exe
File created	C:\Windows\SysWOW64\Ojenek32.dll	Onocomdo.exe
File opened for modification	C:\Windows\SysWOW64\Qpcecb32.exe	Qmeigg32.exe
File opened for modification	C:\Windows\SysWOW64\Qlimed32.exe	Qhmqdemc.exe
File created	C:\Windows\SysWOW64\Pjinodke.dll	Albpkc32.exe
File created	C:\Windows\SysWOW64\Mjknojbk.dll	Qoelkp32.exe
File opened for modification	C:\Windows\SysWOW64\Adikdfna.exe	Aajohjon.exe
File created	C:\Windows\SysWOW64\Bdbnjdfg.exe	Badanigc.exe
File opened for modification	C:\Windows\SysWOW64\Fnnjmbpm.exe	Fefedmil.exe
File created	C:\Windows\SysWOW64\Dnbjkgmg.dll	Jgmjmjnb.exe
File opened for modification	C:\Windows\SysWOW64\Mgphpe32.exe	Moipoh32.exe
File created	C:\Windows\SysWOW64\Nmgjia32.exe	Nlfnaicd.exe
File created	C:\Windows\SysWOW64\Nlkfjqib.dll	Njmhhefi.exe
File created	C:\Windows\SysWOW64\Jjjojj32.dll	Ngjkfd32.exe
File opened for modification	C:\Windows\SysWOW64\Chnlgjlb.exe	Cpdgqmnb.exe
File opened for modification	C:\Windows\SysWOW64\Bnfihkqm.exe	Bochmn32.exe
File opened for modification	C:\Windows\SysWOW64\Dgcihgaj.exe	Dpiplm32.exe
File opened for modification	C:\Windows\SysWOW64\Ljqhkckn.exe	Lqhdbm32.exe
File created	C:\Windows\SysWOW64\Nqbpojnp.exe	Nncccnol.exe
File created	C:\Windows\SysWOW64\Gejain32.dll	Oplfkeob.exe
File created	C:\Windows\SysWOW64\Gmiadfmi.dll	Fligqhga.exe
File opened for modification	C:\Windows\SysWOW64\Kgiiiidd.exe	Koaagkcb.exe
File opened for modification	C:\Windows\SysWOW64\Ahippdbe.exe	Adndoe32.exe
File created	C:\Windows\SysWOW64\Ecalcl32.dll	Bochmn32.exe
File opened for modification	C:\Windows\SysWOW64\Klcekpdo.exe	Kjeiodek.exe
File created	C:\Windows\SysWOW64\Ohcegi32.exe	Oeehkn32.exe
File created	C:\Windows\SysWOW64\Khliclno.dll	Pkegpb32.exe
File created	C:\Windows\SysWOW64\Cofnik32.exe	Clgbmp32.exe
File created	C:\Windows\SysWOW64\Jcfggkac.exe	Jinboekc.exe
File created	C:\Windows\SysWOW64\Pmaffnce.exe	Pkbjjbda.exe
File opened for modification	C:\Windows\SysWOW64\Bdbnjdfg.exe	Badanigc.exe
File created	C:\Windows\SysWOW64\Njmhhefi.exe	Nhokljge.exe
File created	C:\Windows\SysWOW64\Dpkmal32.exe	Dojqjdbl.exe
File created	C:\Windows\SysWOW64\Figfoijn.dll	Mjaabq32.exe
File opened for modification	C:\Windows\SysWOW64\Nclbpf32.exe	Nqmfdj32.exe
File created	C:\Windows\SysWOW64\Agdcpkll.exe	Aoioli32.exe
File created	C:\Windows\SysWOW64\Ahfmpnql.exe	Apodoq32.exe
File opened for modification	C:\Windows\SysWOW64\Ipoheakj.exe	Impliekg.exe
File created	C:\Windows\SysWOW64\Lqkqhm32.exe	Ljqhkckn.exe
File created	C:\Windows\SysWOW64\Bebjdgmj.exe	Bnkbcj32.exe
File opened for modification	C:\Windows\SysWOW64\Dfdpad32.exe	Dnmhpg32.exe
File opened for modification	C:\Windows\SysWOW64\Jilfifme.exe	Jgmjmjnb.exe
File created	C:\Windows\SysWOW64\Phonha32.exe	Pccahbmn.exe
File created	C:\Windows\SysWOW64\Pfiddm32.exe	Pdjgha32.exe
File opened for modification	C:\Windows\SysWOW64\Oobfob32.exe	Oldjcg32.exe
File created	C:\Windows\SysWOW64\Palbgl32.exe	Pmaffnce.exe
File opened for modification	C:\Windows\SysWOW64\Mqimikfj.exe	Mnjqmpgg.exe
File created	C:\Windows\SysWOW64\Dojqjdbl.exe	Dgcihgaj.exe
File created	C:\Windows\SysWOW64\Fligqhga.exe	Fijkdmhn.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6064	9444	WerFault.exe	454

