3a7dda2bb1bfbe63690f1bc2a1a95d1107726d0f4b6a7080bfdf1c449627133b

Analysis

max time kernel
138s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

454856566f2fc7b9887ef16c27b59b70_NeikiAnalytics.exe
Size

182KB
MD5

454856566f2fc7b9887ef16c27b59b70
SHA1

e3307131b9f73d9a380301dbf4797d9e88eada7d
SHA256

3a7dda2bb1bfbe63690f1bc2a1a95d1107726d0f4b6a7080bfdf1c449627133b
SHA512

dd75f07ac298e6642105a07e58c4e488de6a043c1f8b01b049fd4ad5baffd7b4d8bcdd2b1cdd5444e424af32ff64b2acd8e8258002c311781daa4442c10a8339
SSDEEP

3072:939ahd3dYSVtOAdirMx8Jcjs0a3vo7nguPnVgA53+GpOc:9Juo0cvoEiV6GpOc

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Hckjacjg.exeMpoefk32.exePjkombfj.exeBblckl32.exeCliaoq32.exePflplnlg.exeIcplcpgo.exeJmhale32.exeAdgbpc32.exeOnklabip.exeLekehdgp.exeLmiciaaj.exe454856566f2fc7b9887ef16c27b59b70_NeikiAnalytics.exeDaconoae.exeBjddphlq.exeHmfkoh32.exeJfhlejnh.exeLikjcbkc.exeOddmdf32.exeIcifbang.exeGododflk.exeIicbehnq.exeLbdolh32.exeDedkdcie.exeFkciihgg.exeBcoenmao.exeDdbbeade.exeEcmeig32.exeDeoaid32.exeGohhpe32.exePmidog32.exeCeqnmpfo.exeOdmgcgbi.exeLbmhlihl.exeLllcen32.exeKfckahdj.exeBldgdago.exeJbhfjljd.exeOfqpqo32.exeAbemjmgg.exeCbjoljdo.exeGdqgmmjb.exeKmfmmcbo.exeMgagbf32.exeBmkjkd32.exeQloebdig.exeLeihbeib.exeOfcmfodb.exeNcnadk32.exeBdfibe32.exeFohoigfh.exeNjqmepik.exeBfhhoi32.exeDoqpak32.exeFdlnbm32.exeImakkfdg.exeIpbdmaah.exeAndqdh32.exeJmmjgejj.exeMpablkhc.exeAgffge32.exeQmmnjfnl.exeDanecp32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hckjacjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpoefk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjkombfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bblckl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cliaoq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pflplnlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icplcpgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmhale32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onklabip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lekehdgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	454856566f2fc7b9887ef16c27b59b70_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmfkoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfhlejnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Likjcbkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oddmdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icifbang.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gododflk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iicbehnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbdolh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dedkdcie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkciihgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddbbeade.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecmeig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deoaid32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gohhpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmidog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbdolh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbmhlihl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lllcen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfckahdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bldgdago.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbhfjljd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofqpqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abemjmgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbjoljdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdqgmmjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmfmmcbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgagbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qloebdig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Leihbeib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofcmfodb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncnadk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdfibe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fohoigfh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njqmepik.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Doqpak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdlnbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imakkfdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipbdmaah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmmjgejj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpablkhc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agffge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Danecp32.exe

Executes dropped EXE 64 IoCs

Processes:

Ndghmo32.exeNkqpjidj.exeNjcpee32.exeNnolfdcn.exeNdidbn32.exeNbmelbid.exeNcnadk32.exeOndeac32.exeOdnnnnfe.exeObangb32.exeOdpjcm32.exeOkjbpglo.exeOdbgim32.exeOgaceh32.exeOnklabip.exeOdednmpm.exeOnmhgb32.exePkaiqf32.exePqnaim32.exePghieg32.exePbmncp32.exePndohaqe.exePabkdmpi.exePjkombfj.exePeqcjkfp.exePjmlbbdg.exeQecppkdm.exeQgallfcq.exeQajadlja.exeQloebdig.exeQbimoo32.exeAgffge32.exeAnpncp32.exeAanjpk32.exeAcmflf32.exeAjfoiqll.exeAbngjnmo.exeAcocaf32.exeAjiknpjj.exeAacckjaf.exeAdapgfqj.exeAngddopp.exeAealah32.exeAbemjmgg.exeBdfibe32.exeBlmacb32.exeBhdbhcck.exeBjbndobo.exeBbifelba.exeBdkcmdhp.exeBjdkjo32.exeBblckl32.exeBldgdago.exeBobcpmfc.exeBaaplhef.exeBlfdia32.exeBoepel32.exeCacmah32.exeChmeobkq.exeCliaoq32.exeCogmkl32.exeCbcilkjg.exeCeaehfjj.exeCddecc32.exe

pid	process
1520	Ndghmo32.exe
2348	Nkqpjidj.exe
5096	Njcpee32.exe
224	Nnolfdcn.exe
456	Ndidbn32.exe
1676	Nbmelbid.exe
4208	Ncnadk32.exe
1616	Ondeac32.exe
4952	Odnnnnfe.exe
4988	Obangb32.exe
2256	Odpjcm32.exe
3316	Okjbpglo.exe
4448	Odbgim32.exe
4904	Ogaceh32.exe
760	Onklabip.exe
988	Odednmpm.exe
2544	Onmhgb32.exe
800	Pkaiqf32.exe
3300	Pqnaim32.exe
232	Pghieg32.exe
2532	Pbmncp32.exe
3552	Pndohaqe.exe
4776	Pabkdmpi.exe
3348	Pjkombfj.exe
1940	Peqcjkfp.exe
3944	Pjmlbbdg.exe
4920	Qecppkdm.exe
5000	Qgallfcq.exe
4344	Qajadlja.exe
2664	Qloebdig.exe
2808	Qbimoo32.exe
2120	Agffge32.exe
4268	Anpncp32.exe
2080	Aanjpk32.exe
676	Acmflf32.exe
4056	Ajfoiqll.exe
1368	Abngjnmo.exe
4472	Acocaf32.exe
4516	Ajiknpjj.exe
2764	Aacckjaf.exe
4404	Adapgfqj.exe
4584	Angddopp.exe
4788	Aealah32.exe
1004	Abemjmgg.exe
4484	Bdfibe32.exe
1756	Blmacb32.exe
2016	Bhdbhcck.exe
392	Bjbndobo.exe
1816	Bbifelba.exe
1532	Bdkcmdhp.exe
4820	Bjdkjo32.exe
1572	Bblckl32.exe
3840	Bldgdago.exe
4960	Bobcpmfc.exe
3948	Baaplhef.exe
2940	Blfdia32.exe
3672	Boepel32.exe
856	Cacmah32.exe
4560	Chmeobkq.exe
3736	Cliaoq32.exe
1544	Cogmkl32.exe
2064	Cbcilkjg.exe
2876	Ceaehfjj.exe
4948	Cddecc32.exe

Drops file in System32 directory 64 IoCs

Processes:

Blfdia32.exeDkljak32.exeEkacmjgl.exeKbaipkbi.exeMgagbf32.exeOpdghh32.exeCagobalc.exeNepgjaeg.exeOkjbpglo.exeBdfibe32.exeDddojq32.exeEkhjmiad.exeIemppiab.exeJbhfjljd.exeChdkoa32.exeMplhql32.exeCeqnmpfo.exeBobcpmfc.exeElgfgl32.exeGfgjgo32.exeKiidgeki.exePcijeb32.exeHcpclbfa.exeImdgqfbd.exeQffbbldm.exeBaicac32.exeBbifelba.exeCojjqlpk.exeHobkfd32.exeJimekgff.exePnfdcjkg.exeQcgffqei.exeDeokon32.exeFfkjlp32.exeIejcji32.exeImakkfdg.exeNdghmo32.exeEofbch32.exeAmddjegd.exeIlidbbgl.exeCacmah32.exeMenjdbgj.exePqnaim32.exeQecppkdm.exeIeolehop.exeAjfhnjhq.exeDaconoae.exeJplfcpin.exeNilcjp32.exeAeklkchg.exeBclhhnca.exeEcmeig32.exeImmapg32.exeIfgbnlmj.exePjmlbbdg.exeJmmjgejj.exeJcioiood.exeObangb32.exeFcmnpe32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\Boepel32.exe	Blfdia32.exe
File created	C:\Windows\SysWOW64\Dohfbj32.exe	Dkljak32.exe
File opened for modification	C:\Windows\SysWOW64\Eaklidoi.exe	Ekacmjgl.exe
File opened for modification	C:\Windows\SysWOW64\Kfmepi32.exe	Kbaipkbi.exe
File created	C:\Windows\SysWOW64\Bagcnd32.dll	Mgagbf32.exe
File created	C:\Windows\SysWOW64\Donfhp32.dll	Opdghh32.exe
File created	C:\Windows\SysWOW64\Cnkplejl.exe	Cagobalc.exe
File created	C:\Windows\SysWOW64\Odgdacjh.dll	Nepgjaeg.exe
File created	C:\Windows\SysWOW64\Odbgim32.exe	Okjbpglo.exe
File created	C:\Windows\SysWOW64\Egjpehcm.dll	Okjbpglo.exe
File opened for modification	C:\Windows\SysWOW64\Blmacb32.exe	Bdfibe32.exe
File opened for modification	C:\Windows\SysWOW64\Dllfkn32.exe	Dddojq32.exe
File created	C:\Windows\SysWOW64\Mifnjj32.dll	Ekhjmiad.exe
File created	C:\Windows\SysWOW64\Gnchkk32.dll	Iemppiab.exe
File opened for modification	C:\Windows\SysWOW64\Jefbfgig.exe	Jbhfjljd.exe
File created	C:\Windows\SysWOW64\Picpfp32.dll	Chdkoa32.exe
File created	C:\Windows\SysWOW64\Flfelggh.dll	Mplhql32.exe
File created	C:\Windows\SysWOW64\Cfbkeh32.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Baaplhef.exe	Bobcpmfc.exe
File created	C:\Windows\SysWOW64\Eofbch32.exe	Elgfgl32.exe
File opened for modification	C:\Windows\SysWOW64\Hiefcj32.exe	Gfgjgo32.exe
File opened for modification	C:\Windows\SysWOW64\Kpbmco32.exe	Kiidgeki.exe
File created	C:\Windows\SysWOW64\Fjbnapki.dll	Pcijeb32.exe
File created	C:\Windows\SysWOW64\Hfnphn32.exe	Hcpclbfa.exe
File created	C:\Windows\SysWOW64\Enoogcin.dll	Hcpclbfa.exe
File opened for modification	C:\Windows\SysWOW64\Ilghlc32.exe	Imdgqfbd.exe
File created	C:\Windows\SysWOW64\Qeobam32.dll	Qffbbldm.exe
File opened for modification	C:\Windows\SysWOW64\Bgcknmop.exe	Baicac32.exe
File created	C:\Windows\SysWOW64\Bdkcmdhp.exe	Bbifelba.exe
File created	C:\Windows\SysWOW64\Cahfmgoo.exe	Cojjqlpk.exe
File opened for modification	C:\Windows\SysWOW64\Hbpgbo32.exe	Hobkfd32.exe
File created	C:\Windows\SysWOW64\Jmhale32.exe	Jimekgff.exe
File opened for modification	C:\Windows\SysWOW64\Pmidog32.exe	Pnfdcjkg.exe
File created	C:\Windows\SysWOW64\Aoqimi32.dll	Qcgffqei.exe
File created	C:\Windows\SysWOW64\Dkkcge32.exe	Deokon32.exe
File created	C:\Windows\SysWOW64\Apignbdf.dll	Ffkjlp32.exe
File created	C:\Windows\SysWOW64\Imakkfdg.exe	Iejcji32.exe
File created	C:\Windows\SysWOW64\Mfadpi32.dll	Imakkfdg.exe
File opened for modification	C:\Windows\SysWOW64\Mgfqmfde.exe	Mplhql32.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Ndghmo32.exe
File created	C:\Windows\SysWOW64\Eadopc32.exe	Eofbch32.exe
File created	C:\Windows\SysWOW64\Gdeahgnm.dll	Amddjegd.exe
File created	C:\Windows\SysWOW64\Icplcpgo.exe	Ilidbbgl.exe
File created	C:\Windows\SysWOW64\Chmeobkq.exe	Cacmah32.exe
File created	C:\Windows\SysWOW64\Fnhfnh32.dll	Cacmah32.exe
File created	C:\Windows\SysWOW64\Npcoakfp.exe	Menjdbgj.exe
File opened for modification	C:\Windows\SysWOW64\Pghieg32.exe	Pqnaim32.exe
File created	C:\Windows\SysWOW64\Nhmkghpm.dll	Qecppkdm.exe
File created	C:\Windows\SysWOW64\Iikhfg32.exe	Ieolehop.exe
File created	C:\Windows\SysWOW64\Gfnphnen.dll	Ajfhnjhq.exe
File opened for modification	C:\Windows\SysWOW64\Deokon32.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Ncnaabfm.dll	Jplfcpin.exe
File opened for modification	C:\Windows\SysWOW64\Nngokoej.exe	Nilcjp32.exe
File created	C:\Windows\SysWOW64\Agjhgngj.exe	Aeklkchg.exe
File opened for modification	C:\Windows\SysWOW64\Bhhdil32.exe	Bclhhnca.exe
File created	C:\Windows\SysWOW64\Njkdbljm.dll	Ecmeig32.exe
File created	C:\Windows\SysWOW64\Ipknlb32.exe	Immapg32.exe
File created	C:\Windows\SysWOW64\Iejcji32.exe	Ifgbnlmj.exe
File opened for modification	C:\Windows\SysWOW64\Qecppkdm.exe	Pjmlbbdg.exe
File opened for modification	C:\Windows\SysWOW64\Jplfcpin.exe	Jmmjgejj.exe
File created	C:\Windows\SysWOW64\Jfhlejnh.exe	Jcioiood.exe
File created	C:\Windows\SysWOW64\Bkjlibkf.dll	Menjdbgj.exe
File created	C:\Windows\SysWOW64\Kjmidh32.dll	Obangb32.exe
File created	C:\Windows\SysWOW64\Ffkjlp32.exe	Fcmnpe32.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

10256 10180 WerFault.exe Dmllipeg.exe

pid	pid_target	process	target process
10256	10180	WerFault.exe	Dmllipeg.exe

Modifies registry class 64 IoCs

Processes:

Cahfmgoo.exeGmlhii32.exeLdoaklml.exeMlampmdo.exeNjciko32.exeOddmdf32.exeAanjpk32.exeCeaehfjj.exeMdckfk32.exeQmkadgpo.exeChbnia32.exeKfjhkjle.exeNjqmepik.exePghieg32.exeDkljak32.exeNjefqo32.exePjjhbl32.exeClkndpag.exeIlghlc32.exeCfbkeh32.exeIiaephpc.exeKlngdpdd.exeHflcbngh.exeJbeidl32.exeMipcob32.exePnfdcjkg.exeAjhddjfn.exeBbifelba.exeCkedalaj.exeIpknlb32.exeOgkcpbam.exeOqfdnhfk.exeOdnnnnfe.exeCajcbgml.exeGicinj32.exeEoolbinc.exeFkopnh32.exeGbgdlq32.exeHcbpab32.exePqmjog32.exeNbmelbid.exeDhidjpqc.exeQmmnjfnl.exeMpablkhc.exeOjgbfocc.exeOlfobjbg.exeBnhjohkb.exeGododflk.exeKbaipkbi.exeIeolehop.exeLpqiemge.exeBnkgeg32.exeFfkjlp32.exeFhjfhl32.exeCajlhqjp.exeQgallfcq.exeEekaebcm.exeIehfdi32.exeNdghmo32.exeChghdqbf.exeEcmeig32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cahfmgoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmlhii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldoaklml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlampmdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njciko32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oddmdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aanjpk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceaehfjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nniadn32.dll"	Mdckfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmkadgpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chbnia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocdfloja.dll"	Kfjhkjle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njqmepik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pghieg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkljak32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnlden32.dll"	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnigkegh.dll"	Clkndpag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilghlc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pldhcm32.dll"	Iiaephpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efjecajf.dll"	Klngdpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hflcbngh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbeidl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mipcob32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echegpbb.dll"	Ajhddjfn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbifelba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fobdihjo.dll"	Ckedalaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hflcbngh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipknlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chmhoe32.dll"	Ogkcpbam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqfdnhfk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odnnnnfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghaddm32.dll"	Cajcbgml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gicinj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eoolbinc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kldggoeb.dll"	Fkopnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkomqm32.dll"	Gbgdlq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkbbae32.dll"	Hcbpab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfjhkjle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qhbepcmd.dll"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hipnbb32.dll"	Nbmelbid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhidjpqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bchdhnom.dll"	Mpablkhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojgbfocc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohbkfake.dll"	Olfobjbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gododflk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbaipkbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ieolehop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpqiemge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apignbdf.dll"	Ffkjlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fhjfhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgilhm32.dll"	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibihdfhm.dll"	Qgallfcq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpqiemge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhoholen.dll"	Eekaebcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcinbcgc.dll"	Iehfdi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chghdqbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njkdbljm.dll"	Ecmeig32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