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bohbhmfm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amdomd32.dll"	Cbfgkffn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fihnomjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Offnhpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Miongake.dll"	Ndflak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbopphio.dll"	Phfjcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obgbikfp.dll"	Bedgjgkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndoell32.dll"	Geohklaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gefklj32.dll"	Hpnoncim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bohgljdl.dll"	Klfaapbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebnfbcbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgpcliao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emihhjna.dll"	Ojbacd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ginacp32.dll"	Akccap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnegbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obqhpfck.dll"	Mgeakekd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnafno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnifekmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nabfjpak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqknpl32.dll"	Hfcnpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gelfeh32.dll"	Dpiplm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmhlgmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anaomkdb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fnipbc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jilfifme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnjqmpgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaakdpkj.dll"	Olanmgig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpfgmnfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgbefe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pccahbmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Godcje32.dll"	Qpcecb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmiikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfbiemdb.dll"	Njpdnedf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bebjdgmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odjjif32.dll"	Bhpfqcln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbkqfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hebqnm32.dll"	Ibcaknbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcfggkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdfehh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aehgnied.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aekddhcb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klcekpdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lqkqhm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agdcpkll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohkkhhmh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmkmjjaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ioolkncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dapgni32.dll"	Adhdjpjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohcegi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ankkea32.dll"	Efeihb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhmofj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cpbjkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjdebfnd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojbacd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdabnm32.dll"	Odjeljhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klplbbaq.dll"	Oaqbkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oaqbkn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bheplb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pahilmoc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnfihkqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Blielbfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pplobcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Paeelgnj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 3068	3368	4a01b1e7e13981bcefcb6629e635359ffbe814663155229b0bd308de204322d5_NeikiAnalytics.exe	90
PID 3368 wrote to memory of 3068	3368	4a01b1e7e13981bcefcb6629e635359ffbe814663155229b0bd308de204322d5_NeikiAnalytics.exe	90
PID 3368 wrote to memory of 3068	3368	4a01b1e7e13981bcefcb6629e635359ffbe814663155229b0bd308de204322d5_NeikiAnalytics.exe	90
PID 3068 wrote to memory of 1632	3068	Mjokgg32.exe	91
PID 3068 wrote to memory of 1632	3068	Mjokgg32.exe	91
PID 3068 wrote to memory of 1632	3068	Mjokgg32.exe	91
PID 1632 wrote to memory of 1048	1632	Mnkggfkb.exe	92
PID 1632 wrote to memory of 1048	1632	Mnkggfkb.exe	92
PID 1632 wrote to memory of 1048	1632	Mnkggfkb.exe	92
PID 1048 wrote to memory of 1396	1048	Mgclpkac.exe	93
PID 1048 wrote to memory of 1396	1048	Mgclpkac.exe	93
PID 1048 wrote to memory of 1396	1048	Mgclpkac.exe	93
PID 1396 wrote to memory of 3016	1396	Mjahlgpf.exe	94
PID 1396 wrote to memory of 3016	1396	Mjahlgpf.exe	94
PID 1396 wrote to memory of 3016	1396	Mjahlgpf.exe	94
PID 3016 wrote to memory of 536	3016	Mmpdhboj.exe	95
PID 3016 wrote to memory of 536	3016	Mmpdhboj.exe	95
PID 3016 wrote to memory of 536	3016	Mmpdhboj.exe	95
PID 536 wrote to memory of 1652	536	Malpia32.exe	96
PID 536 wrote to memory of 1652	536	Malpia32.exe	96
PID 536 wrote to memory of 1652	536	Malpia32.exe	96
PID 1652 wrote to memory of 4456	1652	Mcjmel32.exe	97
PID 1652 wrote to memory of 4456	1652	Mcjmel32.exe	97
PID 1652 wrote to memory of 4456	1652	Mcjmel32.exe	97
PID 4456 wrote to memory of 436	4456	Mkadfj32.exe	98
PID 4456 wrote to memory of 436	4456	Mkadfj32.exe	98
PID 4456 wrote to memory of 436	4456	Mkadfj32.exe	98
PID 436 wrote to memory of 1888	436	Mjdebfnd.exe	99
PID 436 wrote to memory of 1888	436	Mjdebfnd.exe	99
PID 436 wrote to memory of 1888	436	Mjdebfnd.exe	99
PID 1888 wrote to memory of 4612	1888	Mmbanbmg.exe	100
PID 1888 wrote to memory of 4612	1888	Mmbanbmg.exe	100
PID 1888 wrote to memory of 4612	1888	Mmbanbmg.exe	100
PID 4612 wrote to memory of 4196	4612	Manmoq32.exe	101
PID 4612 wrote to memory of 4196	4612	Manmoq32.exe	101
PID 4612 wrote to memory of 4196	4612	Manmoq32.exe	101
PID 4196 wrote to memory of 1440	4196	Nghekkmn.exe	102
PID 4196 wrote to memory of 1440	4196	Nghekkmn.exe	102
PID 4196 wrote to memory of 1440	4196	Nghekkmn.exe	102
PID 1440 wrote to memory of 4392	1440	Njfagf32.exe	104
PID 1440 wrote to memory of 4392	1440	Njfagf32.exe	104
PID 1440 wrote to memory of 4392	1440	Njfagf32.exe	104
PID 4392 wrote to memory of 1460	4392	Nnbnhedj.exe	105
PID 4392 wrote to memory of 1460	4392	Nnbnhedj.exe	105
PID 4392 wrote to memory of 1460	4392	Nnbnhedj.exe	105
PID 1460 wrote to memory of 920	1460	Napjdpcn.exe	106
PID 1460 wrote to memory of 920	1460	Napjdpcn.exe	106
PID 1460 wrote to memory of 920	1460	Napjdpcn.exe	106
PID 920 wrote to memory of 2372	920	Ncofplba.exe	108
PID 920 wrote to memory of 2372	920	Ncofplba.exe	108
PID 920 wrote to memory of 2372	920	Ncofplba.exe	108
PID 2372 wrote to memory of 1340	2372	Nlfnaicd.exe	109
PID 2372 wrote to memory of 1340	2372	Nlfnaicd.exe	109
PID 2372 wrote to memory of 1340	2372	Nlfnaicd.exe	109
PID 1340 wrote to memory of 3556	1340	Nmgjia32.exe	111
PID 1340 wrote to memory of 3556	1340	Nmgjia32.exe	111
PID 1340 wrote to memory of 3556	1340	Nmgjia32.exe	111
PID 3556 wrote to memory of 3060	3556	Nabfjpak.exe	112
PID 3556 wrote to memory of 3060	3556	Nabfjpak.exe	112
PID 3556 wrote to memory of 3060	3556	Nabfjpak.exe	112
PID 3060 wrote to memory of 3568	3060	Nhmofj32.exe	113
PID 3060 wrote to memory of 3568	3060	Nhmofj32.exe	113
PID 3060 wrote to memory of 3568	3060	Nhmofj32.exe	113
PID 3568 wrote to memory of 696	3568	Nlhkgi32.exe	114

C:\Users\Admin\AppData\Local\Temp\4a01b1e7e13981bcefcb6629e635359ffbe814663155229b0bd308de204322d5_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4a01b1e7e13981bcefcb6629e635359ffbe814663155229b0bd308de204322d5_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\Mjokgg32.exe
  C:\Windows\system32\Mjokgg32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\Mnkggfkb.exe
    C:\Windows\system32\Mnkggfkb.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1632
  - - C:\Windows\SysWOW64\Mgclpkac.exe
      C:\Windows\system32\Mgclpkac.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1048
    - - C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1396
      - C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3016
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4456
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:436
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1888
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2372
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3556
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3060
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3568
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        23⤵
        Executes dropped EXE
        
        PID:696
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        24⤵
        Executes dropped EXE
        
        PID:3036
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        25⤵
        Executes dropped EXE
        
        PID:2736
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4688
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4336
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        28⤵
        Executes dropped EXE
        
        PID:3784
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1216
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        30⤵
        Executes dropped EXE
        
        PID:3392
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4760
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        32⤵
        Executes dropped EXE
        
        PID:4296
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3408
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1564
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:968
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        36⤵
        Executes dropped EXE
        
        PID:2404
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        37⤵
        Executes dropped EXE
        
        PID:3680
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3632
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:892
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        40⤵
        Executes dropped EXE
        
        PID:4916
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        41⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        42⤵
        Executes dropped EXE
        
        PID:3648
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        43⤵
        Executes dropped EXE
        
        PID:4412
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4352
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        45⤵
        Executes dropped EXE
        
        PID:4860
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4108
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3492
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        48⤵
        Executes dropped EXE
        
        PID:1044
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4884
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3448
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        51⤵
        Executes dropped EXE
        
        PID:512
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        52⤵
        Executes dropped EXE
        
        PID:3536
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        53⤵
        Executes dropped EXE
        
        PID:3652
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        54⤵
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1176
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        56⤵
        Executes dropped EXE
        
        PID:3444
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2780
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1548
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        59⤵
        Executes dropped EXE
        
        PID:4792
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        60⤵
        Executes dropped EXE
        
        PID:2480
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        61⤵
        Executes dropped EXE
        
        PID:400
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1624
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        63⤵
        Executes dropped EXE
        
        PID:1664
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        64⤵
        Executes dropped EXE
        
        PID:2604
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1520
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        66⤵
        Drops file in System32 directory
        
        PID:5136
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        67⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        68⤵
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5260
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        70⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        71⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        73⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        74⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        75⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        76⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        77⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5624
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        79⤵
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        80⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        81⤵
        Drops file in System32 directory
        
        PID:5740
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        82⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        83⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        84⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        85⤵
        Drops file in System32 directory
        
        PID:5912
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        86⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        87⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        88⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        89⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        90⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        91⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        92⤵
        Drops file in System32 directory
        
        PID:5268
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        93⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        94⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        95⤵
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        96⤵
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        97⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        98⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        99⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        100⤵
        Drops file in System32 directory
        
        PID:5860
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        101⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        102⤵
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5200
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        105⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        106⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        107⤵
        Drops file in System32 directory
        
        PID:5496
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        108⤵
        Modifies registry class
        
        PID:5592
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        109⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        110⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        111⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        112⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        113⤵
        Drops file in System32 directory
        
        PID:2620
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        114⤵
        Drops file in System32 directory
        
        PID:1724
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        115⤵
        Modifies registry class
        
        PID:6028
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        116⤵
        Modifies registry class
        
        PID:5668
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5884
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        119⤵
        Modifies registry class
        
        PID:5332
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        120⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        121⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        122⤵
        Modifies registry class
        
        PID:5856
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        123⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        124⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        125⤵
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5148
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        127⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        128⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        129⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6232
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6284
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        132⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        133⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        134⤵
        Drops file in System32 directory
        
        PID:6464
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        135⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        136⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        137⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        138⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6732
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        140⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        141⤵
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        142⤵
        Drops file in System32 directory
        
        PID:6892
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        143⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6984
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        145⤵
        Drops file in System32 directory
        
        PID:7024
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        146⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7124
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        148⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        149⤵
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        150⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        151⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        152⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        153⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        154⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        155⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        156⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        157⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6980
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        159⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        160⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6172
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        162⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6448
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        164⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        165⤵
        Drops file in System32 directory
        
        PID:6716
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        166⤵
        Modifies registry class
        
        PID:6840
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        167⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        168⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        169⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6480
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        171⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        172⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        173⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        174⤵
        Modifies registry class
        
        PID:6532
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        175⤵
        Modifies registry class
        
        PID:7008
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        176⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        177⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        178⤵
        Drops file in System32 directory
        
        PID:6880
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        179⤵
        Drops file in System32 directory
        
        PID:7104
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7212
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        181⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        182⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        183⤵
        Modifies registry class
        
        PID:7324
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        184⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        185⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        186⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        187⤵
        Drops file in System32 directory
        
        PID:7508
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        188⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        189⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        190⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7672
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        192⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        193⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        194⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        195⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7876
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        197⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        198⤵
        Modifies registry class
        
        PID:7964
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        199⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8052
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        201⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        202⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        203⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        204⤵
        Modifies registry class
        
        PID:1012
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        205⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        206⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        207⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7416
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        209⤵
        Modifies registry class
        
        PID:7532
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        210⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        211⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        212⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        213⤵
        Modifies registry class
        
        PID:7836
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        214⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        215⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8012
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        217⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        218⤵
        Modifies registry class
        
        PID:8176
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        219⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        220⤵
        Drops file in System32 directory
        
        PID:7248
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        221⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        222⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        223⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7744
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7816
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        226⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        227⤵
        Drops file in System32 directory
        
        PID:8044
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        228⤵
        Modifies registry class
        
        PID:8160
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7196
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        230⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        231⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        232⤵
        Drops file in System32 directory
        
        PID:7808
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        233⤵
        Modifies registry class
        
        PID:7956
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8128
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        235⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        236⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        237⤵
        Modifies registry class
        
        PID:7900
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        238⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        239⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        240⤵
        Modifies registry class
        
        PID:8100
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        241⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7576
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        243⤵
        Drops file in System32 directory
        
        PID:7496
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8200
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8244
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8284
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        247⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        248⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8420
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        250⤵
        Modifies registry class
        
        PID:8460
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        251⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        252⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        253⤵
        Drops file in System32 directory
        
        PID:8600
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        254⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        255⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8772
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        257⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        258⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        259⤵
        Modifies registry class
        
        PID:8960
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        260⤵
        Drops file in System32 directory
        
        PID:8996
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9040
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9076
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9144
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        264⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        265⤵
        Drops file in System32 directory
        
        PID:8080
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        266⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        267⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        268⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8476
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8560
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        271⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8760
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        273⤵
        Drops file in System32 directory
        
        PID:8824
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        274⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9024
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        276⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        277⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        278⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        279⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        280⤵
        Modifies registry class
        
        PID:8416
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        281⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8704
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        283⤵
        Drops file in System32 directory
        
        PID:8820
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8940
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9088
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        286⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        287⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        288⤵
        Drops file in System32 directory
        
        PID:8536
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        289⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8908
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        291⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        292⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        293⤵
        Modifies registry class
        
        PID:8656
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        294⤵
        Modifies registry class
        
        PID:8988
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        295⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8316
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        296⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        297⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        298⤵
        Modifies registry class
        
        PID:9140
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        299⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        300⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        301⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9344
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9388
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9428
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        305⤵
        Modifies registry class
        
        PID:9492
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9540
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        307⤵
        Drops file in System32 directory
        
        PID:9576
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        308⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        309⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        310⤵
        Drops file in System32 directory
        
        PID:9712
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        311⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        312⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        313⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        314⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        315⤵
        Drops file in System32 directory
        
        PID:9932
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        316⤵
        Modifies registry class
        
        PID:9976
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        317⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        318⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        319⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        320⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        321⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8608
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        323⤵
        Drops file in System32 directory
        
        PID:9256
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        324⤵
        Modifies registry class
        
        PID:9332
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9416
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        326⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        327⤵
        Drops file in System32 directory
        
        PID:9560
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        328⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        329⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        330⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        331⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        332⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        333⤵
        Drops file in System32 directory
        
        PID:9992
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        334⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        335⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        336⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        337⤵
        Modifies registry class
        
        PID:8344
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        338⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        339⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9536
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        341⤵
        Modifies registry class
        
        PID:9616
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        342⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        343⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        344⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        345⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        346⤵
        Modifies registry class
        
        PID:10200
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        347⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        348⤵
        Drops file in System32 directory
        
        PID:9484
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9688
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        350⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        351⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        352⤵
        Drops file in System32 directory
        
        PID:9888
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        353⤵
        Drops file in System32 directory
        
        PID:10048
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        354⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        355⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9444 -s 400
        356⤵
        Program crash
        
        PID:6064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4152,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:8
1⤵
PID:6264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 9444 -ip 9444
1⤵
PID:6096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aamknj32.exe

Filesize
80KB

MD5
7fc6b907f1aeb1661e0d9a2372bd42cb

SHA1
8c1df81bbad422fbdeda23a6960b44051c946262

SHA256
98f6c61720d9c4e360cf49e2cc190f0e6747c905901a4d4f5781eda1ef3f5b4f

SHA512
161faeaa937cc105d294687b03178ae7c7dcb35795c8aec0f06dccc2b95f54f4a4226a6554af48a7eda5da9dd99dd7d4f805d2ee1bc2ea4366a9ee1431753d9e

Download Submit
C:\Windows\SysWOW64\Adhdjpjf.exe

Filesize
80KB

MD5
1d44d47bb823feb0135d0026f3d4c79b

SHA1
a3793f44f46b5283ec710afb920ce5f67a45361c

SHA256
25222224edec0c75a55b7dde5e26d6429b992412736d0b3ba57d01fa85fa7197

SHA512
2f938614c297b8fa230cbec1034b5e6c273abdedfbeabf1f9545ed05cf3a77e8d66d65bd44fb48446a4b5c3ce8d0ae3213f2ee02b529d11da9e184f83bfc0831

Download Submit
C:\Windows\SysWOW64\Afpjel32.exe

Filesize
80KB

MD5
492749b1cce2ee9d4d60ce0542b46b3c

SHA1
299971af95e2215a38ccd07f8b7e4f0faf4d91ca

SHA256
54fefdf720e22ab8a392eae102ae95b43856319b6c25d3af83869b9ce576daef

SHA512
0b4b3dd5a7f5b75264aa41b58adcd8aebe1b17ad4d4a99be3f4b4bb8abd9799524001a7cde14d2fb981ea5e8ef70401a431b371358979bea27a4ad34d8947bd9

Download Submit
C:\Windows\SysWOW64\Ahfmpnql.exe

Filesize
80KB

MD5
c81b0b947d1d76350eab62e67f5e2a6e

SHA1
b6d940ce9b625b2ac61d4b9961c1db9ee03f3bd7

SHA256
415dd2f217f2958bb31c2b6be267eef23d0372df94876a2694daf9473495b458

SHA512
16d76975831ff7231f846a2a68bbad8ab3a3010882a3eff478b33a9b15cbe8a3f1b07f009d7da6386703adb6d66ae91e07ec8dad24d9b966edef9c51dc203458

Download Submit
C:\Windows\SysWOW64\Ahgcjddh.exe

Filesize
80KB

MD5
6e5a182b81c7af036b58f26809e5bdc7

SHA1
6dfb3b58835ca72d34bf75bc058c025c31af937a

SHA256
374f33df54cbf562e0e4eb7095717d6b5515aec681ec150165be0d03d6ab6c2b

SHA512
1194ecadd3aec3f28c2781a3ba29946a6872b138d0cec5a9ac89b6a97fdc4c3efb17e41cead39ad755f04d14811f2f11abdf41fc45bce944e94072e015cd4b6c

Download Submit
C:\Windows\SysWOW64\Aogiap32.exe

Filesize
80KB

MD5
a94557efd8fb764b997d44e3d5bbe76d

SHA1
f5bbbff4adbd6263c9658144d1f80e0f364d8f8b

SHA256
6576883eb48391905b5fbea630637d74960dea88135843f2b9dfa25895e57684

SHA512
3e846489e2f6dd4e187484711614854468f8ecf5906e5f18e12152bb6b0dd6edfdef91ec869b3a4e586eb756d8ba7ca3b59fc95bbd014af2e0c90ee304dfc4cc

Download Submit
C:\Windows\SysWOW64\Bddcenpi.exe

Filesize
80KB

MD5
1c03b701587aa472bd6f2ffa5a9316df

SHA1
80c9a85cdbd62b27adc40c68400efc0a7b9baf99

SHA256
877685dd778ee240cee882024595e489a7c5a003a6c9090ce4db8bdf14fd8a52

SHA512
5a9fbce0729f70247e20bd639b9fefbf8a9371edca70b2d1fadb119d04f866a5a189f7cbc90f21b06c2fafe1fc4c158f564c93ae88f3cf781f0c3e4e3fa57de6