454856566f2fc7b9887ef16c27b59b70_NeikiAnalytics.exeNdghmo32.exeNkqpjidj.exeNjcpee32.exeNnolfdcn.exeNdidbn32.exeNbmelbid.exeNcnadk32.exeOndeac32.exeOdnnnnfe.exeObangb32.exeOdpjcm32.exeOkjbpglo.exeOdbgim32.exeOgaceh32.exeOnklabip.exeOdednmpm.exeOnmhgb32.exePkaiqf32.exePqnaim32.exePghieg32.exePbmncp32.exe

description	pid	process	target process
PID 2916 wrote to memory of 1520	2916	454856566f2fc7b9887ef16c27b59b70_NeikiAnalytics.exe	Ndghmo32.exe
PID 2916 wrote to memory of 1520	2916	454856566f2fc7b9887ef16c27b59b70_NeikiAnalytics.exe	Ndghmo32.exe
PID 2916 wrote to memory of 1520	2916	454856566f2fc7b9887ef16c27b59b70_NeikiAnalytics.exe	Ndghmo32.exe
PID 1520 wrote to memory of 2348	1520	Ndghmo32.exe	Nkqpjidj.exe
PID 1520 wrote to memory of 2348	1520	Ndghmo32.exe	Nkqpjidj.exe
PID 1520 wrote to memory of 2348	1520	Ndghmo32.exe	Nkqpjidj.exe
PID 2348 wrote to memory of 5096	2348	Nkqpjidj.exe	Njcpee32.exe
PID 2348 wrote to memory of 5096	2348	Nkqpjidj.exe	Njcpee32.exe
PID 2348 wrote to memory of 5096	2348	Nkqpjidj.exe	Njcpee32.exe
PID 5096 wrote to memory of 224	5096	Njcpee32.exe	Nnolfdcn.exe
PID 5096 wrote to memory of 224	5096	Njcpee32.exe	Nnolfdcn.exe
PID 5096 wrote to memory of 224	5096	Njcpee32.exe	Nnolfdcn.exe
PID 224 wrote to memory of 456	224	Nnolfdcn.exe	Ndidbn32.exe
PID 224 wrote to memory of 456	224	Nnolfdcn.exe	Ndidbn32.exe
PID 224 wrote to memory of 456	224	Nnolfdcn.exe	Ndidbn32.exe
PID 456 wrote to memory of 1676	456	Ndidbn32.exe	Nbmelbid.exe
PID 456 wrote to memory of 1676	456	Ndidbn32.exe	Nbmelbid.exe
PID 456 wrote to memory of 1676	456	Ndidbn32.exe	Nbmelbid.exe
PID 1676 wrote to memory of 4208	1676	Nbmelbid.exe	Ncnadk32.exe
PID 1676 wrote to memory of 4208	1676	Nbmelbid.exe	Ncnadk32.exe
PID 1676 wrote to memory of 4208	1676	Nbmelbid.exe	Ncnadk32.exe
PID 4208 wrote to memory of 1616	4208	Ncnadk32.exe	Ondeac32.exe
PID 4208 wrote to memory of 1616	4208	Ncnadk32.exe	Ondeac32.exe
PID 4208 wrote to memory of 1616	4208	Ncnadk32.exe	Ondeac32.exe
PID 1616 wrote to memory of 4952	1616	Ondeac32.exe	Odnnnnfe.exe
PID 1616 wrote to memory of 4952	1616	Ondeac32.exe	Odnnnnfe.exe
PID 1616 wrote to memory of 4952	1616	Ondeac32.exe	Odnnnnfe.exe
PID 4952 wrote to memory of 4988	4952	Odnnnnfe.exe	Obangb32.exe
PID 4952 wrote to memory of 4988	4952	Odnnnnfe.exe	Obangb32.exe
PID 4952 wrote to memory of 4988	4952	Odnnnnfe.exe	Obangb32.exe
PID 4988 wrote to memory of 2256	4988	Obangb32.exe	Odpjcm32.exe
PID 4988 wrote to memory of 2256	4988	Obangb32.exe	Odpjcm32.exe
PID 4988 wrote to memory of 2256	4988	Obangb32.exe	Odpjcm32.exe
PID 2256 wrote to memory of 3316	2256	Odpjcm32.exe	Okjbpglo.exe
PID 2256 wrote to memory of 3316	2256	Odpjcm32.exe	Okjbpglo.exe
PID 2256 wrote to memory of 3316	2256	Odpjcm32.exe	Okjbpglo.exe
PID 3316 wrote to memory of 4448	3316	Okjbpglo.exe	Odbgim32.exe
PID 3316 wrote to memory of 4448	3316	Okjbpglo.exe	Odbgim32.exe
PID 3316 wrote to memory of 4448	3316	Okjbpglo.exe	Odbgim32.exe
PID 4448 wrote to memory of 4904	4448	Odbgim32.exe	Ogaceh32.exe
PID 4448 wrote to memory of 4904	4448	Odbgim32.exe	Ogaceh32.exe
PID 4448 wrote to memory of 4904	4448	Odbgim32.exe	Ogaceh32.exe
PID 4904 wrote to memory of 760	4904	Ogaceh32.exe	Onklabip.exe
PID 4904 wrote to memory of 760	4904	Ogaceh32.exe	Onklabip.exe
PID 4904 wrote to memory of 760	4904	Ogaceh32.exe	Onklabip.exe
PID 760 wrote to memory of 988	760	Onklabip.exe	Odednmpm.exe
PID 760 wrote to memory of 988	760	Onklabip.exe	Odednmpm.exe
PID 760 wrote to memory of 988	760	Onklabip.exe	Odednmpm.exe
PID 988 wrote to memory of 2544	988	Odednmpm.exe	Onmhgb32.exe
PID 988 wrote to memory of 2544	988	Odednmpm.exe	Onmhgb32.exe
PID 988 wrote to memory of 2544	988	Odednmpm.exe	Onmhgb32.exe
PID 2544 wrote to memory of 800	2544	Onmhgb32.exe	Pkaiqf32.exe
PID 2544 wrote to memory of 800	2544	Onmhgb32.exe	Pkaiqf32.exe
PID 2544 wrote to memory of 800	2544	Onmhgb32.exe	Pkaiqf32.exe
PID 800 wrote to memory of 3300	800	Pkaiqf32.exe	Pqnaim32.exe
PID 800 wrote to memory of 3300	800	Pkaiqf32.exe	Pqnaim32.exe
PID 800 wrote to memory of 3300	800	Pkaiqf32.exe	Pqnaim32.exe
PID 3300 wrote to memory of 232	3300	Pqnaim32.exe	Pghieg32.exe
PID 3300 wrote to memory of 232	3300	Pqnaim32.exe	Pghieg32.exe
PID 3300 wrote to memory of 232	3300	Pqnaim32.exe	Pghieg32.exe
PID 232 wrote to memory of 2532	232	Pghieg32.exe	Pbmncp32.exe
PID 232 wrote to memory of 2532	232	Pghieg32.exe	Pbmncp32.exe
PID 232 wrote to memory of 2532	232	Pghieg32.exe	Pbmncp32.exe
PID 2532 wrote to memory of 3552	2532	Pbmncp32.exe	Pndohaqe.exe

C:\Users\Admin\AppData\Local\Temp\454856566f2fc7b9887ef16c27b59b70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\454856566f2fc7b9887ef16c27b59b70_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\SysWOW64\Ndghmo32.exe
  C:\Windows\system32\Ndghmo32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\Nkqpjidj.exe
    C:\Windows\system32\Nkqpjidj.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Windows\SysWOW64\Njcpee32.exe
      C:\Windows\system32\Njcpee32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5096
    - - C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:224
      - C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4208
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3316
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:988
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2544
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:800
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3300
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:232
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2532
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        23⤵
        Executes dropped EXE
        