Download Submit
C:\Windows\SysWOW64\Bheplb32.exe

Filesize
80KB

MD5
7f9540a8b7e285eed941354ea04d8c64

SHA1
fe3c8608eb0660448b8e40e21c52d6e50c02c609

SHA256
cd0b633998f855efcdf8f3a1e647d55040a707bc9282eecc2cd40a98dae6cf33

SHA512
6554120c97cecac1ff9c121d552ac134e2f05f1cd99f0cf759e87659b559c6dee802108c22fcc0fdce9df7cba19a919666f8173bf32aa4560421ae91288fcd6c

Download Submit
C:\Windows\SysWOW64\Chnlgjlb.exe

Filesize
80KB

MD5
4f2e7af22d32bad0979bb29c1a1ef164

SHA1
07db197a1c05de53a7565dfe0cdc190c09bf497c

SHA256
d8bc4387b2d29770e60504f21eb7505b22633709333d08f60dd76f6523ab9f45

SHA512
4d86624471af952205a33bd2b64bbb2b4091fa475b3b71367fe247d2e1a642cb6fc3a7e769d2f36ca8044f204191d2d5c1af4d6ab3de70c1db7f336f680f2541

Download Submit
C:\Windows\SysWOW64\Ckebcg32.exe

Filesize
80KB

MD5
34eb5fabfc9f0abae1ebd334617966a0

SHA1
b6c9f4c2d0cc5a90bb15caac7a1546c7e918ef91

SHA256
87b8d0e862d0acbe70301aa0552ed4cd69a0a16a1b143a0126660afd63d671fa

SHA512
4d189d0139f4ec932b7bbb04bcb0d6177ed2ba7f6c833e1efb9a3b0e3f715b6515df341900f8cf4a18a139964ae66a0c78cd89106209f3049d7fa947eeefa40b

Download Submit
C:\Windows\SysWOW64\Dbnmke32.exe

Filesize
80KB

MD5
5b5abc1e1ceaface6c7900e492a3d178

SHA1
d08e8853e73500d9c4c1b892a74821e2c373b16a

SHA256
2c09175ad85bfba5535bb2495b9dea4dea78bed5b4e6bc1dac9d26a44d62b947

SHA512
dfbcc2aabb86c600fc915f09c1af5515fd2bb2f221240e977d9b57f2568856eb61d11a1e10a1e6840e571923873cad2696c8d0abebedf81c41995a2aa1ef4bd0

Download Submit
C:\Windows\SysWOW64\Dkqaoe32.exe

Filesize
80KB

MD5
74c032d17b84f07fafdf0a700a844f97

SHA1
a1cd87269f1f22e8a3e8c6fac9e5f0e43e329134

SHA256
ecc5ac5855cbec6998a8fe1153945080db424cdf36aabb4e59906afb5e6cb83d

SHA512
025813e45328fd3af20bf0084aa9e2934922fa96663c74190427931916ab1b391019613fe58f96d3ce587674f9899d714ac88837ec703917e46c5aa81b5747c7

Download Submit
C:\Windows\SysWOW64\Dojqjdbl.exe

Filesize
80KB

MD5
625b912baa993162d95f1a20a97473fa

SHA1
00556d68015484f5606486bdb252a2367a92f49c

SHA256
4bfa289968f2f999efdf5c18f37cfa978397ffab9533c1f324971c0300eebcba

SHA512
8ec8a2a056d8ce4075f3f12fb02125b11005bf768369c980b8f802746ed8691882dc8b74973a827ad02271b2b4cb2cc3d25a6f88fea679868043295a4a52a8cd

Download Submit
C:\Windows\SysWOW64\Ebdcld32.exe

Filesize
80KB

MD5
75fd30b745991eb3019a50d6408443ab

SHA1
7aaae91bfb491d1c523d421419e1cbc3e8245f5d

SHA256
5c57ffe10e9c5dbb91ed9ead1997bd291ee66237c1087088f920ced2701bb149

SHA512
0e55cb1a55771f164763be59afd5d397d9338665364b6ffb6713aeb68282b97acc13a453c54a0edbd8afa6c1d01add948ccce8bab360238bbc1af9234302be59

Download Submit
C:\Windows\SysWOW64\Fefedmil.exe

Filesize
80KB

MD5
294b047374e196cdf9f4d50c88ad2fd9

SHA1
a2d87ca715ad4b6a1a262390297735af8048f221

SHA256
e6d93ec9f0ab912dbdcfe35d1f7df0078613fd2b0d1d400e79b5feac26d6a1e0

SHA512
bcfa7e773ba6a6e5302259f002add9c38c70552dd83b5f9cc6493517ef77723f2e89e868703652e32622763e2fc1c201c3046a755112a0e459c540d3732aa91f

Download Submit
C:\Windows\SysWOW64\Ffnknafg.exe

Filesize
80KB

MD5
65a55fc80fd0e545b2077f72183a4024

SHA1
b11e47c41658ee65b7015784c3f3f917271bc2fb

SHA256
ac06dcba994dd508b87b1959b523a0e6f4d2646de94fb33237ede2ab750b14da

SHA512
efdb6d6e0df180500d3611bc61c653436e405930eb3ee1ddf7a7ef74933c45b8a6762e3e1544f82914a1eaafe8de734dbfc542d55ef008d8d35d3fb4aaf71123

Download Submit
C:\Windows\SysWOW64\Ffqhcq32.exe

Filesize
80KB

MD5
5c6c64f60d7a9e22b64e8275ad7a35d6

SHA1
720156815b1e01953154886847dfa0b6601b4c84

SHA256
083588057eaa381d302676ad29d0249362df9476ee0cdd4eb7844671f2edbbd7

SHA512
2f19098ca680bd48188ad13beb8105c9e7a6de59a251356a53d91ef87aef746da0d7be4fb5f408ccb7347239e3f084a3b386d76cdb2c4f0d86e04f913b37eaed

Download Submit
C:\Windows\SysWOW64\Gbnoiqdq.exe

Filesize
80KB

MD5
f7ee57b11b79788bc9cb0544102e3ce2

SHA1
6c1b68e23806a6b0422d67d9f9ea987ea9003193

SHA256
508cfa1322bf055466895ee6cb3e9d356067c7924018d8221445ee73fb1928ea

SHA512
e499fc646548a41b42f9cd4c8163acc9847b20e54bf454a158148be669f3d7126e86a82a06ee483461d2a2a5ad6759d8ee6c496c5950a6e5e325fa854755db9c

Download Submit
C:\Windows\SysWOW64\Geohklaa.exe

Filesize
80KB

MD5
06be65ca9895fcbe72a113d1c0276ebc

SHA1
ee19e07376ce05c698402c7c2d33e99e089ad7fc

SHA256
6cae570308fa6b57a129879596eee7f42fba7111ab37dd57cef5ee25b7af7411

SHA512
dfe48af96a41e3349378398368c03e9ece5527397f0bd17727e904f38a07efcb765a75707c39c236b659ad4de96cd2adaaba44beafa03d53e7d46a9a455856c2

Download Submit
C:\Windows\SysWOW64\Gimqajgh.exe

Filesize
80KB

MD5
6e6d30704e3fee94b10a2dabcc6de69b

SHA1
5c3042ea634de9d0bd05410d70c498eee97f8067

SHA256
3f4bc933bde588141a6ffb1beedb0e95d2960998bcfd4517842d06406aa75ff6

SHA512
7c5c9ad80a2106a754f4c559bb139531e9c2ca4df99434bc269fc356d58aca68e880b9c9f4338ee82016018e62976befc71bdfeb5242047feccfe8c4ccdba4ae

Download Submit
C:\Windows\SysWOW64\Hfaajnfb.exe

Filesize
80KB

MD5
772df1b91a38b6a899175c7dba878be8

SHA1
ab9e3535845f033d356e93a526ab82f2e45d7470

SHA256
40dedff4491183e33a65f3576ee9cee4b6a43def3d9797a9268910830b9a7825

SHA512
3ade721fe0cc85527bfb20252ed703f81906fa69e69f7b83a68d5eb485b98507587038263928b88048b4ff5957b7d2c348bd8d5f8d67cd9a44d269f72c4d3567