        PID:3552
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        24⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3348
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        26⤵
        Executes dropped EXE
        
        PID:1940
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3944
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4920
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5000
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        30⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2664
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        32⤵
        Executes dropped EXE
        
        PID:2808
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2120
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        34⤵
        Executes dropped EXE
        
        PID:4268
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2080
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        36⤵
        Executes dropped EXE
        
        PID:676
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        37⤵
        Executes dropped EXE
        
        PID:4056
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        38⤵
        Executes dropped EXE
        
        PID:1368
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        39⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        40⤵
        Executes dropped EXE
        
        PID:4516
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        41⤵
        Executes dropped EXE
        
        PID:2764
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        42⤵
        Executes dropped EXE
        
        PID:4404
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        43⤵
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        44⤵
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1004
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4484
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        47⤵
        Executes dropped EXE
        
        PID:1756
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        48⤵
        Executes dropped EXE
        
        PID:2016
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        49⤵
        Executes dropped EXE
        
        PID:392
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1816
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        51⤵
        Executes dropped EXE
        
        PID:1532
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        52⤵
        Executes dropped EXE
        
        PID:4820
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1572
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3840
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4960
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        56⤵
        Executes dropped EXE
        
        PID:3948
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2940
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        58⤵
        Executes dropped EXE
        
        PID:3672
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:856
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        60⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3736
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        62⤵
        Executes dropped EXE
        
        PID:1544
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        63⤵
        Executes dropped EXE
        
        PID:2064
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2876
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        65⤵
        Executes dropped EXE
        
        PID:4948
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        66⤵
        Modifies registry class
        
        PID:4364
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        67⤵
        Drops file in System32 directory
        
        PID:1760
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        68⤵
        Modifies registry class
        
        PID:3932
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        69⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        70⤵
        Modifies registry class
        
        PID:3684
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        71⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        72⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        73⤵
        Modifies registry class
        
        PID:1268
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        74⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        75⤵
        Drops file in System32 directory
        
        PID:2516
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        76⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:744
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        78⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        79⤵
        Modifies registry class
        
        PID:2072
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        80⤵
        Modifies registry class
        
        PID:4908
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3796
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        82⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        83⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        84⤵
        Modifies registry class
        
        PID:1204
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        85⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        86⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        87⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        88⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        89⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5244
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5320
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        92⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        93⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5420
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        94⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        95⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        96⤵
        Drops file in System32 directory
        
        PID:5564
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        97⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        98⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5712
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        100⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        101⤵
        Drops file in System32 directory
        
        PID:5788
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        102⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        103⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        104⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        105⤵
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        106⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        107⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        108⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        110⤵
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        111⤵
        Drops file in System32 directory
        
        PID:5296
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        112⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        113⤵
        Drops file in System32 directory
        
        PID:5468
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        114⤵
        Drops file in System32 directory
        
        PID:5544
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        115⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        116⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5776
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        118⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        119⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        120⤵
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        121⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        122⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        123⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        124⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        125⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        126⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5772
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        128⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        129⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1680
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        131⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        132⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        133⤵
        Drops file in System32 directory
        
        PID:5640
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        134⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        135⤵
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        136⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        138⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        139⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5304
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        141⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        142⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        143⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        144⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        145⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        146⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        147⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6320
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        149⤵
        Modifies registry class
        
        PID:6384
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        150⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        151⤵
        Modifies registry class
        
        PID:6476
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        152⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        153⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        154⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        155⤵
        Modifies registry class
        
        PID:6652
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        156⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        157⤵
        Drops file in System32 directory
        
        PID:6740
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        158⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        159⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6880
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        161⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        162⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        163⤵
        Drops file in System32 directory
        
        PID:7012
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        164⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        165⤵
        Modifies registry class
        
        PID:7104
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7148
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        167⤵
        Drops file in System32 directory
        
        PID:6164
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        168⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        169⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        170⤵
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        171⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        172⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        173⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        174⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        175⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        176⤵
        Modifies registry class
        
        PID:6824
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        177⤵
        Drops file in System32 directory
        
        PID:6900
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        178⤵
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        179⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        180⤵
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6280
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        182⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        183⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6680
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        185⤵
        Drops file in System32 directory
        
        PID:6792
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        186⤵
        Drops file in System32 directory
        
        PID:6960
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6948
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        188⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        189⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        190⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        191⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        192⤵
        Drops file in System32 directory
        
        PID:6820
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        193⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        194⤵
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6660
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        196⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        197⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6328
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        198⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        199⤵
        Drops file in System32 directory
        
        PID:6528
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6232
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        201⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        202⤵
        Drops file in System32 directory
        
        PID:7256
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7300
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        204⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        205⤵
        Modifies registry class
        
        PID:7388
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        206⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        207⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        208⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7568
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        210⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        211⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7700
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        213⤵
        Drops file in System32 directory
        
        PID:7744
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        214⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        215⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        216⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        217⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        218⤵
        Drops file in System32 directory
        
        PID:7960
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8008
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        220⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        221⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        222⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        223⤵
        Modifies registry class
        
        PID:7176
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        224⤵
        Drops file in System32 directory
        
        PID:7220
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        225⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        226⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7360
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        227⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        228⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7560
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        230⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        231⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        232⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        233⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        234⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        235⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        236⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        237⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        238⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        239⤵
        Modifies registry class
        
        PID:7308
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        240⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        241⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7668
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        243⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        244⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        245⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        246⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8108
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        248⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        249⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        250⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7752
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7532
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        253⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        254⤵
        Modifies registry class
        
        PID:8088
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        255⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        256⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        257⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        258⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        259⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        260⤵
        Modifies registry class
        
        PID:7608
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        261⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7412
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        263⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        264⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7820
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        266⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8280
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8324
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        269⤵
        Modifies registry class
        
        PID:8368
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8408
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        271⤵
        Modifies registry class
        
        PID:8444
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        272⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        273⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        274⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        275⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        276⤵
        Modifies registry class
        
        PID:8668
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        277⤵
        Drops file in System32 directory
        
        PID:8712
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        278⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        279⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8844
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        281⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        282⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8976
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        284⤵
        Drops file in System32 directory
        
        PID:9024
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        285⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        286⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        287⤵
        Drops file in System32 directory
        
        PID:9204
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        288⤵
        Drops file in System32 directory
        
        PID:8232
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        289⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        290⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        291⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        292⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        293⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        294⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        295⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8740
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        297⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        298⤵
        Modifies registry class
        
        PID:8900
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        299⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        300⤵
        Modifies registry class
        
        PID:9056
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        301⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        302⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        303⤵
        Modifies registry class
        
        PID:8404
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        304⤵
        Modifies registry class
        
        PID:8528
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8636
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        306⤵
        Modifies registry class
        
        PID:6364
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        307⤵
        Drops file in System32 directory
        
        PID:1556
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8836
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        309⤵
        Modifies registry class
        
        PID:8964
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9092
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        311⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8516
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        313⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        314⤵
        Drops file in System32 directory
        
        PID:2136
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        315⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        316⤵
        Modifies registry class
        
        PID:9040
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        317⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        318⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8772
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        320⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        321⤵
        Modifies registry class
        
        PID:8432
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        322⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8708
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8912
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        324⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        325⤵
        Modifies registry class
        
        PID:8212
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        326⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3528
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        328⤵
        Drops file in System32 directory
        
        PID:9240
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        329⤵
        Drops file in System32 directory
        
        PID:9288
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        330⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9376
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        332⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        333⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        334⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        335⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        336⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        337⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        338⤵
        Drops file in System32 directory
        
        PID:9704
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        339⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        340⤵
        Drops file in System32 directory
        
        PID:9792
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        341⤵
        Drops file in System32 directory
        
        PID:9836
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        342⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        343⤵
        Modifies registry class
        
        PID:9940
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9984
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        345⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        346⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        347⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        348⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        349⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        350⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        351⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        352⤵
        Modifies registry class
        
        PID:9340
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9396
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        354⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        355⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        356⤵
        Modifies registry class
        
        PID:9664
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        357⤵
        Drops file in System32 directory
        
        PID:9736
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        358⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        359⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        360⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10016
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10084
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        363⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        364⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        365⤵
        Drops file in System32 directory
        
        PID:9300
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        366⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        367⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        368⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        369⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9864
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        371⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        372⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        373⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9348
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        375⤵
        Modifies registry class
        
        PID:9536
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        376⤵
        Drops file in System32 directory
        
        PID:1044
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        377⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        378⤵
        Modifies registry class
        
        PID:9768
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        379⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        380⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        381⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9540
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        383⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        384⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10136
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        386⤵
        Drops file in System32 directory
        
        PID:9404
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        387⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        388⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        389⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        390⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10180 -s 404
        391⤵
        Program crash
        
        PID:10256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 10180 -ip 10180
1⤵
PID:9584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Agffge32.exe

Filesize
182KB

MD5
05194c74eda4302a5af16bdcfa6d6349

SHA1
44829c0ab4afb8496b9684d05373bab1d8568925

SHA256
03157a57a577a5da56783fe22e74141b742321733847cbb948f912320448705a

SHA512
31b6bb83690e5cdcc2635f04f6514f424d20533184db82dd923540de16da51607405c110e89f4eb97835c60caf3897c53e351d732a8658653d6434fbc275cf3f

Download Submit
C:\Windows\SysWOW64\Banllbdn.exe

Filesize
182KB

MD5
5c8db8eeeff1405cb682a8ff3976e721

SHA1
979b026b7ed7631f47675524eb9ef270c0f9a255

SHA256
2d5eb626e7e5d9bf36b84371e1f65a6adb3d7ca89dca0a0e6f3a7b60f59e0375

SHA512
e2d3dbb2b27baab1a6580581d8e7cd374a56551e03fdf57108f48e28bf9859e5c00403acbf376686d4077b20c4d5c985e673b64b1878ba2061b56056d7dbb4db

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
182KB

MD5
fbbc8bd02f17bd9b859f22cd78ca575c

SHA1
8be3a449d9082b7a929d4d1a911705f546c32a50

SHA256
53ecb201aa470fc0137df23fbeecfb9a43a51fcf955bd95a04dc4f61bbbcbf78

SHA512
71126b1ebf66e3336e6f30c0baa012e20cc2281712187138464110f4106598de8b4b2fcb3f4acec584ccc8fa2bedc4cc7948cca724b206932df68db38d178288

Download Submit
C:\Windows\SysWOW64\Calhnpgn.exe

Filesize
182KB

MD5
2cf26e78d12e609694753d2122ed7c48

SHA1
e6dcbbacfbab2defc288bb0543d1d413cac3bf87

SHA256
cd6a26684360e3390bb2ac03924bb5343ce4d2d25acd5624593f38ce0fd96638

SHA512
25c2b77edd75c679e17b300f7c90e27897a986d38474cb2ade3aa60771034e94c82155c21cd9700850278d923700f3bb0e49030eddee76ebc6e206aaa3a8a0c5

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
182KB

MD5
a496a8732732694b209a2549d36ec67c

SHA1
8ca782d5baef5e78eac412239ced2e06ba3baec4

SHA256
3694b2a3d2c830425728c2750ed3dfea8b86b13d951f92c5eb7c6f61dc2c426d

SHA512
e577d56d91bd7ab7fd621c8a190c06b0286bfe02d009322d2d5a51d6d24fa4129ad67ac575267aee2ad1cf024fc558ccd0ee6f07b25a21e4c585b2354f183bf5

Download Submit
C:\Windows\SysWOW64\Eabbjc32.exe

Filesize
182KB

MD5
2ff3ddfd1eb72ed3977db12d44663a0f

SHA1
aa70d65135bfe1e3805414da9aa82d07f1d2a127

SHA256
5e43a09d822ff335a7b1ebb596c817e661b3534c269671860fe00f69efe230b9

SHA512
58a70f143faf97b83bcbcfdeffb9b09b944e75a31e16a66bad74438f7801aec637bc9bde4399e37301b6a7880a6875b5d075fb3d988dca0e335e7abc5fa2a590

Download Submit
C:\Windows\SysWOW64\Eadopc32.exe

Filesize
182KB

MD5
8f1457ff0361dacd2d3da7c1f8c69060

SHA1
2e5863e9f1284a9d3e89b80cc78ca15abdb59f36

SHA256
174a7437491c0962930614c06c438992519bfad3755803ec8be5557bcd4b8794

SHA512
cff902c59147c92bbbe0872ca4a2a2e43b89218f0a976e01a21979e7e7e0c44573dc11e3936e8903befae29b7c9a30265d649c8582b3e5e34015dff27dcd818b

Download Submit
C:\Windows\SysWOW64\Edkdkplj.exe

Filesize
182KB

MD5
138c129f96cea97a5e80554039bc9ddf

SHA1
ed995758d442b0f4dbf837c0722fb4e033531ec9

SHA256
5f4cf3e1783244574c1dac915bea5d2b60361d7c7b5b5f82c7ee798f56477809

SHA512
60667783fa1f0cb913e636342128cd61ad02cc1ac9fae6b3d2f6bf96b2b38f46b71ac73c6a28a82ee64d5daeff92036b5ade01887c15b06df9b4d81e0bd27e8c

Download Submit
C:\Windows\SysWOW64\Fdlnbm32.exe

Filesize
182KB

MD5
e146e0c128e129fab059d5faed58d41a

SHA1
35671670e86bf389b54af172e8500a93dace1f8b

SHA256
e1cb20aee60698904cdd12946b57a66905730b1ed51865060294667d1e0f4da1

SHA512
4cd168376eae421f0d95c2a4f8e3da4171f1919c2745b162ab195f23e06e9a64081e2324d18afe4a19a6842d5fd87be34cf176a05e5df32c87a7b89effb6f1a6

Download Submit
C:\Windows\SysWOW64\Hfcicmqp.exe

Filesize
182KB

MD5
dedfec1cd28d9a43fc653fa004dffd20

SHA1
ac1d0463cb7ed18abb73c175142af81f862b9446

SHA256
f9127708d7172802772addc467bce0b580929ca679b10e038f35553fb82ed500

SHA512
7c2822c393e26083c68a19ff862e923165c159d67e1e8e87bcb3badc6fe4e9aabef74da533c80d23e9bdd1aaa76d34d5466bb88ba2868dee2c531a1a51995bec

Download Submit
C:\Windows\SysWOW64\Hihbijhn.exe

Filesize
182KB

MD5
79515f642b43cdf02fa1be684bc34474

SHA1
cd2f21fe344ef87283edf5b7bd9a2673d089177b

SHA256
6b0efb95162f4ed111f89df2b899021470bed4d12eedff79b7237938074fb925

SHA512
29d40661720aa16cdad8cd6411d52f6cea3aa8be5441f4289eb6181d79013dff407780484644234112ffe2558a9f8c22c537275a414b26055e93f535fca95bbc

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
182KB

MD5
069035b031b933ef56667341193cebc5

SHA1
c999f814e6abba2df8885769ec790f440d9449b3

SHA256
c1071663879daab9416492c4dde9485ff8fb6e5866f4c8b773efe6fbd9cefb78

SHA512
9ffa55cdbf5d9cb108dc3c6e80bf40cf5df21c5efab42df9e43565b3f3bc3e17a5c0a43339974526ee05fd233835b8467c675af906420d280862a6f72c28fff8

Download Submit
C:\Windows\SysWOW64\Icplcpgo.exe

Filesize
182KB

MD5
29d86a655fcce57ca10a953887fee81c

SHA1
e3f3982aa517da595e3d324c356f8dde4e88f226

SHA256
36d486727de075f99eaf7c101a573bc71e4b924679aa52e8da42fa70fac382bb

SHA512
715057b9fcd2ddcb2a07ebf74dc58ac5f91daaf247a0dd3080a69e1238b03a1fff320f22774c6389b71e859c67fd99a1a2e9c23e4aaa4c6129d2703bbf409f0d

Download Submit
C:\Windows\SysWOW64\Jbeidl32.exe

Filesize
182KB

MD5
02ed9cd9f481beb66899cc82d3aa578e

SHA1
86de18ab73e10c5a1f81bd40ef19d91282f5e32f

SHA256
846aaa33c015f5f239850aa30f763e778f52f5f4cc2c1fd40a4d85c8eba0ced4

SHA512
43503e9240108c799797825ba15f89d02f787323ebe7e1738b33cf74352ea923f59b1dbafc77272bd737b644486af2fbaed0b20457aa08aaec50b27eeb53e8a3