Download Submit
C:\Windows\SysWOW64\Hffken32.exe

Filesize
80KB

MD5
241f3133cd41cd83e1528f1467bc915f

SHA1
7d89c4a5318995fc713c7071c9824fef2523c68c

SHA256
7fb6b85095ffa37658c13f25ca8f0ae270830f5ee002cd64933fccf39bcaa105

SHA512
8db76d6e11efd3025c8bec5b5ff47a95db307659131de24e7e09a1e8ab577ccee7e9845792e1311891b2fdf595e543f6b9577b38fba798909ec851211e469367

Download Submit
C:\Windows\SysWOW64\Hpnoncim.exe

Filesize
80KB

MD5
869f1fe56b56a803c5c05975cdfb78e2

SHA1
2e3021d1583461e494364243d4b6b1f6acf20c0f

SHA256
69cd7abfcfe11df27de3773d53c0e9b78730dc959c621b0e9c5fb82ebd9db64d

SHA512
4781389db775f67a8331ce421e937acde0ae7e8e67173800bf3886fabf7f4566294d3ccc8483be4ead552cad6c079952ad66038101c8b3216e26a8d43a1c55f4

Download Submit
C:\Windows\SysWOW64\Igajal32.exe

Filesize
80KB

MD5
69b713d19cd4e5f006f56055dc3a5e63

SHA1
c4ae07834b5960b9f8b24bec0498090cb51e40d7

SHA256
9820668f9f98a474303b2cbcdd1b3a285c213aa4e01416b07b04af12d732726e

SHA512
8ff7e65bb0bb56b6ae1c06f426b2743f84ecec4466938c6ba0dc5743caf8e36779141c1dd9c91702d840dab94dc5caccee38c2f67d0a9eb1479a2604b0165e59

Download Submit
C:\Windows\SysWOW64\Iikmbh32.exe

Filesize
80KB

MD5
741be54cabee7785b00755551097c0a9

SHA1
ecb4af144cbbcd81d0a9533a2ad7616b7bc4c448

SHA256
dbb6e71d770916bff263d3d65b191153cf43d128cf62cef217f2e29837856d76

SHA512
deece82a196012d473daf5d3315c8a271340dbb610e9429820870deb356c4d51538c9d2db8ca9b987b1967d9447ac3cdbd0bc8b3e4226b1b57338837c085b853

Download Submit
C:\Windows\SysWOW64\Impliekg.exe

Filesize
80KB

MD5
ba180b521beab77e4bbea0a8688c2ee7

SHA1
bad0e819639f1d28d751487a1d9becbad11c709f

SHA256
836d46802a678cc9b8240197553a59ea6abbcc23251d39c4abf93476bef34c05

SHA512
ce795364fdf03e7c684a04721554ca662976df4a3e4c3c4766a4261498224f456886cdf83ff64f6ec9ee7bf41c60bedc9c3880b584aa94dec33886969ed09dec

Download Submit
C:\Windows\SysWOW64\Iomoenej.exe

Filesize
80KB

MD5
109f5507ef20be72f8cfbb1ce5b68b86

SHA1
a153d2fc21a10a42a774a7a2e5156d00ace77ff5

SHA256
39529a624b732eaf7316b835b557cf80277a4cedef6f02bccad0fc276f8c3f9d

SHA512
0d67f9ba49b1333ad5cd69143af88e86f1b6ed0978fc019f1192810a9c5b9db4043dfd530798cf7b44d2bdd0e0146cc687c3d3ef8dcb8a3a83029d7e3bc37a2a

Download Submit
C:\Windows\SysWOW64\Jmbhoeid.exe

Filesize
80KB

MD5
feadbef4dfb1e73ea04f276b3937f84d

SHA1
8880e283fa572787d16bc1383956e036b304c665

SHA256
b15f3642bebf74c8c96dbf69e84dccb8175055b6570844b0e5d15fd13fb59f6f

SHA512
58cd42bfdd5c4b962e3aadef4b57438b86003c0668dbc95d85b632fd18848f54612346132df55a2ffe2e33617252582031e4d1bb9aed1f04e33ac6e4ce12f382

Download Submit
C:\Windows\SysWOW64\Kpcjgnhb.exe

Filesize
80KB

MD5
5d99dcee94959eaf5a734c4cbdf594f5

SHA1
85f1bfd33380681beaf905b20febd7aa62a1fdf7

SHA256
f9b5108ec5a3cdae386b49d37400aa4418ae67e006decd966352c86ffc747024

SHA512
d27c54533045e542d0eb6abe813a25639569104c12e94841d1b8a0a57ffdba629af30fe97c37c2c02f3642418b825056d12dcb2d826c5ed589e8fc9dba88f7d5

Download Submit
C:\Windows\SysWOW64\Ljceqb32.exe

Filesize
80KB

MD5
1296b782b55e8347dfa2efc1ad27dcb3

SHA1
0006c5026a0cae1d765f0f5338ef1da5d09c9111

SHA256
b1ba77438a70e19afcab72235ef9e7885997386b29c6d1424d20729db5e14ebc

SHA512
c791cff1cb187f9707ee4fa73e517c4d145739c051735daf488bec26daeae5da83cd273c3b24989eace358505b968b8e30c12d9086527c55aa0439758f230865

Download Submit
C:\Windows\SysWOW64\Malpia32.exe

Filesize
80KB

MD5
84ec202ff45e28a34a2739bbaaf8a0df

SHA1
79cdd6d47fb4636b12ff11b7e16382da939d1e8b

SHA256
b53ad7d2a050547e532225b9531f8e302c4f96dc27e46fd6115e701946e3d1da

SHA512
ab33197a27ee01e93ba302070450b512af6f38b5757268c52b7e099a7e01e8154e3815d87943d5d1aabaa23d984ca646354ca69ade1a5479b48f7c609d4c7607

Download Submit
C:\Windows\SysWOW64\Manmoq32.exe

Filesize
80KB

MD5
11757cfe34464bc879655a42304975d1

SHA1
41d2c8c5e1bdf871234d7375f36bb0806fdb16b9

SHA256
e8a62442e4c6763e7808385dc776053f3427e3ce9efe8d377a8f2330dcb1de8e

SHA512
63c08481bb6c5a3caddc4e6e92258c23e93f3c6b59f96973c94627efd88747ade1712cfbeb145f4b1151f7f75ed5fdfce3730ff9ec36ab06b176656c864e2b89

Download Submit
C:\Windows\SysWOW64\Mcjmel32.exe

Filesize
80KB

MD5
65dfcce8fdf5c1906f9961e8635eb6ae

SHA1
b9c27773da5e6d7d61b5a8c97e545c011295c3f5

SHA256
f437459ddc9587e0a41e6d3864857a339514569288fbacc156a3c9f5ac566eee

SHA512
971a0ae56756931693c95236cdcc0cc35701135f092888e6569e933b6186ea20be81aeafb31666cae9f075ccd8974e3fb7cf2badcf4f154d108bac2caac9f4da

Download Submit
C:\Windows\SysWOW64\Mgclpkac.exe

Filesize
80KB

MD5
753c7f1297af7dc4ab6a558b2a714a11

SHA1
4224585e348f36a291f7fa3fee7f56a6b6f7336e

SHA256
b85e8ec93e410cb0be63875f4a49efb85af161f6fa963a1dc001c490a3ff5098

SHA512
6b3195e50a792bbd3a63a36f2cf95f47ec6dba1c60cff6c317786f062dd372c1a3dec6256763dff61e3a601de2c55f559ac1b0141ed8ca3f7ed5388a0af9bea5

Download Submit
C:\Windows\SysWOW64\Mjahlgpf.exe

Filesize
80KB

MD5
74bde80d7068b6410646c97a9dbce98a

SHA1
e32b40a50c3a61fc1941e3ae2a83f2e58a2b6f89

SHA256
c861faef9c2209a66b0bf25577d6c3c4ff5a3b8570e1b8a8a2562dc45e3a5739

SHA512
06c45e661aecd50ffd20e6a07397d39cf4195f25d547a51d0d2214c1f933eabe6c688bf407e6ac45438142c4ac1d43cedd281473bcdaa8803e044f48033ba76a

Download Submit
C:\Windows\SysWOW64\Mjdebfnd.exe

Filesize
80KB

MD5
1fafbafb4f10a9d1df12c58e8173b06d

SHA1
97f2f590bb2600e47219e9738e2052c6317d8088

SHA256
a8276c193dbd6183e03d10eabc4ffef3660b2280d37f4f97eae4172f05639f0f

SHA512
be9a6b931e58904870cc2d6846d259f434620c9814fd4b40643f0926bece2338171e219d0fc1879d5dddd2848f1780ee23ba0f9b9bb034ac956f7daae42b0dfa

Download Submit
C:\Windows\SysWOW64\Mjokgg32.exe

Filesize
80KB

MD5
9889cb152e87f74d37fda8d2ff0ba0f1

SHA1
e873297cf51690f1f9c89fc755959f2df2751f6d

SHA256
fd6555c086b202a1691a4b704bee3da096138d9147cc0bae1bf40bd5811b1c63

SHA512
fda72d9224b86a11964405e0c3dc5db1e3dd6c554a4e66455edfcfb966372c7b2ae2c5db69f3fac25874161c46d7b1ccc7e6f8669b975fe81767ed3d67ff0036

Download Submit
C:\Windows\SysWOW64\Mkadfj32.exe

Filesize
80KB

MD5
052d492fca03334913f3ef4bc4137296

SHA1
1e2693d461949fbc17d6a66877387b6469c05598

SHA256
1e395cf8987f2e0f04197d4b8d44daec6a0571118b16fc7aba62b1c1c051991b

SHA512
bfc9ec7fc4ce4fe02fbc0bf96d62841050d6043baf479f67c52a636e3a4b747a04ba269f74c4c75216381dd3b5e91debb00255269548e05d3238accb7070ec43

Download Submit
C:\Windows\SysWOW64\Mmbanbmg.exe

Filesize
80KB

MD5
d0ec9bf9d14d36a0393f3dd8790e7f89

SHA1
16bd5ca20b139731ddb2db06f1c640020b91efa1

SHA256
733f76df483846afe45572461e7dede84b6d0f84ad7a9498e3f41bba38428302

SHA512
2addad0c400bfb25c53d31222604d8f0b1e9fdaba839285484d9482522d615c98ad4e8e2c710c728a4020f30e6bf960a5a60985e23be77b16bdcdf668ab7bbeb

Download Submit
C:\Windows\SysWOW64\Mmpdhboj.exe

Filesize
80KB

MD5
2ec55f7bb4562619deab915b1b6496b4

SHA1
ba76391c43f657f68471123ef59cd5f5286e9682

SHA256
ed7d14220624b6d65ea7e3a6f3777bf86695b78d1d55cfafb5efae8b2589d923

SHA512
6a875fa0ca4a79f418b1582732c1ad92b5a4fd181b8cf0ccb5d62784217822105210536ec3950702d9b7115df785a6b6940e7052b5bd1f8976ec662693c08e60

Download Submit
C:\Windows\SysWOW64\Mnkggfkb.exe

Filesize
80KB

MD5
f180ad5fef3d459ababa701a6a089d0d

SHA1
09e5d8578a954ef1f5a10f2b6b3545459c9be0bc

SHA256
a0f63360400ed8b2e627c88eb4a2080b25b8db3fd45fa01fe2bf229f14fd4fe6

SHA512
9fb113259f1d439592f4073529a1c88c9376f379c19e6fef339231353f678895db7935bcd399c41535b00282bb65a74c3ab0dd0600ae213081092cf7c946318c

Download Submit
C:\Windows\SysWOW64\Mogcihaj.exe

Filesize
80KB

MD5
818e2498d173ce79f3afc9595aefc84f

SHA1
cac4bb3af1d7b6bd7d824d68d4c3893b6eab78fc

SHA256
33c84d3209d1c12c3a2bb5a15d433dcb98180a8d5d06f1125740cba28eb55122

SHA512
7846d345856260f4920f21219779f08250cd93964710f874528c36f4e5b40cbca90a206502957fb062c2d44e3a585241c690cd350a6d8275348d567a4b9af6c8

Download Submit
C:\Windows\SysWOW64\Nabfjpak.exe

Filesize
80KB

MD5
d4c0b0684593512a9c66a6e9d359710b

SHA1
95e5e65b70b0d34f194638f33356b23253bf7194

SHA256
15bf68ae2b447cb1d673f849b18a048e569bbf999eaaad86961406401e93ddc3

SHA512
4881972c8e93388cf9de2941c3dcdb12e9d1e8144e3ff17a853dd76a6fc60a62fcaf0bdb3e001213ed7e5723d622d8236f05a01ca126492614e751794b941a00

Download Submit
C:\Windows\SysWOW64\Naecop32.exe

Filesize
80KB

MD5
b0f3ba19bce272fdd310a66f068461bc

SHA1
b652c4fc62d99d8b73c37394d140ed42d89b20a0

SHA256
63eaa2e5ce5d298629c93b81e4471ab36e9537d337148509f5cf357c168f56a7

SHA512
a1fe23cb5f2a0bf2e24a725ec8180e62d4b83db4b1238638446f307c9bae50f14cb283850301c421caba59eb12b48a5c02542d8ac053a5f4d44912a7a5358554

Download Submit
C:\Windows\SysWOW64\Nagpeo32.exe

Filesize
80KB

MD5
4d823026b1dd291fe59b6a2fd2bb4552

SHA1
e1aba4d902532de06de516bde30b2b608a382b38

SHA256
245c26774316d68b8854cbc5e8e619648c4593a128e76139ea2783a3ca121632

SHA512
a3297c8db0c08141187674c02d1ad5d7216c71c726f0e226851a49051007d7aae3f02e5334b2ac09a66822065f23dd7966f35630aad2b62a8b933dbcac0814bf

Download Submit
C:\Windows\SysWOW64\Napjdpcn.exe

Filesize
80KB

MD5
9128d357258d18fcf63203cbd2e15441

SHA1
ce62f21c8888030c312b1b8c2265c9a7096d99f9

SHA256
8344b1a67fd4b6134d439e456427b0c67bd9a73f649b45b5520c7e0ede403eab

SHA512
91929c54762d20c65d3774fd2b0f95338e74245480ef4cdce07db84d3bc5223f3857786e3353a34f92006da89f4cb756394694a683e874df9d5e1bf11b766311

Download Submit
C:\Windows\SysWOW64\Nceefd32.exe

Filesize
80KB

MD5
918d09e0a707f46024cf7eca549479a1

SHA1
c5038b32613b4b30af03feaab95a1014ee22bca7

SHA256
5aa3e51a2f3e0d1b681187367c3a1f39584b4101e7feb06a9c139fce116f4c92

SHA512
f5903e2596951ac2c13546e15e175e5960bb8ef7980ffa2cc746b251dcb9fbe72c69a5daa9d1faa40d5c0b4ca67869247c777596c05ea1adbefdc2eba8455d81

Download Submit
C:\Windows\SysWOW64\Ncofplba.exe

Filesize
80KB

MD5
d6ac786e79d2ce69eb8b30873aa152ae

SHA1
c7c1505643e4878a8891d3770f782cafc75cfca2

SHA256
e469cc17db38a09ce77f766ac051c6c982df888bcbbddad95ed54d2e9f9bd091

SHA512
bd145678d5835b078f509cc72fdf6f30d6dc42872e6a2b6bd446e08176e8e9a331935b781de14cea90aa91e364d5af2bc55c68fcb21ea63531829790e70f41d4

Download Submit
C:\Windows\SysWOW64\Ndflak32.exe

Filesize
80KB

MD5
8af11b79f75104f1be511446effc5af3

SHA1
0b853ca2619feedabee29cdc69d900a818d1e528

SHA256
af9906941bd84ec9e69346454858b35f7e55cffe064adce94e86def6ebd78670

SHA512
209430924b5b51b113cf3cffc28b1e75bc150fd5f157530c4f6a58cc268ae706eb54016e4fd66255177e8b3313321bb54f7e310feaa3f0e5662592652f7994e4