Download Submit
C:\Windows\SysWOW64\Jmhale32.exe

Filesize
182KB

MD5
4a548ea5b17534f0fde18a615603c6a8

SHA1
216bc5c0b4a0886e326067cba41f3b9dee256d33

SHA256
4a96a3d08fe1886b66762c80843c4e993a47ba3f92fc3b09a50b53d40b7eb14d

SHA512
e12ae5b712c04c104880738badb77bba607e673fa55c9eb36d7890d6e1a301eef9e5d6c05c57dec356d41229bee3abd0b891c7544d0b922055e1f3622d0576b1

Download Submit
C:\Windows\SysWOW64\Kibgmdcn.exe

Filesize
182KB

MD5
95cfe30537a1a52395fb5ddba1178b67

SHA1
468c4c8b831ef83f6ea9e6249a34a87596177f8a

SHA256
9258244c58036cbdb652b3bbd05b0e97362778fa30b5602c12432a55ffac987b

SHA512
99e8d5cc56f9ae0e4ce71461b38d682b9f5ecd1a55bdee58842db5006a8b19b6d0f879c2c23695bec84f3467d2c0a00aca979480e7ac2bdbfdef101b57f4ff64

Download Submit
C:\Windows\SysWOW64\Kmijbcpl.exe

Filesize
182KB

MD5
b1a6729bb57ed9e558c157f9d6de96cc

SHA1
0cba839fbec62705fc409613794cabc8d1b6d145

SHA256
26061d25f51a707f774c70a249bc3866fca93488d4a4a426023ec46253410210

SHA512
4768f5c90303e4a74f6099e00b0d0d327e56d0b3ce91472159295be38fd116e2d21ab2f365a142353dea56ec6cae94d3d9b5c66824098c1605584d4477612fcc

Download Submit
C:\Windows\SysWOW64\Lmbmibhb.exe

Filesize
182KB

MD5
26ae6e5b6b96733a14b48ee15207098c

SHA1
1d00c9139a37d4e8b961bd41619f796ccac9c80d

SHA256
c4b473f0ee486740da058ab668290ec66a4133016445ba72e94949658a463499

SHA512
7c4712efc2ffaa2887eb8cf94439b4c59d04044ace993a9bc9a499df1297cdd89ddc46035de35ee1ffe70ae2e6d97052e0c96942d979a570742cc2748f3ad0d9

Download Submit
C:\Windows\SysWOW64\Megdccmb.exe

Filesize
182KB

MD5
69911b52fd404a41a18e9e020df6ba89

SHA1
657fdeaf1c6f9e84258f35fb1865eec41103e6df

SHA256
304fd907d1f749684efed956454f07223635774c5f47eb6c0ee5620cf2e7c8ce

SHA512
23bc20477be11b1a6b550b8154e46ef0e90bac04593b946ef0d0b2506294cbfb5c688d261c5a6d6cbc05c066d3bc21efebd15057bfdd4b3a59098918e87056a6

Download Submit
C:\Windows\SysWOW64\Nbmelbid.exe

Filesize
182KB

MD5
604872af20d013989fe02c9e91467477

SHA1
a40903914445a36f9c4d8f6853017bf34ff6ae84

SHA256
751339bfa8463ee24b32b2591f276a1fab08b30e81c2c40e2d64838b7ca9c5cc

SHA512
eaabb169eceb808df13156fe3095b4848e5cba0f973430380327795b469fce57895cdd0df84a434bb9a5591c04f70f22cdd008a90fc125beb8bcfc3a8c5c285c

Download Submit
C:\Windows\SysWOW64\Ncnadk32.exe

Filesize
182KB

MD5
ed8dc5bb453a33ed1e3d3c771b47cdb0

SHA1
44316d47c6c25f2f131648febc51e6a1760df339

SHA256
2a401ee123ddf79591fef81df7d1dc65bd722d9402b55459c0f7ea80ae364943

SHA512
0587f62f27daa6d27eb94758e5e4959bddd8f1e587b9cd32f9ad5925f0653e0c5ba6632b5682fc1be31c0b1bf7d140e15f88041fe85815419bc2a6eeecdad527

Download Submit
C:\Windows\SysWOW64\Ndghmo32.exe

Filesize
182KB

MD5
c7cac6e209da0622b8e26357908d3f2f

SHA1
b62ebb89f38feca1cb35c847b4ada2a9b041199b

SHA256
04e4977058695fb26a5477aa75911003648576a065195a68dad32498cefd4d5b

SHA512
229ed536afdfefc1e6835608d8a27ef297852ae5c91d428bddee797a1f3e9ae274b3f80e67b1f50b38526cfc26a345e6f44f3a59f645c910a2c604b3c90d4b24

Download Submit
C:\Windows\SysWOW64\Ndidbn32.exe

Filesize
182KB

MD5
23e2118559e4f5caa8cc241d91984709

SHA1
edf494df3b0310f02fc9d22e04103d78db5a4928

SHA256
57494e9b5437fc29c69d20e7861b96eaf4365ceb4a6d1ecae7bc37bf9bece28b

SHA512
94d8da670da35145b2c2c2bf5726102f0e0429c8f6b930a425cccb91f69ecb372ba286474ef1f92c242ad788f42a8a7eddb83e19b5fbe36dd5ebf5ee3dd69f5e

Download Submit
C:\Windows\SysWOW64\Njcpee32.exe

Filesize
182KB

MD5
879e61b9ccae67c1cf8ce1d99d681bb6

SHA1
bceffc3bdd71c4804483062e1f75dece0f86ee68

SHA256
2ddcbc299d0d23f9a4f052e9e1df30824e9ad16513b94516c2ecb702303547c8

SHA512
84e00cbba1ee0032b5ed17214e385ba71855ac3ea686913186ed74bfd21bce1cc9c8b91fcdbc9916e498e6e6bd255cd38b072d40670f9f6d1f049bea1f26a66b

Download Submit
C:\Windows\SysWOW64\Nkqpjidj.exe

Filesize
182KB

MD5
d6a4fdf9763241500641718c64f89972

SHA1
ffbdc8acf8178f9f618b250a37e30ce9f6027687

SHA256
8279b46bfaaf5daee46a13ed09f1e5f83310b06c83282b864cf3f86314c070f6

SHA512
890093dc06ea9e0321d79917929ce62ff8a687f510c071e5464574a84fd9c9b9584be834d522100d36691e92b70b361521417de7f751471aa343903dd4692852

Download Submit
C:\Windows\SysWOW64\Nnolfdcn.exe

Filesize
182KB

MD5
eaededabc0e0772e2815db74bd1e18de

SHA1
288c969088359d501ff756c1f41de313f75a7f9b

SHA256
d5af978e925635921b11860083fd5cce0f126bfacc1efcd89a1e3f0005c7f3d3

SHA512
ed3e8014dd909cdba140a69ade66aa71b486163cfa9d324fed400365d02e393f8b5399ef7a238992b6fbd097875fbcb3d9650cf1ba211565b16f1d69e4e85191

Download Submit
C:\Windows\SysWOW64\Obangb32.exe

Filesize
182KB

MD5
250b80ac8945d59a666edfc66183cef9

SHA1
8a390a74e9b78d059e7d2a71b88b0ae8c5e7e104

SHA256
bc5323f2534140a14267c5969f480ff788803e8316d319fdf500a8ad34f16e5d

SHA512
09a9ae3e1cafbbb8940170fdf61321cdb3cee1d060ed8d2648d6e98e6d4c499a200162a6f2d27851c366875b4546bf061900bf598a5533554dea675aa2398ec8

Download Submit
C:\Windows\SysWOW64\Odbgim32.exe

Filesize
182KB

MD5
adb169b42272991e3a0fcc6514e30676

SHA1
77f6970bd21013466b59366c6aab346b323e3e9a

SHA256
fead110a28ca7aea6e8cfd374b2fbf58f1d15ab161013d2142904ff30b8a3f1d

SHA512
d39eaa7186d2faa52850f67cc09e3d608f40a5c815672bf973f3e56734e1f70621b6454b41b7a16046720c42a4a24df7e49328774dcff13fc60812d0d446b2f0

Download Submit
C:\Windows\SysWOW64\Odednmpm.exe

Filesize
182KB

MD5
f45dc78301ce25cc37a3ac9239026d42

SHA1
c97012a1ecc38c2d8553bf463605fff1040e6e39

SHA256
9698048bc2f3b0b98aebcf996e76c0d8070432255963b4daa2873b9a1eb02b28

SHA512
fd78a5307ff3238b48185a3397b0a7a2a5056b4d710fdcb97be66791409e1753ac651af57eea0b20b179f4bbf2dac52a880f3f890cc197d4e7e47d39a5d13c6e

Download Submit
C:\Windows\SysWOW64\Odnnnnfe.exe

Filesize
182KB

MD5
4858a77c1957374464cdb1e42e814b42

SHA1
8370e7d579b6e71f8598e708f9a64616a94a7c51

SHA256
b467600785ece591446a69d2dce47830982acec7832839bd6df4ff3eba4dcdcb

SHA512
34fe0e6cc140c1121d5e3981e6c42d3926e203f14173e75aeda6d3489004df396e9fa5e0ac8c3dfe40e301a51e8f536e01b49be1b563a48a69e6438e5b2ce562

Download Submit
C:\Windows\SysWOW64\Odpjcm32.exe

Filesize
182KB

MD5
cba7bfd1c8ac287b0daff68d1b93a713

SHA1
7eeb3cd91d5ca872b5a184a67832bf10c44a75a8

SHA256
080edab55b6e0e7ceb73474ba9a8eabbecbf1bf30bf39c12ead1a50d9e634594

SHA512
258e7f1b51e2a72e9a2a4934449ea9acaeed1f0d4b89a4eb6a21e924b1cffd0b31873f64ed417f5ea80e25f50ffe0bfdab78db0deb14b8bd54ce319d969231d7

Download Submit
C:\Windows\SysWOW64\Ogaceh32.exe

Filesize
182KB

MD5
2c5ce680027b59868a09860886939d4e

SHA1
48184d21d40e5d26982ff148d309f6f4345632d8

SHA256
4cc79286a17f89f6d737a1a60990740bdeee2fc54e31768135cd0775d3a139e9

SHA512
af49e0891e3547d35ebb46511f8174037a60eeb2ccfdff6bc8e818f702ba3d0b213675816bc058f6b54317d3a9cac4cb84f660bb41085fdec534430f7ec0d5ac

Download Submit
C:\Windows\SysWOW64\Ogkcpbam.exe

Filesize
182KB

MD5
88d5b7b8ddd3726a0abb6a390a12bbbf

SHA1
7618cdce7f5b2c8e94f7e8f73c706401dd7ab481

SHA256
cb2f2481a24b033a08619341fb241f76df4e40ae8ce8fe4691e9a48e90358cec

SHA512
7b557ec0668c04e3831310bdc1774543c24c8bd50d5e9324d598d9e5a092bd22ba8bc60ea1970353a86f2e1a70c492e7c1de33a053860c1480cc8ab17f40a979

Download Submit
C:\Windows\SysWOW64\Okjbpglo.exe

Filesize
182KB

MD5
7741f6899f2bd7a98c5972d8150c546d

SHA1
39d92e1f37e3f41a98d59541be7285a66db8bf68

SHA256
d0da755b7f30f6710dc746faf063b6631fdfb44fe7c14dc4dc640660c0bb50cc

SHA512
e2bad694a854f754c90c6e03b2b1cbcde8433bd10fb2d68ed53698e10f5cd0f9c68d5f2dc00b7bd61ca7f2351868df9bc40dedda22301804c0e6e94ea3bb3fe8

Download Submit
C:\Windows\SysWOW64\Ondeac32.exe

Filesize
182KB

MD5
1bec2875737ce8d545a8a78a20508d87

SHA1
4296ac8c3cc4edcb1d6918a88cb63e83e7db71b6

SHA256
d8cacab23f35a5dedfed462a93c825a116e6c809a09a958c651f2bb68979fcad

SHA512
a2c419308f36ec64a4c80a21bf640f710547823218470feaa4bfae77a053d7709f791d74cb677de3f6f8f6803c3c47d682a670b7a05dc03aa7e2e8df10f1e013

Download Submit
C:\Windows\SysWOW64\Onklabip.exe

Filesize
182KB

MD5
e78f61bf992c55db1b433ffb32bf1fb7

SHA1
b228cbd4ac90b4cc0beed1dcae4457c282584c7a

SHA256
02023e7c1e0947c6092511887608ed195be55b8aeeaef472927f70da1b229841

SHA512
959cde1bef30b1b140eeb2d5ef0aeff2ff1a31b709e38a73903103c63932da281e3a5f61412562155efc1a2da5ce32197b2eccb3fb4a7d21b28ebd2a7299b11a

Download Submit
C:\Windows\SysWOW64\Onmhgb32.exe

Filesize
182KB

MD5
a2b8dbfc9566ec484d42d3f007d1bc31

SHA1
a97f697302d3b2f3c230cf37d018b9b6c1ebfb22

SHA256
1f8fa7e7b778019eaeca449d41c69dddc727fbad37d8ba1b9f2350d8c37aac41

SHA512
e40e74f2d8f6b6a56a37c40392bc3b3193a65d7e6e3b7bc57e200dea8846437a6c116dd603240d70550be2b3f8fc9fa62c70862fc07c854f8334247e54a7fe36

Download Submit
C:\Windows\SysWOW64\Opdghh32.exe

Filesize
182KB

MD5
2ddd6e7803da8eba8e1814da47c557c3

SHA1
0c2007959c12e8be7c700b88bfa92f4753805a04

SHA256
9cc7491498ec8170aa28de300ccf7e07b5f31dc2a58bd63cdafe3044b43e319d

SHA512
31877a9127838cdf5e129cd8b15c8fae0ba26f5f2415f9095ad1bec92ab73258956371cbe5fb0115956304c972868be257972ab09f2b24695cb5c0e1a85c1af5

Download Submit
C:\Windows\SysWOW64\Pabkdmpi.exe

Filesize
182KB

MD5
08b5d06a18f5ed1e5f3c2997783d8406

SHA1
8babbdbd1c2dea158c8d03552fc79796c7ffd5fa

SHA256
8820d7b316109a0a863d6254980d5c65484cdfe1d95a53a72d35d078bd5b2da9

SHA512
d14b63db9e5e8fd67787d52fcafc937eb3f21a434518121280577c7b3fa9a1db08dd6b9ef5cf5f456ff12f2fd006068c840a37bca6ef16873f7a7e3ac68c4703

Download Submit
C:\Windows\SysWOW64\Pbmncp32.exe

Filesize
182KB

MD5
b5d5bd4217d4b309272c2830543930c9

SHA1
cc384e973781e26b2c5edf8db21c52a581b82b79

SHA256
715d18b9fec26d8768a9adda3aa9fb5fe0c69496da9649ff7171ea3e49705309

SHA512
9ff68a2d514a603dba14b56224abf7ac39656d0439620125b51e052a1da21d2381316e16ce88334266021a963e586ff5e4b1e78c3004f6a1b843f82b665070d1

Download Submit
C:\Windows\SysWOW64\Pdpmpdbd.exe

Filesize
182KB

MD5
664bb196e291b16ecb297acf4d3b2a72

SHA1
c31a38c06287bda5184442f562574da7faa9fd01

SHA256
7521d4d849e661ce5e004df4e2d6981e61c4e3fc8cab76eb6437fa2be087a565

SHA512
674fc4ab4b260e495b42e306b2b96b70109aa333fccfa4912e6c48fffe79cfed0b54632264fce92cd6a83db7eb93d73db86aca487f19dfdedcacdf85d78d18f2

Download Submit
C:\Windows\SysWOW64\Peqcjkfp.exe

Filesize
182KB

MD5
9b4459dfb92f74825758be719499941b

SHA1
553f424c0379260389977f0d5362f9f4afc6c9e3

SHA256
c546e746aa3c56b5a938c6754c77e5e91b63ab6358675176b08fae120379792a

SHA512
4f11a7877cc31cef63ef2ba64ac877feb90fa6fadc3a7cee02941007f5ffb3db2d838ea022dbf6d5ed03b7efb972f7e423faadfdae053286c5c814b2f257c502

Download Submit
C:\Windows\SysWOW64\Pghieg32.exe

Filesize
182KB

MD5
d7354717e97d535b3c7a31d1f620957f

SHA1
a0973af881de51b453ea55f63da0054810b52951

SHA256
731765307432f4084ab04fe4031310661a3a22fcf3a0d961c4f27487c020158c

SHA512
92b97299c522cd3c064ebadfc309d961fe906a3ac57bfea24815aea7ecd35c276d61c8eab6de712db3378f3a8a25027ba6b8c3088549baeee3aaadca20c981c0

Download Submit
C:\Windows\SysWOW64\Pjkombfj.exe

Filesize
182KB

MD5
5b218c1e9e728def03e63a7ed3abd735

SHA1
0a0e5aad29d5e9aec4044e7676e588b8d3455157

SHA256
e8a3c047587a763d35efd0637a57ae5935eb52aa86a7fb098b8229533b5f805a

SHA512
a64ee4854eda942d3c59f1bb85bad9a7d2aa03e0d33a6b0380de0d094bf4efeb0f7c5e1defdd2e0de528bf0da0fb1f946e3edb9bc46ce0d7a8f4833fb45d61fa

Download Submit
C:\Windows\SysWOW64\Pjmlbbdg.exe

Filesize
182KB

MD5
a479db420ce91f4e3f408ac9234b71a6

SHA1
361c2bd0470a409e5b128bc012b4321471ab9ffc

SHA256
2fcdf7b7ff912efe8f9b5c9ba83d2c0ac2326fb3f10c7dad81f425dd54829e14

SHA512
0f8fca66eae27b59a1a1d8f607e300f921fbff097dd917b9090e1358531201603690d5f6b940d2361c1d7e5d9ef22ccc7895ffb1b9354e43a82d97a8a4d5f187

Download Submit
C:\Windows\SysWOW64\Pkaiqf32.exe

Filesize
182KB

MD5
406a7466967f0da294c5b273ab84aa89

SHA1
b7cb6eb31b393f731ae63c389f7586cacc2924bb

SHA256
b74c5769da6abf505b5a2a50eb2b9533ff6ebfc9663140fe250f1c9f14a0f00a

SHA512
734812f7f6db1511d29e980994465104e8ce277d682452f90e19b22aaec86f575d613aab55bc4168bdfbe05f6b4c4c62a97bc457741267cdac1419e665cd17b0

Download Submit
C:\Windows\SysWOW64\Pmoahijl.exe

Filesize
182KB

MD5
54bdee04d14c93e9c9d9a26beeef6195

SHA1
1940463784c6272bf9fc77dacd48367bcac582a8

SHA256
1c7a9745d85343e6d51a77391e19c0342e9fa3d21e15374e9165f3f9276eb9bb

SHA512
2f6effb6efe5c8b57325610c74db9c383df328815978affa40eacee60cc3546c41863a018b24a05b44bde5c8457407f724b6046161c53d5191d587ca2116785b

Download Submit
C:\Windows\SysWOW64\Pndohaqe.exe

Filesize
182KB

MD5
a7e7a2040d4c9e2d6b15d61a65e8f355

SHA1
5b601efeb227efe4fe76391e8720e88a52c9149c

SHA256
eb49e31f723761dfd6c44fc04b5553983faf39ea994f73f6acb983947ba73e29

SHA512
d49b61a172976b24b50c55491d23fb7d93ca2527b9137093535c4b2379b855f1cb56c0f1480a03063b3b4caf9dbd8bd92ce10332b03740e2c17d2205c6042852

Download Submit
C:\Windows\SysWOW64\Pqnaim32.exe

Filesize
182KB

MD5
83635c33b42b503553fe51e839021b2a

SHA1
51ac9c9ce2dcd73dbd80f51fc5d2cd0759e1d449

SHA256
615857a2e7a7ebd0975de8efe68fe022ddaffc3822e56f8d60fdba2e636106ee

SHA512
07c2432cae55f77377c1dc69dbb8a8e233bff0e4e1c4dd7ea7ecfce386d65e166c8ed9ffa5d5ec21de5cc04bfa1ad51896c17bf2dd3d959d439f22946f190c27

Download Submit
C:\Windows\SysWOW64\Qajadlja.exe

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\SysWOW64\Qajadlja.exe

Filesize
182KB

MD5
3d5277ed9d1c6b0abd0aacfec2fe7933

SHA1
5b2faabc5cddfaa02738e8ee8e118521674718f9

SHA256
c0ba5812a8823c1523f0d64a47ab1df672f28eea7cd4c4937e11285040279a28

SHA512
ddc275c1f5c6bddf0b78aa9e88555a71f9daae970afe5552c99d3940c2e7f83bfd54615e2e6c2d7ab6213023b61d04b5e4b05dd0db4d562e9a6b7e2cef0ce7d4

Download Submit
C:\Windows\SysWOW64\Qbimoo32.exe

Filesize
182KB

MD5
4c0bbb0ffc5ee09d4f79049570e6c7a7

SHA1
a293afc91d38200e4ac78e5e3e040eafcccbac06

SHA256
70298f5dfa330cf2b6ce7ed903837ac66f6dd3ffbc6e692dda15ae4c0709c36e

SHA512
04fdff5ee634750ee41c7335e38dde4d1009cbd93d6693b877f8f4556a4c4f2dfcac3f6259417f1c2499b5d818bdaf3ca2bf5d5d42371b907e97221112e68835

Download Submit
C:\Windows\SysWOW64\Qecppkdm.exe

Filesize
182KB

MD5
34aad51420b68739fc3866248bc56478

SHA1
ec2c57257398ed82490c47c298d31a783d7ff45f

SHA256
1caae6527fb528bab35922dafa0f1ccb3d85691627ea6b190f5b9be6c5d7da83

SHA512
a5c3714d043e02e6c9ee6b496656f9109cf535d9cd594f059d000c507c4e6e20ab698baba00a1f09fc96baf59a348b95d33d5529077ddae987903c014d433b50

Download Submit
C:\Windows\SysWOW64\Qgallfcq.exe

Filesize
182KB

MD5
01892dd17fea253ccddb0d36e7c8b5c3

SHA1
2ca69c54fc512e6235f268ab988f26629b500166

SHA256
b80224faa8a4ab47fd40093c404793523540887e196ae186be2574809d0daaf1

SHA512
96abc72a6449f367c5598f89c34f5bd247049051f68deaebe32401d9e4a0d9dc26b7a04da6bf11dc3ce11ba69751c5ba73c8e74eb7e7623d11c7e8a37b4c4a66

Download Submit
C:\Windows\SysWOW64\Qloebdig.exe

Filesize
182KB

MD5
f445a40b83d2839012c69f23199819e0

SHA1
25d698204bd659504e62d203699755c8ec5e28a5

SHA256
02c083f98f8253aa4b8cf4ff2b8117b92765a3df7be8ac97c6519ed54fc3b20a

SHA512
79e8fb8b6310c0331d188d7cbfb218af9b24f4cc5e656c540455be2ecbb31ba8afbda769de68c520e73b92ce6d7b8bd693874825973918422f380fcc4d41b553

Download Submit
memory/224-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/224-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/232-173-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/232-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/392-387-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/456-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/456-122-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/676-296-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/676-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/760-212-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/760-124-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/800-238-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/800-150-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/988-220-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/988-133-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1004-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1004-427-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1368-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1368-379-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1520-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1532-405-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1572-414-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1616-149-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1616-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1676-132-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1676-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1756-373-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1816-398-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1940-213-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1940-295-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2016-380-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2080-289-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2080-358-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2120-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2120-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2256-94-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2348-21-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2532-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2532-266-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2544-229-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2544-142-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2664-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2664-330-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2764-404-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2764-331-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2808-337-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2808-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2916-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2916-2-0x0000000000431000-0x0000000000432000-memory.dmp

Filesize
4KB

Download
memory/2916-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3300-159-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3300-247-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3316-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3316-189-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3348-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3348-204-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3552-190-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3840-421-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3944-302-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3944-221-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4056-372-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4056-303-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4208-141-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4208-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4268-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4268-351-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4344-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4344-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4404-338-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4404-411-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4448-194-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4448-106-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4472-386-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4472-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4484-434-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4484-370-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4516-397-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4516-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4584-349-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4776-195-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4776-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4788-352-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4788-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4820-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4904-114-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4904-203-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4920-309-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4920-230-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4952-158-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4952-74-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4960-428-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4988-168-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4988-82-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5000-239-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5000-316-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5096-29-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10136-2765-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download