Download Submit
C:\Windows\SysWOW64\Neqopnhb.exe

Filesize
80KB

MD5
d138fd12fdb669f3d1006b1f423cf1e3

SHA1
5f6dafe74486b603ab77ea4cc527a4c56d45ddf1

SHA256
3dd496ae0ed1d9068162c2875ce72bfd89594775f594b20089874a9b923b307b

SHA512
828cb297bae5b0ef926dbc8dcaac709abac54abd4e4a692e59cfc10d7a6c2f7e3aa4cba698ff2969025e41715c295bc263897b0c7bee880d6e867afa2bc7ef59

Download Submit
C:\Windows\SysWOW64\Nghekkmn.exe

Filesize
80KB

MD5
94702ccdbf25fc52c9cb78a1d0145725

SHA1
8aa4fd7ddba2b85110cc0951386b3ee5d323e547

SHA256
45ef761d336998cc16be3cde9915dcff54aecaeb64cd1b586b7d665ca0a7001b

SHA512
3cdb9ab468e32c30493b36d4142a2efcfebdded423ee0a5241ef3cdea31ff46c616e0c709fe82ad7528869f3f30aad90cc492e6eb03fc7224c7685719638cee7

Download Submit
C:\Windows\SysWOW64\Ngjkfd32.exe

Filesize
80KB

MD5
a8693a3d6e7d0c71fed67517d847807a

SHA1
8952f007aa6909d43d928af2765ef971f6084074

SHA256
6c2f2465da127ac55a89910f51ffd00d6d2f85290d285380fda089f743bf9cc3

SHA512
c239d03b0886ed9cc9d5ea57044ce47052e2f7ac1996fa15839a4421f51707969eac5cbdf42b232567b12c51119d704f2b958926a4824f19eb28a742c5314547

Download Submit
C:\Windows\SysWOW64\Nhahaiec.exe

Filesize
80KB

MD5
ed5dedd66c1ae137f2bd3dc6821445b0

SHA1
e707bb05e942e296802b743829120ccc72ed5fa7

SHA256
612376ed4671ee9ec54aa1432f5735e39d8eb5a1230c6f5eece875ad98827c31

SHA512
1966c5fbcaa910be92d25c44fd3823242b456edbded2d0b48b5210f8d4da46d98c566ca24611501ec840dd79a23c61405b6a072f518883f5cab69dc2787014de

Download Submit
C:\Windows\SysWOW64\Nhmofj32.exe

Filesize
80KB

MD5
a82389471c284cc56ff1543b2c6903e1

SHA1
d85221af9456a8a438f578d939dd5e4fe4ddbbde

SHA256
6fd2b2f95c585e2f6c2079a6dde43aae1b91600989b518e7f46448db5d9a52b4

SHA512
470017f1b0e4ef842032c132c5cce06d3e36fe034f854b73036ab4a3e3383a7d559dff23fe6247dff0079325ca9eaeff78431d9069987f135ab0656c7ad44d09

Download Submit
C:\Windows\SysWOW64\Nhokljge.exe

Filesize
80KB

MD5
8b795b6ca63733720f498be8626aa344

SHA1
29ed694f82121b34d45986a5d9663fbc0f68cf63

SHA256
e72597b29a2f29ea0a3d25973bb53d70d83347a3235b9d12977d282c8fee5956

SHA512
8c75ab72406629fe2751b387c031d82d5712f51fb8cdec4faa235a024121f19ce31b3504e4a7c12a5681b30add2c2c8aa47787eaa5f7b1a920c3dfe1c1f5294b

Download Submit
C:\Windows\SysWOW64\Njfagf32.exe

Filesize
80KB

MD5
2243fff16a9a89a78d51b014081095ef

SHA1
8d2284e6dc144c69ca491e1832487fb70ab79805

SHA256
787fa8d22e878fc2e13e27a3a9f71cfba774d3e780bef1db89ca09ff9279b751

SHA512
459415435cdbd7d3bd04e142c9f9078bc8ece2252dd84f07ee4833c7ebcdc90fd2e13181c7050f11248d9cf700a65959f9b37395b7c11141c83f3850d632f4ba

Download Submit
C:\Windows\SysWOW64\Njmhhefi.exe

Filesize
80KB

MD5
5193ec2fbeaf825546364a520d26fd7a

SHA1
ef747f89d66c29e8a1641d76748c74edd9685c78

SHA256
3e13ffceb2e86e3baf0652bf9177eec1180671aeb7e1c408e264fe6d713dfc3d

SHA512
3b477a83bfe90ff5c61e88653c9050a128b90819f5deaf73fa1b73d401c3bf342d16a014ca102da0774ec23f3024f0c0ed316381a2d7bba3175664dba13b0081

Download Submit
C:\Windows\SysWOW64\Njpdnedf.exe

Filesize
80KB

MD5
2cf0a0e17a1abbbb774940bde7e28d14

SHA1
90094d139e2db736cc73d649be4e8fd0b71b8416

SHA256
f39a107570749287f54179ecd24d4b22bec3b4651b9686b4222cd34a24549a53

SHA512
031d825fa4356a1f7b84ac6093df454db40b5c6097d810916a8bd0193011dae4b1a07461c63eb96b33e1b4adc9c7144d22469c94fe3bc57b8c7b57af2953bdd2

Download Submit
C:\Windows\SysWOW64\Nlfnaicd.exe

Filesize
80KB

MD5
dbc4d1db5a00e3ec0abe29846020da1a

SHA1
bf8cc242dfdf116b2379e91c17018827be69e894

SHA256
6b5751bbe4687bd6bc94c0f7988eba666b42717db2fedab8b767ab54f9c016fa

SHA512
53ebf07894bf99208bf0c1d4a606f244aa31a18a799ebd4b8afe3fd2c7c10ac22812360f65c3d6604009e90048995e7edbbb6511261ea3cc202df7c7282906f8

Download Submit
C:\Windows\SysWOW64\Nlhkgi32.exe

Filesize
80KB

MD5
2e574a4903364b593c49ba7a235adcbc

SHA1
f582d3c1637d7634efb534004247b29c896a63e7

SHA256
d364b6b4cb6b492f4d52ca4f911be9a4f40ce0ee2cdf23e5cdc744273c390191

SHA512
b431fc0d160a483bbc440d3514705dfeac07dccfb4484fa3ab17e8d80ff60f54c91da8901c430bd52a0d3c1cb3c6129517a99a653dfdee65e86fd732895b13ad

Download Submit
C:\Windows\SysWOW64\Nmgjia32.exe

Filesize
80KB

MD5
196a864b72d200b680383defa2270a36

SHA1
a85139ac338616b5ea137c6fca88bb068b115183

SHA256
6237a4742562d2199977cde245e8b6589240c42c0d332ab0306703116901a873

SHA512
3a2219864c81ab2a25b4c19b59d2a278c1d5f96462a218ddf58d61b22e1b398bb8eeacceb4471efe38dc6077fb92627dd900d15319ce6ce0d442b0a94e906d5d

Download Submit
C:\Windows\SysWOW64\Nmipdk32.exe

Filesize
80KB

MD5
5cfa1c93085e172a08ae608d7dee3b54

SHA1
5736454e57b86765e9fbf7561cd4bd4f37f1e01e

SHA256
2faf684c6b2209233447305ae3c46e46aaf87f187e3b4478d76a5a45935b8f02

SHA512
2978bc52de48e435b29fae7a38b03bbeb25a720b13af4fd99cbb9b0d84fac34986474a2626955f6f854d7f21b2f9a74ac8a0a5540d73b5493591c03bdcc6de85

Download Submit
C:\Windows\SysWOW64\Nmnqjp32.exe

Filesize
80KB

MD5
15a961639f45ea7f498ab4daf8af53d1

SHA1
5c8bd3551e9e5ed857d18ff1f46969859b995495

SHA256
cfc5cfe484c527acc1e64a86e2f4938d3d0b94e05188728e45be7255b71e2671

SHA512
02e59666afe1a66d6b92724c69f5aad96a5f6cef22a665ad0bfa6dd69a0b4935f965dbb7e8af61a3ab24c4e28c9386ca3dec2f077cd4b27faf1edeb8fcf076f2

Download Submit
C:\Windows\SysWOW64\Nnbnhedj.exe

Filesize
80KB

MD5
022b5e5770f511b7aaf631c4fa751404

SHA1
48fbbdb6480bacc712becbd29d237a2f95a4213c

SHA256
296969bcf14a6102d409bc62489dc978553cabe03fc148835ebdbdfead345d35

SHA512
6b4574eaaa5b75e6c31ef258f03c395c31aa642cd0ad57ba5b369f28a0422b8a82e9ae5eda02b184455aa1b87934db9b92a7528d11763767a1295744ac80a32b

Download Submit
C:\Windows\SysWOW64\Nncccnol.exe

Filesize
80KB

MD5
30683c0bd13e4913548babce38ba80b8

SHA1
c3f807fc470a9e05828111d015e6b41752009e91

SHA256
f9c0d3cf34920bd34ac35cec449da1623bac1aa3b81069684ab26adac9555375

SHA512
674ca62485ebd3ba04c204fc535dc30358a92a6dc4fcafbfcc3ae497e51df2a0a5dc7e5323088e7ac4b33cdcdfb9499a4bdf5af638fb8ee9ee4f277c209b47b1

Download Submit
C:\Windows\SysWOW64\Nnfgcd32.exe

Filesize
80KB

MD5
1578a6cfbb0962e594400aa217c73871

SHA1
a75e3cd331af5495960ef325242228a508bcdc30

SHA256
c3d1173e9816900a7927941a33a5c6642e9d3ae606a5f9399359948e04176475

SHA512
7f59bd1242dae02118ac17d6bc217f4e468b0eeab7b0262802e304829975dd77161cc95ca42b6a7c965fc1e5093d4efa7acf1c83c7ce7eb53e938aa62d34546f

Download Submit
C:\Windows\SysWOW64\Oabhfg32.exe

Filesize
80KB

MD5
c6d9116ec8960099423bd2d0f2d12ca3

SHA1
e77df420bd25d4c8225b8533a19c7744d002b6e3

SHA256
64d086d36653bf923ada6bb8034613272f30c64905f356fbd611e9c894e560b6

SHA512
fd4f9573c73934ebf86076890ebc4d6eaa98cdd8216857dddcfbefcdae0584c44562c9a8940faf699a03790d8ec17c9a9ac2c51f4a325adeb388a05926dbdc55

Download Submit
C:\Windows\SysWOW64\Oeehkn32.exe

Filesize
80KB

MD5
895839cafb5896eea9cfa06d9ba04e49

SHA1
de1f8e4ccf6f772f4316815bc368fcd982c6b2ee

SHA256
dbf9dafae59fad40f0542b35abdfd749bf44be8b73299a3ccbe6dc522868e639

SHA512
90f35f8b933f10c22f1a4f022ebfbe2fb6784dcc634197aae063e45b19b92dbdfc7b3011823b80fb29fc0765ba585cad04e22e786082b940d9a2941bbdc5c434

Download Submit
C:\Windows\SysWOW64\Ojajin32.exe

Filesize
80KB

MD5
8f70f41d643dc17b0dcb9fb97af4ac8d

SHA1
75a6b6c41e01d05445adc2fe653d20f3c3bcca8c

SHA256
57ac7e0c2072b1cd7a8051e6b96fd95a77ff2a03bbb07d3a5263fe44e594318b

SHA512
0f2a217ed64d06dd2074f64a047ff707545b9f374cfa6e5a4621f86ad16b80eef6a9c20d59105a7191b97b1d00df8f18d550472d5678db11519907856602e1f5

Download Submit
C:\Windows\SysWOW64\Olicnfco.exe

Filesize
80KB

MD5
4e81b43912b894525b84f0aa5380d0e8

SHA1
1685f0608d1663b4b7d6d7e349f43f5cf5e72bbe

SHA256
d4a13c347d5e081a5e43520d95083e9fe9cefebd8714fb22eeca5b43e6ff42c4

SHA512
30f981a25a2318c3145dd543df15b51508f3358651acbbc4f124a343635f4f90b93b6ca3e891e70c8c1223d9abb9b9b160ca818ab1483fd851a2565f3235fb39

Download Submit
C:\Windows\SysWOW64\Omqmop32.exe

Filesize
80KB

MD5
7257253bc183f923be137f60b715d597

SHA1
725f37872b4009dd53c53fd7393db9f522e6622e

SHA256
f6d770b6965065d4bb5ece353a34ae97408e81f4bc8b7e60e41e82cf83042f73

SHA512
adbcb74614ddd0f520081235755fc2a5e7ee3a899acd61f13027ea9f76b0d31d21d761544c417fa935a08da8f29c27c4f30e1accc585febf8153539fb20a5328

Download Submit
C:\Windows\SysWOW64\Onocomdo.exe

Filesize
80KB

MD5
d4b1d925531334cb3256085d3ff8cd80

SHA1
3bdf7781cfb5b2038924dbc093aa7ddcb8d95b3a

SHA256
8233067b09e84ef4e801fa2a861a32e1965ccfdfd39b624a887e9d0655d43c12

SHA512
149a3385576eb6e42efc1e48764bbe035aee1b1defbea2a994e87cb9903157f4db462771c05d57219bb32a56dd7a0c85a5e7e53da68b4966824519bd531e7b7a

Download Submit
C:\Windows\SysWOW64\Pkegpb32.exe

Filesize
80KB

MD5
cc715f86c306b63a4eab19043052aa46

SHA1
3e5bfda5fe5446463eea40d2e61380b100d63330

SHA256
0df5940b2ed989db792a7c724068d37bcb05925a93979bbf24a99c06956147fe

SHA512
105c816aa54c85a71250ef6b22c19e4e1c195005918c0235d84b824fa584b9ce14f725a09fc0dfa495c96111122978dcfb00185d6c3685642c975de674290441

Download Submit
C:\Windows\SysWOW64\Poimpapp.exe

Filesize
80KB

MD5
c72c660d44bfa53b88c86071cdc64139

SHA1
d1fe820188e979a6d91d49bd8a35b4577854c096

SHA256
f9a84bf85d22507881ad37e71dd2bfafdcf3eb2c889419675a04aed08a81ecf7

SHA512
867f598221e4f252c21a3e7dc64a1c237018c0fe2ef9fa27c740c8e7df68b48de7bc75b9ceda0a170e9ee1989e75a09792170ecb127406609007cdc9527e2d52

Download Submit
C:\Windows\SysWOW64\Qmeigg32.exe

Filesize
80KB

MD5
166ba4452d1dbcbb46f692a8938d16b0

SHA1
fa3305df8c4a4e8efbf26e4ff131cccd8cd4ec8c

SHA256
9740053871b931e6a0ed5425b1ef3a32f79ab79e35292ba5d1e97a503deda8df

SHA512
786f8dea8a2852aaa5447a7b9b880fcf662bf2d5717b86cdeb1c5392007770af2941738e0559ff9266ae59a182c16f94f94e4724b231c5b764a71321aa2f4d7d

Download Submit
memory/224-383-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/400-429-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/436-73-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/512-365-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/536-593-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/536-49-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/696-177-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/892-297-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/920-129-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/968-269-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1044-351-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1048-571-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1048-26-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1176-389-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1216-225-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1340-145-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1396-33-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1396-583-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1440-105-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1460-121-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1504-310-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1520-453-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1548-411-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1564-265-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1624-431-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1632-559-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1632-16-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1652-57-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1664-437-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1888-85-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2372-137-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2404-279-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2480-419-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2604-443-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2736-193-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2780-401-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3016-41-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3016-586-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3036-185-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3060-160-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3068-9-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3068-552-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3368-549-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3368-7-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/3368-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3392-233-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3408-257-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3444-395-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3448-363-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3492-345-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3536-375-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3556-154-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3568-169-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3632-291-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3648-315-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3652-377-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3680-285-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3784-217-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4108-339-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4196-97-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4296-253-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4336-209-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4352-323-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4392-113-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4412-321-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4456-64-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4612-89-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4688-205-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4760-241-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4792-417-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4860-329-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4884-353-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4916-303-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5136-455-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5180-465-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5220-467-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5260-477-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5300-481-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5340-489-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5380-495-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5416-502-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5460-507-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5500-509-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5544-519-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5584-521-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5624-532-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5660-533-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5704-543-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5740-551-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5784-553-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5836-565-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5876-572-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5912-573-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5968-585-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6004-587-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/6056-594-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads