ae81a0c11f47c09e516033abe2a91aae7fe8c7bce40bca6f99209523ca839052

Analysis

max time kernel
97s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2023 16:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.b449582835352007eb36de4a2a03f448.exe
Size

400KB
MD5

b449582835352007eb36de4a2a03f448
SHA1

a4d934aa30da9816cf594abb8f32540e5e89a7f0
SHA256

ae81a0c11f47c09e516033abe2a91aae7fe8c7bce40bca6f99209523ca839052
SHA512

44ebc5c3aac349d6c423d0efdc93ca2c3892f227e69af6ea332f1016e8f8997ccaf992460fb754cd09b36088160e219a9f33485becbc6ae270c936a4245f1d6f
SSDEEP

12288:HXmdrxUtyWUedCv2EpV6yYPaNFZpV6yYPo:wrxFWUSAWQZWo

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bffcpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmphaaln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dokgdkeh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajdbac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pciqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nhbfff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oocddono.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhpfqcln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bkobmnka.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jikoopij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjidgkog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Leadnm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbfldf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kggcnoic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aajohjon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nahgoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oihmedma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Molelb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hpqldc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojcpdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pciqnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chlflabp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgiaemic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpphjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbaclegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ckdkhq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Blhpqhlh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nciopppp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apggckbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Iamamcop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kcejco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahkih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eiekog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hlambk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cofecami.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Boeebnhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pomgjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jimldogg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkkgpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Moaogand.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Difpmfna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ipjoja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njgqhicg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgfbbb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	NEAS.b449582835352007eb36de4a2a03f448.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anclbkbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nciopppp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmnhcb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banjnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Banjnm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdolgfbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nlkngo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jlobkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Niojoeel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dnljkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dpbdopck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gpecbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aekddhcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bebjdgmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmohno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibfnqmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nflkbanj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dncpkjoc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhcjqinf.exe

Executes dropped EXE 64 IoCs

pid	Process
4644	Leadnm32.exe
3140	Miomdk32.exe
4128	Molelb32.exe
3748	Moobbb32.exe
1032	Moaogand.exe
692	Npchgdcd.exe
2952	Nohehq32.exe
3136	Nhbfff32.exe
3504	Nchjdo32.exe
3956	Nookip32.exe
4888	Oekpkigo.exe
3188	Oocddono.exe
2452	Oofaiokl.exe
4660	Opemca32.exe
3144	Pedbahod.exe
1580	Pomgjn32.exe
3768	Plagcbdn.exe
4820	Pcmlfl32.exe
928	Pleaoa32.exe
4912	Qcbfakec.exe
4748	Qlmgopjq.exe
4092	Afelhf32.exe
1696	Aqmlknnd.exe
892	Lihpif32.exe
2224	Lndham32.exe
5096	Ljkifn32.exe
4440	Mbenmk32.exe
3204	Mhafeb32.exe
3996	Majjng32.exe
4020	Mehcdfch.exe
2804	Mnphmkji.exe
2836	Mejpje32.exe
1672	Nbqmiinl.exe
3376	Nafjjf32.exe
1844	Nlkngo32.exe
944	Nahgoe32.exe
1748	Nlnkmnah.exe
5052	Nbgcih32.exe
4828	Nlphbnoe.exe
1584	Oampjeml.exe
1028	Oifeab32.exe
3192	Oldamm32.exe
1180	Oemefcap.exe
4936	Obafpg32.exe
4264	Ajggomog.exe
4564	Aleckinj.exe
4000	Abbkcpma.exe
1096	Blhpqhlh.exe
4812	Bljlfh32.exe
3472	Bhcjqinf.exe
1516	Bombmcec.exe
4840	Bkdcbd32.exe
984	Bckkca32.exe
1716	Cmcolgbj.exe
4968	Cbphdn32.exe
4608	Cmflbf32.exe
2732	Cbbdjm32.exe
4156	Cofecami.exe
3948	Cioilg32.exe
4412	Coiaiakf.exe
3728	Cjnffjkl.exe
4636	Dbjkkl32.exe
688	Dpnkdq32.exe
4804	Difpmfna.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ehfomc32.dll	Jahqiaeb.exe
File opened for modification	C:\Windows\SysWOW64\Khiofk32.exe	Kpnjah32.exe
File created	C:\Windows\SysWOW64\Nchjdo32.exe	Nhbfff32.exe
File created	C:\Windows\SysWOW64\Nlphbnoe.exe	Nbgcih32.exe
File opened for modification	C:\Windows\SysWOW64\Bljlfh32.exe	Blhpqhlh.exe
File opened for modification	C:\Windows\SysWOW64\Coadnlnb.exe	Cdlqqcnl.exe
File created	C:\Windows\SysWOW64\Aidehpea.exe	Adgmoigj.exe
File created	C:\Windows\SysWOW64\Binhnomg.exe	Bdapehop.exe
File opened for modification	C:\Windows\SysWOW64\Biklho32.exe	Bbaclegm.exe
File opened for modification	C:\Windows\SysWOW64\Djelgied.exe	Dpphjp32.exe
File opened for modification	C:\Windows\SysWOW64\Lnmkfh32.exe	Lknojl32.exe
File opened for modification	C:\Windows\SysWOW64\Mmkkmc32.exe	Mkjnfkma.exe
File created	C:\Windows\SysWOW64\Jnblgj32.dll	Ckdkhq32.exe
File opened for modification	C:\Windows\SysWOW64\Pomgjn32.exe	Pedbahod.exe
File created	C:\Windows\SysWOW64\Hmlpaoaj.exe	Gbfldf32.exe
File created	C:\Windows\SysWOW64\Iekkfckg.dll	Kjepjkhf.exe
File opened for modification	C:\Windows\SysWOW64\Banjnm32.exe	Ajdbac32.exe
File created	C:\Windows\SysWOW64\Bhcjqinf.exe	Bljlfh32.exe
File created	C:\Windows\SysWOW64\Mkjnfkma.exe	Mccfdmmo.exe
File created	C:\Windows\SysWOW64\Pnbmhkia.dll	Apnndj32.exe
File created	C:\Windows\SysWOW64\Dpnkdq32.exe	Dbjkkl32.exe
File opened for modification	C:\Windows\SysWOW64\Difpmfna.exe	Dpnkdq32.exe
File created	C:\Windows\SysWOW64\Ccegpn32.dll	Dafppp32.exe
File created	C:\Windows\SysWOW64\Leadnm32.exe	NEAS.b449582835352007eb36de4a2a03f448.exe
File created	C:\Windows\SysWOW64\Lnnlhc32.dll	Giinpa32.exe
File opened for modification	C:\Windows\SysWOW64\Dnpdegjp.exe	Dmohno32.exe
File created	C:\Windows\SysWOW64\Eiekog32.exe	Dafppp32.exe
File created	C:\Windows\SysWOW64\Lhlgjo32.dll	Fklcgk32.exe
File created	C:\Windows\SysWOW64\Jcggmk32.dll	Fnjocf32.exe
File created	C:\Windows\SysWOW64\Fmhbagkn.dll	Moaogand.exe
File opened for modification	C:\Windows\SysWOW64\Hbhijepa.exe	Hmlpaoaj.exe
File created	C:\Windows\SysWOW64\Jlmfeg32.exe	Hmbfbn32.exe
File created	C:\Windows\SysWOW64\Dnpdegjp.exe	Dmohno32.exe
File opened for modification	C:\Windows\SysWOW64\Lhgkgijg.exe	Lckboblp.exe
File created	C:\Windows\SysWOW64\Fqbeoc32.exe	Fjhmbihg.exe
File created	C:\Windows\SysWOW64\Gghocf32.dll	Nlnkmnah.exe
File created	C:\Windows\SysWOW64\Gjpnoh32.dll	Npchgdcd.exe
File created	C:\Windows\SysWOW64\Adnipccc.dll	Gfmojenc.exe
File created	C:\Windows\SysWOW64\Ibfnqmpf.exe	Illfdc32.exe
File created	C:\Windows\SysWOW64\Pjphcf32.dll	Ocdnln32.exe
File created	C:\Windows\SysWOW64\Ncbafoge.exe	Nqaiecjd.exe
File opened for modification	C:\Windows\SysWOW64\Iamamcop.exe	Ilfennic.exe
File created	C:\Windows\SysWOW64\Mhafeb32.exe	Mbenmk32.exe
File created	C:\Windows\SysWOW64\Dpdaepai.exe	Dikihe32.exe
File created	C:\Windows\SysWOW64\Gedapeof.dll	Kkpbin32.exe
File opened for modification	C:\Windows\SysWOW64\Hmdlmg32.exe	Hfjdqmng.exe
File created	C:\Windows\SysWOW64\Fqdbdbna.exe	Fglnkm32.exe
File created	C:\Windows\SysWOW64\Bdcebook.dll	Anclbkbp.exe
File created	C:\Windows\SysWOW64\Icpjna32.dll	Ccppmc32.exe
File created	C:\Windows\SysWOW64\Gjpank32.dll	Bhkmec32.exe
File created	C:\Windows\SysWOW64\Jahqiaeb.exe	Jimldogg.exe
File created	C:\Windows\SysWOW64\Nciopppp.exe	Mcdeeq32.exe
File opened for modification	C:\Windows\SysWOW64\Gddgpqbe.exe	Fnjocf32.exe
File created	C:\Windows\SysWOW64\Qcbhah32.dll	Cnkkjh32.exe
File opened for modification	C:\Windows\SysWOW64\Ommceclc.exe	Ocdnln32.exe
File created	C:\Windows\SysWOW64\Gpkehj32.dll	Adgmoigj.exe
File opened for modification	C:\Windows\SysWOW64\Hpqldc32.exe	Dflfac32.exe
File created	C:\Windows\SysWOW64\Hjcbmgnb.dll	Ncbafoge.exe
File created	C:\Windows\SysWOW64\Ocgkan32.exe	Ommceclc.exe
File opened for modification	C:\Windows\SysWOW64\Ilfennic.exe	Hbgkei32.exe
File created	C:\Windows\SysWOW64\Fgiaemic.exe	Fdkdibjp.exe
File created	C:\Windows\SysWOW64\Headjohq.dll	Mbenmk32.exe
File opened for modification	C:\Windows\SysWOW64\Hfjdqmng.exe	Hpqldc32.exe
File created	C:\Windows\SysWOW64\Pencqe32.dll	Paihlpfi.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3368	2500	WerFault.exe	365

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oflpld32.dll"	Oifeab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cbbdjm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bhbcfbjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dojpmiij.dll"	Jimldogg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pciqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbaokj32.dll"	Opemca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aleckinj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ifmqfm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Iamamcop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elckbhbj.dll"	Lcfidb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nciopppp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dmohno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qbajeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Adgmoigj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kcejco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hlambk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Acqgojmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgngnj32.dll"	Jlobkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bljlfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chlflabp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cofecami.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bhkmec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Lkeekk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kjepjkhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fppcajgd.dll"	Cmflbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phgibp32.dll"	Ommceclc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dokgdkeh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppipkl32.dll"	Gmggfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iehjdl32.dll"	Lddgmbpb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hfjdqmng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Iipfmggc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfgnho32.dll"	Pciqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Apnndj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Micoommd.dll"	Cbphdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nchjdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qabjcina.dll"	Gkkgpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dafppp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiciojhd.dll"	Kidben32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Leadnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilnpcnol.dll"	Kglmio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oekpkigo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bkdcbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlgjal32.dll"	Bebjdgmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bbhildae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcipf32.dll"	Fjmfmh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oemefcap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keoaokpd.dll"	Hbgkei32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bkobmnka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kpnjah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhlbgmif.dll"	Pcgdhkem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fglnkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnjfibml.dll"	Baadiiif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bckkca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cbbdjm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mejpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dpgnjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgooajdl.dll"	Nchjdo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nlkngo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gckoph32.dll"	Hlambk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lckboblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kejiqphj.dll"	Molelb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ilfennic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Khlklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Giinpa32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 4644	2532	NEAS.b449582835352007eb36de4a2a03f448.exe	85
PID 2532 wrote to memory of 4644	2532	NEAS.b449582835352007eb36de4a2a03f448.exe	85
PID 2532 wrote to memory of 4644	2532	NEAS.b449582835352007eb36de4a2a03f448.exe	85
PID 4644 wrote to memory of 3140	4644	Leadnm32.exe	86
PID 4644 wrote to memory of 3140	4644	Leadnm32.exe	86
PID 4644 wrote to memory of 3140	4644	Leadnm32.exe	86
PID 3140 wrote to memory of 4128	3140	Miomdk32.exe	87
PID 3140 wrote to memory of 4128	3140	Miomdk32.exe	87
PID 3140 wrote to memory of 4128	3140	Miomdk32.exe	87
PID 4128 wrote to memory of 3748	4128	Molelb32.exe	89
PID 4128 wrote to memory of 3748	4128	Molelb32.exe	89
PID 4128 wrote to memory of 3748	4128	Molelb32.exe	89
PID 3748 wrote to memory of 1032	3748	Moobbb32.exe	90
PID 3748 wrote to memory of 1032	3748	Moobbb32.exe	90
PID 3748 wrote to memory of 1032	3748	Moobbb32.exe	90
PID 1032 wrote to memory of 692	1032	Moaogand.exe	91
PID 1032 wrote to memory of 692	1032	Moaogand.exe	91
PID 1032 wrote to memory of 692	1032	Moaogand.exe	91
PID 692 wrote to memory of 2952	692	Npchgdcd.exe	92
PID 692 wrote to memory of 2952	692	Npchgdcd.exe	92
PID 692 wrote to memory of 2952	692	Npchgdcd.exe	92
PID 2952 wrote to memory of 3136	2952	Nohehq32.exe	94
PID 2952 wrote to memory of 3136	2952	Nohehq32.exe	94
PID 2952 wrote to memory of 3136	2952	Nohehq32.exe	94
PID 3136 wrote to memory of 3504	3136	Nhbfff32.exe	95
PID 3136 wrote to memory of 3504	3136	Nhbfff32.exe	95
PID 3136 wrote to memory of 3504	3136	Nhbfff32.exe	95
PID 3504 wrote to memory of 3956	3504	Nchjdo32.exe	96
PID 3504 wrote to memory of 3956	3504	Nchjdo32.exe	96
PID 3504 wrote to memory of 3956	3504	Nchjdo32.exe	96
PID 3956 wrote to memory of 4888	3956	Nookip32.exe	97
PID 3956 wrote to memory of 4888	3956	Nookip32.exe	97
PID 3956 wrote to memory of 4888	3956	Nookip32.exe	97
PID 4888 wrote to memory of 3188	4888	Oekpkigo.exe	98
PID 4888 wrote to memory of 3188	4888	Oekpkigo.exe	98
PID 4888 wrote to memory of 3188	4888	Oekpkigo.exe	98
PID 3188 wrote to memory of 2452	3188	Oocddono.exe	99
PID 3188 wrote to memory of 2452	3188	Oocddono.exe	99
PID 3188 wrote to memory of 2452	3188	Oocddono.exe	99
PID 2452 wrote to memory of 4660	2452	Oofaiokl.exe	100
PID 2452 wrote to memory of 4660	2452	Oofaiokl.exe	100
PID 2452 wrote to memory of 4660	2452	Oofaiokl.exe	100
PID 4660 wrote to memory of 3144	4660	Opemca32.exe	101
PID 4660 wrote to memory of 3144	4660	Opemca32.exe	101
PID 4660 wrote to memory of 3144	4660	Opemca32.exe	101
PID 3144 wrote to memory of 1580	3144	Pedbahod.exe	102
PID 3144 wrote to memory of 1580	3144	Pedbahod.exe	102
PID 3144 wrote to memory of 1580	3144	Pedbahod.exe	102
PID 1580 wrote to memory of 3768	1580	Pomgjn32.exe	103
PID 1580 wrote to memory of 3768	1580	Pomgjn32.exe	103
PID 1580 wrote to memory of 3768	1580	Pomgjn32.exe	103
PID 3768 wrote to memory of 4820	3768	Plagcbdn.exe	105
PID 3768 wrote to memory of 4820	3768	Plagcbdn.exe	105
PID 3768 wrote to memory of 4820	3768	Plagcbdn.exe	105
PID 4820 wrote to memory of 928	4820	Pcmlfl32.exe	106
PID 4820 wrote to memory of 928	4820	Pcmlfl32.exe	106
PID 4820 wrote to memory of 928	4820	Pcmlfl32.exe	106
PID 928 wrote to memory of 4912	928	Pleaoa32.exe	107
PID 928 wrote to memory of 4912	928	Pleaoa32.exe	107
PID 928 wrote to memory of 4912	928	Pleaoa32.exe	107
PID 4912 wrote to memory of 4748	4912	Qcbfakec.exe	108
PID 4912 wrote to memory of 4748	4912	Qcbfakec.exe	108
PID 4912 wrote to memory of 4748	4912	Qcbfakec.exe	108
PID 4748 wrote to memory of 4092	4748	Qlmgopjq.exe	109

C:\Users\Admin\AppData\Local\Temp\NEAS.b449582835352007eb36de4a2a03f448.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b449582835352007eb36de4a2a03f448.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\SysWOW64\Leadnm32.exe
  C:\Windows\system32\Leadnm32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\SysWOW64\Miomdk32.exe
    C:\Windows\system32\Miomdk32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Windows\SysWOW64\Molelb32.exe
      C:\Windows\system32\Molelb32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4128
    - - C:\Windows\SysWOW64\Moobbb32.exe
        
        C:\Windows\system32\Moobbb32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3748
      - C:\Windows\SysWOW64\Moaogand.exe
        
        C:\Windows\system32\Moaogand.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1032
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:692
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2952
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3136
        
        C:\Windows\SysWOW64\Nchjdo32.exe
        
        C:\Windows\system32\Nchjdo32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\Nookip32.exe
        
        C:\Windows\system32\Nookip32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3956
        
        C:\Windows\SysWOW64\Oekpkigo.exe
        
        C:\Windows\system32\Oekpkigo.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3188
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4660
        
        C:\Windows\SysWOW64\Pedbahod.exe
        
        C:\Windows\system32\Pedbahod.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1580
        
        C:\Windows\SysWOW64\Plagcbdn.exe
        
        C:\Windows\system32\Plagcbdn.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3768
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\SysWOW64\Pleaoa32.exe
        
        C:\Windows\system32\Pleaoa32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:928
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\SysWOW64\Afelhf32.exe
        
        C:\Windows\system32\Afelhf32.exe
        23⤵
        Executes dropped EXE
        
        PID:4092
        
        C:\Windows\SysWOW64\Aqmlknnd.exe
        
        C:\Windows\system32\Aqmlknnd.exe
        24⤵
        Executes dropped EXE
        
        PID:1696
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        25⤵
        Executes dropped EXE
        
        PID:892
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        26⤵
        Executes dropped EXE
        
        PID:2224
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        27⤵
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4440
        
        C:\Windows\SysWOW64\Mhafeb32.exe
        
        C:\Windows\system32\Mhafeb32.exe
        29⤵
        Executes dropped EXE
        
        PID:3204
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        30⤵
        Executes dropped EXE
        
        PID:3996
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        31⤵
        Executes dropped EXE
        
        PID:4020
        
        C:\Windows\SysWOW64\Mnphmkji.exe
        
        C:\Windows\system32\Mnphmkji.exe
        32⤵
        Executes dropped EXE
        
        PID:2804
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2836
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        34⤵
        Executes dropped EXE
        
        PID:1672
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        35⤵
        Executes dropped EXE
        
        PID:3376
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1844
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:944
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1748
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5052
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        40⤵
        Executes dropped EXE
        
        PID:4828
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        41⤵
        Executes dropped EXE
        
        PID:1584
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1028
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        43⤵
        Executes dropped EXE
        
        PID:3192
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1180
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        45⤵
        Executes dropped EXE
        
        PID:4936
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        46⤵
        Executes dropped EXE
        
        PID:4264
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4564
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        48⤵
        Executes dropped EXE
        
        PID:4000
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1096
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4812
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3472
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        52⤵
        Executes dropped EXE
        
        PID:1516
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4840
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:984
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        55⤵
        Executes dropped EXE
        
        PID:1716
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4968
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4608
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2732
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4156
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        60⤵
        Executes dropped EXE
        
        PID:3948
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        61⤵
        Executes dropped EXE
        
        PID:4412
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        62⤵
        Executes dropped EXE
        
        PID:3728
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4636
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:688
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4308
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        67⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1248
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        69⤵
        Drops file in System32 directory
        
        PID:5024
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        70⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        71⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        72⤵
        Modifies registry class
        
        PID:3368
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        73⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        74⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        75⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3360
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        76⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        77⤵
        Drops file in System32 directory
        
        PID:3876
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        78⤵
        Modifies registry class
        
        PID:3496
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1936
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5140
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        81⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5236
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        83⤵
        Drops file in System32 directory
        
        PID:5276
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        84⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        85⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5404
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        87⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        88⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        89⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        90⤵
        Drops file in System32 directory
        
        PID:5592
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        91⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        92⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        93⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5788
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        95⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        96⤵
        Drops file in System32 directory
        
        PID:5872
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        97⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5952
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        99⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        100⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        101⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        102⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        103⤵
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        104⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        105⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        107⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        108⤵
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        109⤵
        Drops file in System32 directory
        
        PID:5600
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        110⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        111⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        112⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        113⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        114⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        115⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        116⤵
        Modifies registry class
        
        PID:6088
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        117⤵
        Drops file in System32 directory
        
        PID:1464
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        118⤵
        Drops file in System32 directory
        
        PID:5260
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        119⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        120⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5732
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        122⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        123⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5352
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        125⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        126⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        127⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        128⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5940
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6108
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        131⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        132⤵
        Modifies registry class
        
        PID:1960
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        133⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6104
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        135⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        136⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5228
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5172
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6168
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6212
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        141⤵
        Modifies registry class
        
        PID:6252
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        142⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6332
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        144⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        145⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        146⤵
        Drops file in System32 directory
        
        PID:6456
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        147⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        148⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        149⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6620
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        151⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        152⤵
        Drops file in System32 directory
        
        PID:6700
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        153⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6784
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        155⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6864
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        157⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        158⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        159⤵
        Drops file in System32 directory
        
        PID:7000
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7044
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        161⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7088
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        162⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        163⤵
        Modifies registry class
        
        PID:7164
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        164⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        165⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        166⤵
        Drops file in System32 directory
        
        PID:6312
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6356
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        168⤵
        Modifies registry class
        
        PID:6452
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6512
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        170⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6760
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        172⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        173⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3248
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:400
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        175⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        176⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        177⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        178⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6960
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        179⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3584
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        181⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3448
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7148
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        184⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        185⤵
        
        PID:704
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        186⤵
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        187⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3768
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        188⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        189⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        190⤵
        Modifies registry class
        
        PID:6396
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        191⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        192⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        193⤵
        Modifies registry class
        
        PID:6656
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        194⤵
        
        PID:884
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        195⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        196⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3572
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        197⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        198⤵
        
        PID:828
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        199⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1664
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        201⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        202⤵
        Drops file in System32 directory
        
        PID:4660
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6260
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        204⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        205⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4644
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        207⤵
        Drops file in System32 directory
        
        PID:6892
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        208⤵
        Drops file in System32 directory
        
        PID:6996
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:744
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        210⤵
        Drops file in System32 directory
        
        PID:4888
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        211⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4916
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        212⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        213⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1512
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        215⤵
        
        PID:4336

C:\Windows\SysWOW64\Oihmedma.exe
C:\Windows\system32\Oihmedma.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4016
- C:\Windows\SysWOW64\Pfojdh32.exe
  C:\Windows\system32\Pfojdh32.exe
  2⤵
  PID:2116
- - C:\Windows\SysWOW64\Paihlpfi.exe
    C:\Windows\system32\Paihlpfi.exe
    3⤵
    - Drops file in System32 directory
    PID:4340
  - - C:\Windows\SysWOW64\Pcgdhkem.exe
      C:\Windows\system32\Pcgdhkem.exe
      4⤵
      Modifies registry class
      PID:436
    - - C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        5⤵
        
        PID:2964
      - C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2904
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4060
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        8⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        9⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\Qbonoghb.exe
        
        C:\Windows\system32\Qbonoghb.exe
        10⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        11⤵
        Modifies registry class
        
        PID:1508
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        12⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        13⤵
        Modifies registry class
        
        PID:6516
        
        C:\Windows\SysWOW64\Apggckbf.exe
        
        C:\Windows\system32\Apggckbf.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3380
        
        C:\Windows\SysWOW64\Aiplmq32.exe
        
        C:\Windows\system32\Aiplmq32.exe
        15⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Afcmfe32.exe
        
        C:\Windows\system32\Afcmfe32.exe
        16⤵
        
        PID:416
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        17⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7112
        
        C:\Windows\SysWOW64\Aidehpea.exe
        
        C:\Windows\system32\Aidehpea.exe
        18⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\Apnndj32.exe
        
        C:\Windows\system32\Apnndj32.exe
        19⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2600
        
        C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2452
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6276
        
        C:\Windows\SysWOW64\Bjfogbjb.exe
        
        C:\Windows\system32\Bjfogbjb.exe
        22⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        23⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3196
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        25⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        26⤵
        Drops file in System32 directory
        
        PID:4168
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        27⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        28⤵
        Modifies registry class
        
        PID:2316
        
        C:\Windows\SysWOW64\Cdhffg32.exe
        
        C:\Windows\system32\Cdhffg32.exe
        29⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2960
        
        C:\Windows\SysWOW64\Calfpk32.exe
        
        C:\Windows\system32\Calfpk32.exe
        31⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        32⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\Ckdkhq32.exe
        
        C:\Windows\system32\Ckdkhq32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6684
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        34⤵
        Drops file in System32 directory
        
        PID:3440
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6152

C:\Windows\SysWOW64\Cpfmlghd.exe
C:\Windows\system32\Cpfmlghd.exe
1⤵
PID:2824
- C:\Windows\SysWOW64\Dnljkk32.exe
  C:\Windows\system32\Dnljkk32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:3780
- - C:\Windows\SysWOW64\Dncpkjoc.exe
    C:\Windows\system32\Dncpkjoc.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:2144
  - - C:\Windows\SysWOW64\Edoencdm.exe
      C:\Windows\system32\Edoencdm.exe
      4⤵
      PID:7052
    - - C:\Windows\SysWOW64\Egpnooan.exe
        
        C:\Windows\system32\Egpnooan.exe
        5⤵
        
        PID:2688
      - C:\Windows\SysWOW64\Ephbhd32.exe
        
        C:\Windows\system32\Ephbhd32.exe
        6⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Ejagaj32.exe
        
        C:\Windows\system32\Ejagaj32.exe
        7⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\Ejccgi32.exe
        
        C:\Windows\system32\Ejccgi32.exe
        8⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Fkcpql32.exe
        
        C:\Windows\system32\Fkcpql32.exe
        9⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Fdkdibjp.exe
        
        C:\Windows\system32\Fdkdibjp.exe
        10⤵
        Drops file in System32 directory
        
        PID:4952
        
        C:\Windows\SysWOW64\Fgiaemic.exe
        
        C:\Windows\system32\Fgiaemic.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4280
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        12⤵
        Drops file in System32 directory
        
        PID:3852
        
        C:\Windows\SysWOW64\Fqbeoc32.exe
        
        C:\Windows\system32\Fqbeoc32.exe
        13⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Fglnkm32.exe
        
        C:\Windows\system32\Fglnkm32.exe
        14⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1516
        
        C:\Windows\SysWOW64\Fqdbdbna.exe
        
        C:\Windows\system32\Fqdbdbna.exe
        15⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        16⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        17⤵
        Modifies registry class
        
        PID:3016
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        18⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        19⤵
        Drops file in System32 directory
        
        PID:1192
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        20⤵
        Drops file in System32 directory
        
        PID:4264
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        21⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 412
        22⤵
        Program crash
        
        PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2500 -ip 2500
1⤵
PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afcmfe32.exe

Filesize
400KB

MD5
a460b7518cd25dd5fd34cbdef00123e6

SHA1
be1a426b0ee55f3a00e7f02d45e73883ede2de72

SHA256
1c2ec835bf1e1f91a6b63979d11022f0456f682fafe1c66bae3438e29fd913df

SHA512
6563ef306fda356acf512ca53fec41746ed99cd865a0e7011206fe8c2f8538bf4d1b325228833fc573044ee3ff832e5f7e97109067cb8b7ca71f87fcbb914628

Download Submit
C:\Windows\SysWOW64\Afelhf32.exe

Filesize
400KB

MD5
1b376f54870f60d57608ec59580fb318

SHA1
9ac8b8a22f22bcd78e9e13208823f089bc5e1b12

SHA256
0027773df837657415865a020f36111f099c3a018a49691db00e8c54ce849329

SHA512
32903b2acfa11aaa51062774675ac5ed49e2c717c91e601f5b67f45d8967b59b75d51fdef1f4358d1af99102c797d3293356d1cde410fbd8517618435b6d97cf

Download Submit
C:\Windows\SysWOW64\Afelhf32.exe

Filesize
400KB

MD5
1b376f54870f60d57608ec59580fb318

SHA1
9ac8b8a22f22bcd78e9e13208823f089bc5e1b12

SHA256
0027773df837657415865a020f36111f099c3a018a49691db00e8c54ce849329

SHA512
32903b2acfa11aaa51062774675ac5ed49e2c717c91e601f5b67f45d8967b59b75d51fdef1f4358d1af99102c797d3293356d1cde410fbd8517618435b6d97cf

Download Submit
C:\Windows\SysWOW64\Aqmlknnd.exe

Filesize
400KB

MD5
b90d8e1ddc2905195600510f81a631c8

SHA1
825cf4ac29cba4d583e7c7da686983124fd05236

SHA256
0a441e7a9a46a9c70bbb13704092e03b8e11dc9cd9cdfc14eb45b7c18b4fa023

SHA512
d1370922ed19f468434451da6ac82bf1046a16dfc7f2a67571237d8b2def82fe7e0b14186060e65fe71694bed226f892992a37964516582f93547db6b4f393ed

Download Submit
C:\Windows\SysWOW64\Aqmlknnd.exe

Filesize
400KB

MD5
b90d8e1ddc2905195600510f81a631c8

SHA1
825cf4ac29cba4d583e7c7da686983124fd05236

SHA256
0a441e7a9a46a9c70bbb13704092e03b8e11dc9cd9cdfc14eb45b7c18b4fa023

SHA512
d1370922ed19f468434451da6ac82bf1046a16dfc7f2a67571237d8b2def82fe7e0b14186060e65fe71694bed226f892992a37964516582f93547db6b4f393ed

Download Submit
C:\Windows\SysWOW64\Chlflabp.exe

Filesize
400KB

MD5
b229bc85fe1e9a71126ea877d769d467

SHA1
262140122cf5608d3ab3e25f0f9543c859fa5903

SHA256
dcf39132b00dfa15d51e284e405db4072adfcfcc360309403f26c8eeb0456abe

SHA512
7e4735ffbf6125717bcbdc1541b77b29b13f231ccabdc5db033a1dbc63bd2328dfb78d4fb42ad50f0d4cb009a1aaec61b9b5f831e349373da88e66e8e1d53c52

Download Submit
C:\Windows\SysWOW64\Cllhoapg.dll

Filesize
7KB

MD5
fbc26ac2e183a0dc6c5bef3e015b3a82

SHA1
d8a383280472a01f9c6425c460a7e3ce157655b7

SHA256
21bd62fce3b0f0b94a45eb8c6b07c11708d0dc34cc94f07093181c8b18cd07e5

SHA512
02f3dc4d73a353971a46b2ec8ecf9921330f1df93001175086ee1fc7d2981cb9d8751c9ea9ff9957cc677f6892afb9d19e22d94a07dc7f9ee784b20820ed6197

Download Submit
C:\Windows\SysWOW64\Lcfidb32.exe

Filesize
400KB

MD5
eaf8cbf74857bd526a51ca177f11c0a5

SHA1
55d0e028668931eba6f69bc7909e2c6d4708c493

SHA256
a811136baa875a5753ca7eea93ec19519a25cb542c622a314a8a69d1d79becac

SHA512
9417a37f92a8f623b0be06ca074c5ab7e91d2c69dc1cde75c91271bc0d6413b2802a0aff2ff68a3984962b76a5cc6ba2bf8f7a80374ff33da2fddf533c717ad0

Download Submit
C:\Windows\SysWOW64\Leadnm32.exe

Filesize
400KB

MD5
eef61d7be8128c2c8d346604c78fbdf4

SHA1
db1c3a15a44c3fe5221075fd52d2ed9e09d37903

SHA256
2aade4a9b17a0bef7201d1f8c5aa479033118e1e728f2ff6d5e8a9f8606389b8

SHA512
57b89f726ddadc02329ec66bd5928c0b6233ad2568bd7a1e79a367003267beb459d1b6f7c46f981e15927006f75442f25affef815a5b0844014c02b6db94481f

Download Submit
C:\Windows\SysWOW64\Leadnm32.exe

Filesize
400KB

MD5
eef61d7be8128c2c8d346604c78fbdf4

SHA1
db1c3a15a44c3fe5221075fd52d2ed9e09d37903

SHA256
2aade4a9b17a0bef7201d1f8c5aa479033118e1e728f2ff6d5e8a9f8606389b8

SHA512
57b89f726ddadc02329ec66bd5928c0b6233ad2568bd7a1e79a367003267beb459d1b6f7c46f981e15927006f75442f25affef815a5b0844014c02b6db94481f

Download Submit
C:\Windows\SysWOW64\Lihpif32.exe

Filesize
400KB

MD5
1267074f742fba15640a38dd78366394

SHA1
2177a089357125d0ecc939b456ef3a45c6ced61c

SHA256
c66c54ab1629919666fb0a93bdb7a422d941fe826b91e595079787c6749e7e44

SHA512
eac7b82b56fb97ad104b65551528b4476f1f7684c65752b9e555823cf84ffdb8610c459eef180ee123205d2e0972de31abab5237514a3f145dddd562783c429e

Download Submit
C:\Windows\SysWOW64\Lihpif32.exe

Filesize
400KB

MD5
1267074f742fba15640a38dd78366394

SHA1
2177a089357125d0ecc939b456ef3a45c6ced61c

SHA256
c66c54ab1629919666fb0a93bdb7a422d941fe826b91e595079787c6749e7e44

SHA512
eac7b82b56fb97ad104b65551528b4476f1f7684c65752b9e555823cf84ffdb8610c459eef180ee123205d2e0972de31abab5237514a3f145dddd562783c429e

Download Submit
C:\Windows\SysWOW64\Likhem32.exe

Filesize
400KB

MD5
d93c5c759827d8aede06d0baaf3fd9ce

SHA1
8104c3b00294be9fa224b65178d143166d09feab

SHA256
410f8aae40eaf765bbf71be0be27d9d9d9b91e46003a08b4d6b560d015ec3e98

SHA512
b30ea53f164f1f0b4645f1ea9ad9ee4703f62bc7d77dcae2f22dc0f4b403287f969b01c2af0ec30de8bb4690e2b457610dcbfb42da232374ba3c535f7f13eee8

Download Submit
C:\Windows\SysWOW64\Ljkifn32.exe

Filesize
400KB

MD5
8482d9dc4523bf8749578c8b2050accc

SHA1
31bddc147eb5cd2627fe07b9a7a90c5bf68b0ddc

SHA256
abf39e42d573173df4c4dc430277ca413b0c4298da21a8f1b2ef520c3153170b

SHA512
e5b1963f52898748c501d3624d1e2b79c67a5a05f25dceb2b3cd997ec4b954ece9447c3d6bdf3a1573d84d2a7aac43e2c52bd9b20f1011b7b7efbd97b9811831

Download Submit
C:\Windows\SysWOW64\Ljkifn32.exe

Filesize
400KB

MD5
8482d9dc4523bf8749578c8b2050accc

SHA1
31bddc147eb5cd2627fe07b9a7a90c5bf68b0ddc

SHA256
abf39e42d573173df4c4dc430277ca413b0c4298da21a8f1b2ef520c3153170b

SHA512
e5b1963f52898748c501d3624d1e2b79c67a5a05f25dceb2b3cd997ec4b954ece9447c3d6bdf3a1573d84d2a7aac43e2c52bd9b20f1011b7b7efbd97b9811831

Download Submit
C:\Windows\SysWOW64\Lndham32.exe

Filesize
400KB

MD5
2ce5f64dcfee33a7085a336ab444427e

SHA1
ca09908dc7dfcc131da086781cb9519842aef865

SHA256
d132d9c43542a5442a902bb2976e0b54a6740d66ec742e843f5faa2573e9f679

SHA512
22c9db367e6261c3b6e3e23c5cc27ebfcdbc31e870d4c36d0c9dc79d87fd0fb856264160c24095fb6c5bbc5f164dd6809fffcb6a8998ed7a0a98764dec505034

Download Submit
C:\Windows\SysWOW64\Lndham32.exe

Filesize
400KB

MD5
2ce5f64dcfee33a7085a336ab444427e

SHA1
ca09908dc7dfcc131da086781cb9519842aef865

SHA256
d132d9c43542a5442a902bb2976e0b54a6740d66ec742e843f5faa2573e9f679

SHA512
22c9db367e6261c3b6e3e23c5cc27ebfcdbc31e870d4c36d0c9dc79d87fd0fb856264160c24095fb6c5bbc5f164dd6809fffcb6a8998ed7a0a98764dec505034

Download Submit
C:\Windows\SysWOW64\Majjng32.exe

Filesize
400KB

MD5
3b93d4572a4f9e2bd278c1dd0123e722

SHA1
524b1bd748783071c3102f0ceb0e1dc1048ca2ee

SHA256
7c1d5945670650a22ca2632093bb40373a93b5d395b7e060cd766dbcc7cc5f05

SHA512
7f61ca1787bec46810fc776d67776e5604a617ac5c05df7ef293632f91a0856f0994223e4e30190fd5f25240e4c5059ea133667d10f40ddd36795b8128fcc21b

Download Submit
C:\Windows\SysWOW64\Majjng32.exe

Filesize
400KB

MD5
3b93d4572a4f9e2bd278c1dd0123e722

SHA1
524b1bd748783071c3102f0ceb0e1dc1048ca2ee

SHA256
7c1d5945670650a22ca2632093bb40373a93b5d395b7e060cd766dbcc7cc5f05

SHA512
7f61ca1787bec46810fc776d67776e5604a617ac5c05df7ef293632f91a0856f0994223e4e30190fd5f25240e4c5059ea133667d10f40ddd36795b8128fcc21b

Download Submit
C:\Windows\SysWOW64\Mbenmk32.exe

Filesize
400KB

MD5
399d8738050cf04ca191db17ade560ec

SHA1
0fcb22b0161c886deed1cf20178669e5047b41eb

SHA256
835a060d125fff10a7a7e220f5cf8fee34e049c8070c2fee6e052fa6bde221b4

SHA512
01aeb847e1cee29663581cdde2c81a1c58c7f33b96b295ab125d1f771d24ba4e5199fb6afca3cbd97eb715783a0ac5a10302a124f0b386c1486e376e6291f6fc

Download Submit
C:\Windows\SysWOW64\Mbenmk32.exe

Filesize
400KB

MD5
399d8738050cf04ca191db17ade560ec

SHA1
0fcb22b0161c886deed1cf20178669e5047b41eb

SHA256
835a060d125fff10a7a7e220f5cf8fee34e049c8070c2fee6e052fa6bde221b4

SHA512
01aeb847e1cee29663581cdde2c81a1c58c7f33b96b295ab125d1f771d24ba4e5199fb6afca3cbd97eb715783a0ac5a10302a124f0b386c1486e376e6291f6fc

Download Submit
C:\Windows\SysWOW64\Mehcdfch.exe

Filesize
400KB

MD5
25a067c60297030c8c992fddc03b30ff

SHA1
0db3f7891086c10ee9490ee39a9ea693a1229947

SHA256
e016c3f6914758c2eb2965c258af526e11ecf28957553b6afd6e6aa4f99bb37b

SHA512
da1a3bcd62d66a48e8996aa60e2eadf3fae563979db0ac22286f1ac67b9fd8cd649620b80fafd20d1de364d0377aaaac36aea86fc497712c02962a8d4cf9db24

Download Submit
C:\Windows\SysWOW64\Mehcdfch.exe

Filesize
400KB

MD5
25a067c60297030c8c992fddc03b30ff

SHA1
0db3f7891086c10ee9490ee39a9ea693a1229947

SHA256
e016c3f6914758c2eb2965c258af526e11ecf28957553b6afd6e6aa4f99bb37b

SHA512
da1a3bcd62d66a48e8996aa60e2eadf3fae563979db0ac22286f1ac67b9fd8cd649620b80fafd20d1de364d0377aaaac36aea86fc497712c02962a8d4cf9db24

Download Submit
C:\Windows\SysWOW64\Mejpje32.exe

Filesize
400KB

MD5
7e992c7b6063b69a8f650c23a1a1f5c8

SHA1
2417474b65af503700fa231957762f42c6de4a50

SHA256
5224b4c96b2340bb2297e0e6c95b8479cc92ee04cc95c52d5b31662bf714697e

SHA512
7450df662ccbba957d9dc5c0731a7201003395337866414fd775c110fd3197a72cb627d87d4feaaddb80c913c5867a2dd91717853bcedbfc993b91cdbf9fb0cf

Download Submit
C:\Windows\SysWOW64\Mejpje32.exe

Filesize
400KB

MD5
7e992c7b6063b69a8f650c23a1a1f5c8

SHA1
2417474b65af503700fa231957762f42c6de4a50

SHA256
5224b4c96b2340bb2297e0e6c95b8479cc92ee04cc95c52d5b31662bf714697e

SHA512
7450df662ccbba957d9dc5c0731a7201003395337866414fd775c110fd3197a72cb627d87d4feaaddb80c913c5867a2dd91717853bcedbfc993b91cdbf9fb0cf

Download Submit
C:\Windows\SysWOW64\Mhafeb32.exe

Filesize
400KB

MD5
0c2038e596f21561b3996c295bf673e2

SHA1
6965e9eb4ebfd59a65ab68170bdfacf8a637dc71

SHA256
f86fb1a85f836c6414644349b067d3420c9619d6a8247aa901f9ac0e3fb363b4

SHA512
7a7f70b71496b444f7b85969e092e5e38141ca8807a89974f4e91903d28132e833a55e897bbfac8ce9203404cde921565d1ba31025ab520528b3d359eb2c9e7b

Download Submit
C:\Windows\SysWOW64\Mhafeb32.exe

Filesize
400KB

MD5
0c2038e596f21561b3996c295bf673e2

SHA1
6965e9eb4ebfd59a65ab68170bdfacf8a637dc71

SHA256
f86fb1a85f836c6414644349b067d3420c9619d6a8247aa901f9ac0e3fb363b4

SHA512
7a7f70b71496b444f7b85969e092e5e38141ca8807a89974f4e91903d28132e833a55e897bbfac8ce9203404cde921565d1ba31025ab520528b3d359eb2c9e7b

Download Submit
C:\Windows\SysWOW64\Miomdk32.exe

Filesize
400KB

MD5
ce2a7abc1834315ebe9af42ad8593452

SHA1
32f3782e74de41688a7c507e5f1ebb933c12ef3c

SHA256
978694df74d544a7e24dc870373bf783f626c70158ee56aaf69f7beec083ad08

SHA512
10d4d3d8b6ea7e8c3e99830625b42812ee5c21e8f9e280c614d8e391839efef569853abe7b9598895a88fdfabc6cf5185239832f3532858971d5cfaab48fd6b5

Download Submit
C:\Windows\SysWOW64\Miomdk32.exe

Filesize
400KB

MD5
ce2a7abc1834315ebe9af42ad8593452

SHA1
32f3782e74de41688a7c507e5f1ebb933c12ef3c

SHA256
978694df74d544a7e24dc870373bf783f626c70158ee56aaf69f7beec083ad08

SHA512
10d4d3d8b6ea7e8c3e99830625b42812ee5c21e8f9e280c614d8e391839efef569853abe7b9598895a88fdfabc6cf5185239832f3532858971d5cfaab48fd6b5

Download Submit
C:\Windows\SysWOW64\Mnphmkji.exe

Filesize
400KB

MD5
5c06a65bc084de64c97bdd3a0d832c13

SHA1
5857c79104ea8f55128f43a2bb0f9f439b136abb

SHA256
6b9fb90698100f450afcb4eb1a48893c1a5ce037f671654cd480c3bc85af8183

SHA512
6696be3886d967fe2941c2be8cfeb0376f19a50cb6a96716b3ee64235e7130d86e1c6ebf5b5e742552a62bd34339135d1ec86d39eabba1d82402fda6909b1256

Download Submit
C:\Windows\SysWOW64\Mnphmkji.exe

Filesize
400KB

MD5
5c06a65bc084de64c97bdd3a0d832c13

SHA1
5857c79104ea8f55128f43a2bb0f9f439b136abb

SHA256
6b9fb90698100f450afcb4eb1a48893c1a5ce037f671654cd480c3bc85af8183

SHA512
6696be3886d967fe2941c2be8cfeb0376f19a50cb6a96716b3ee64235e7130d86e1c6ebf5b5e742552a62bd34339135d1ec86d39eabba1d82402fda6909b1256

Download Submit
C:\Windows\SysWOW64\Moaogand.exe

Filesize
400KB

MD5
eca91180157b71c23eb675eda4922d93

SHA1
9930e3a40c3c3d0c4ef9fa3e9c19c0040da80d3f

SHA256
54be8a7cc93ff507209f4ca595b6f86a36fff8a5de6046bb661d647cf6b6e937

SHA512
ffcbef76aaefae95963e8f514a6e08351934ca2850ccb1c32a11eb54924b2e3ed7d28be6dbb6e314d1a3b6be293208c24a38f11f8c6e1482b44761af252ffab2

Download Submit
C:\Windows\SysWOW64\Moaogand.exe

Filesize
400KB

MD5
eca91180157b71c23eb675eda4922d93

SHA1
9930e3a40c3c3d0c4ef9fa3e9c19c0040da80d3f

SHA256
54be8a7cc93ff507209f4ca595b6f86a36fff8a5de6046bb661d647cf6b6e937

SHA512
ffcbef76aaefae95963e8f514a6e08351934ca2850ccb1c32a11eb54924b2e3ed7d28be6dbb6e314d1a3b6be293208c24a38f11f8c6e1482b44761af252ffab2

Download Submit
C:\Windows\SysWOW64\Molelb32.exe

Filesize
400KB

MD5
49adeb8562b6878b3a2c7994f2075c3b

SHA1
7410b8316ca39a9fe8f198ddc30cf903836c6933

SHA256
7b64cf835584c9e78ff916362067c6470892b099e4b02c356aac701f67bfdbb1

SHA512
f40fdd850d4f6fbf4281b96cd0bb80e986e8eee21b8d4d214416b982b5b3f6dde3a55c40b5000e6cfce603b6700e5da0be119e335e5afe03b5d1e6528784fb71

Download Submit
C:\Windows\SysWOW64\Molelb32.exe

Filesize
400KB

MD5
49adeb8562b6878b3a2c7994f2075c3b

SHA1
7410b8316ca39a9fe8f198ddc30cf903836c6933

SHA256
7b64cf835584c9e78ff916362067c6470892b099e4b02c356aac701f67bfdbb1

SHA512
f40fdd850d4f6fbf4281b96cd0bb80e986e8eee21b8d4d214416b982b5b3f6dde3a55c40b5000e6cfce603b6700e5da0be119e335e5afe03b5d1e6528784fb71

Download Submit
C:\Windows\SysWOW64\Moobbb32.exe

Filesize
400KB

MD5
b070c19398a107e9c471f197f8c72f0c

SHA1
c7e213e3fdb37226aae8a5544dad72835654cf96

SHA256
b10587d091adc8acb0eb5fae38bd1641dddc7a0c81e13342be8ee2a4a10de245

SHA512
6667d6ebc850b568073fbb54a3bcfccc0e2176ff4710009828f46d76fbf8a6867476ec8d31b7f49f6b02593516062d9378e3144f2acd0d2c53d25ac8595fa90d

Download Submit
C:\Windows\SysWOW64\Moobbb32.exe

Filesize
400KB

MD5
b070c19398a107e9c471f197f8c72f0c

SHA1
c7e213e3fdb37226aae8a5544dad72835654cf96

SHA256
b10587d091adc8acb0eb5fae38bd1641dddc7a0c81e13342be8ee2a4a10de245

SHA512
6667d6ebc850b568073fbb54a3bcfccc0e2176ff4710009828f46d76fbf8a6867476ec8d31b7f49f6b02593516062d9378e3144f2acd0d2c53d25ac8595fa90d

Download Submit
C:\Windows\SysWOW64\Nafjjf32.exe

Filesize
400KB

MD5
2a7f5a63f92168c297aa6c5587566fb6

SHA1
b2418c84708c57fe8be56e72e67bc7d0ff040015

SHA256
07ebd3ab7b05c3e2074732fe4a0a2f9e02dee67d9f226444a5ba2d827429bbf7

SHA512
5a19426086106ca808f6b297d2bf475766fd429ee8db654e883e8fc2e52be0ff7f537af1160af3ca3fd5c24f2b7cfcfce74c712cfd3e5812f7be80a0abd978b1

Download Submit
C:\Windows\SysWOW64\Nchjdo32.exe

Filesize
400KB

MD5
023fa716e2b768b2e7d9a9e00764306c

SHA1
c328901b3221cd434c94c0d0711e55c90a3b916e

SHA256
47cb80effd5dfab67deff39f587dae78563153f375e4e53b116d4bbafbd74b02

SHA512
69a433d15f97ef327d640eb47d28f91eff4b81ff4c792dced63ab029267976dbaabd5adbdae6799a3910a80fec00f7258ffdbe24d68b05727dd87c4f4d66b69b

Download Submit
C:\Windows\SysWOW64\Nchjdo32.exe

Filesize
400KB

MD5
023fa716e2b768b2e7d9a9e00764306c

SHA1
c328901b3221cd434c94c0d0711e55c90a3b916e

SHA256
47cb80effd5dfab67deff39f587dae78563153f375e4e53b116d4bbafbd74b02

SHA512
69a433d15f97ef327d640eb47d28f91eff4b81ff4c792dced63ab029267976dbaabd5adbdae6799a3910a80fec00f7258ffdbe24d68b05727dd87c4f4d66b69b

Download Submit
C:\Windows\SysWOW64\Nhbfff32.exe

Filesize
400KB

MD5
0f1de35bb3ba22fb7693c031947df5e9

SHA1
b78823c9ef730e7bb3b593b1a3dd20e18f321bcf

SHA256
777a392d6db5deaadf7e3f236b6dcae989645d8f736559c2cf48a14a139e516d

SHA512
25e125cc4d225b761a5818061b282220ff66c98700aecf4088bf3701c243b040b5019c0ac06cdebfeb91ce49706b26cc99db11d58a03140a4abe88b3e0e45d12

Download Submit
C:\Windows\SysWOW64\Nhbfff32.exe

Filesize
400KB

MD5
0f1de35bb3ba22fb7693c031947df5e9

SHA1
b78823c9ef730e7bb3b593b1a3dd20e18f321bcf

SHA256
777a392d6db5deaadf7e3f236b6dcae989645d8f736559c2cf48a14a139e516d

SHA512
25e125cc4d225b761a5818061b282220ff66c98700aecf4088bf3701c243b040b5019c0ac06cdebfeb91ce49706b26cc99db11d58a03140a4abe88b3e0e45d12

Download Submit
C:\Windows\SysWOW64\Nohehq32.exe

Filesize
400KB

MD5
25b99bfc05317d1f31021cd36f1a6cf5

SHA1
4f962a9890e0174dc14877fa745ebe77ca79bb4b

SHA256
97ff35a994c828ed611e98c81b488dc7f2ba7ee8eba426b23606b56bb7d84e4c

SHA512
0d6802f8ec3e0c46156915f1c314def8e047b2c21b24305fcbc9df209fbe3025a10e41f396669bb1f97f4446b307e7d488f853082b78cccb473c80fef848a843

Download Submit
C:\Windows\SysWOW64\Nohehq32.exe

Filesize
400KB

MD5
4112d8518a69ef03dbfb3ad8ff4dc5f1

SHA1
f0a9676f5f38120bf3d7ce675223a8e51a51d5f1

SHA256
91de9f3cf3eb7ae6c2123f681cd66858461ff565391930aea727d5ad063ee84a

SHA512
532d5ebf36af1b1007e0fe956f456fe88f348425601b5175e57791475d8ed3050ebb1944922ac97c6c1245caf9b41540686edaf91cf104ae20c1848db4beca52

Download Submit
C:\Windows\SysWOW64\Nohehq32.exe

Filesize
400KB

MD5
4112d8518a69ef03dbfb3ad8ff4dc5f1

SHA1
f0a9676f5f38120bf3d7ce675223a8e51a51d5f1

SHA256
91de9f3cf3eb7ae6c2123f681cd66858461ff565391930aea727d5ad063ee84a

SHA512
532d5ebf36af1b1007e0fe956f456fe88f348425601b5175e57791475d8ed3050ebb1944922ac97c6c1245caf9b41540686edaf91cf104ae20c1848db4beca52

Download Submit
C:\Windows\SysWOW64\Nookip32.exe

Filesize
400KB

MD5
8459fa55d3484ec995939a5fa667914a

SHA1
8200e2b31fc2312e93a3361d80f12e42d9e63034

SHA256
89b60960531a5a8e7138dc1f5ca41527829355cd9b5221c5acb38db464e863bc

SHA512
65601fbf0b0e640d38d3fdd4110e6048110658756f6560e1a5257a226c390e5806dbfd924693c0296fc986c3a4b06356ca5938264b4f1cd7cbffb892a1a400a5

Download Submit
C:\Windows\SysWOW64\Nookip32.exe

Filesize
400KB

MD5
8459fa55d3484ec995939a5fa667914a

SHA1
8200e2b31fc2312e93a3361d80f12e42d9e63034

SHA256
89b60960531a5a8e7138dc1f5ca41527829355cd9b5221c5acb38db464e863bc

SHA512
65601fbf0b0e640d38d3fdd4110e6048110658756f6560e1a5257a226c390e5806dbfd924693c0296fc986c3a4b06356ca5938264b4f1cd7cbffb892a1a400a5

Download Submit
C:\Windows\SysWOW64\Npchgdcd.exe

Filesize
400KB

MD5
c55956c2fbeca4f2d9904e248164dbec

SHA1
488ab004ffbe217585b487ef3730cdd119bb5de8

SHA256
528d67dd058b13c08c698b0373cb733b5bc6895d425acde0aa9d5ef307f23d2a

SHA512
5754203fe564e7a4337fabcc8c91ee0d3973fd25dc08b413af40c553951df1fbba94b42a3366dbd04225f4e1a624ad918c4319175fa86db06fd7f556e164cd71

Download Submit
C:\Windows\SysWOW64\Npchgdcd.exe

Filesize
400KB

MD5
c55956c2fbeca4f2d9904e248164dbec

SHA1
488ab004ffbe217585b487ef3730cdd119bb5de8

SHA256
528d67dd058b13c08c698b0373cb733b5bc6895d425acde0aa9d5ef307f23d2a

SHA512
5754203fe564e7a4337fabcc8c91ee0d3973fd25dc08b413af40c553951df1fbba94b42a3366dbd04225f4e1a624ad918c4319175fa86db06fd7f556e164cd71

Download Submit
C:\Windows\SysWOW64\Oekpkigo.exe

Filesize
400KB

MD5
1505c23a812bbd8e874f0faf08f03f57

SHA1
7aba85883ef515151aa0badde33699d811e44218

SHA256
d6a5e6af2b0e32b984b19e74855658d808e65fe05fa4ad7b44c11b50ace12f63

SHA512
ef9487ec47975d5990c3690ef4cffbec10fc246ba9e0987f83f5d127cf10b72d02a11210cc90436830598e10496283ed469dc1b58319100fdb27b28c0c5ba3f1

Download Submit
C:\Windows\SysWOW64\Oekpkigo.exe

Filesize
400KB

MD5
1505c23a812bbd8e874f0faf08f03f57

SHA1
7aba85883ef515151aa0badde33699d811e44218

SHA256
d6a5e6af2b0e32b984b19e74855658d808e65fe05fa4ad7b44c11b50ace12f63

SHA512
ef9487ec47975d5990c3690ef4cffbec10fc246ba9e0987f83f5d127cf10b72d02a11210cc90436830598e10496283ed469dc1b58319100fdb27b28c0c5ba3f1

Download Submit
C:\Windows\SysWOW64\Oocddono.exe

Filesize
400KB

MD5
ded778cfd85eace3480258d4a1159742

SHA1
c18dd1542862a20065caf34c3490a8e9bafe01b9

SHA256
3978e9eba984cfc30a3489783c25f9cf65922336dcf344ab6a84e78a8a9aa5a4

SHA512
b4e6894e6621356ed962740c01241e5458324b7e1013787b54993aebfc61e7900706c45ed464766df826039c1b94682092d7319ffabac7e4c65d61324a4193be

Download Submit
C:\Windows\SysWOW64\Oocddono.exe

Filesize
400KB

MD5
ded778cfd85eace3480258d4a1159742

SHA1
c18dd1542862a20065caf34c3490a8e9bafe01b9

SHA256
3978e9eba984cfc30a3489783c25f9cf65922336dcf344ab6a84e78a8a9aa5a4

SHA512
b4e6894e6621356ed962740c01241e5458324b7e1013787b54993aebfc61e7900706c45ed464766df826039c1b94682092d7319ffabac7e4c65d61324a4193be

Download Submit
C:\Windows\SysWOW64\Oofaiokl.exe

Filesize
400KB

MD5
7dfb4f60c8a4a8cdfceaa0be50305417

SHA1
ec4894a932a9cef4ae1cd4de9b2a928a49910c62

SHA256
443d50895b25c03456ee8f031457c9246a3acd88fa1acbbe94456dad5ec3b7c0

SHA512
5cea2a124d9f69a0cd7b3879943ed5b0b6c65bc844910db36d10160d9109be6d9288f145582c7a7356825dcfda4670c14b7ee57e9fb48fc60db3a28eaeee251b

Download Submit
C:\Windows\SysWOW64\Oofaiokl.exe

Filesize
400KB

MD5
7dfb4f60c8a4a8cdfceaa0be50305417

SHA1
ec4894a932a9cef4ae1cd4de9b2a928a49910c62

SHA256
443d50895b25c03456ee8f031457c9246a3acd88fa1acbbe94456dad5ec3b7c0

SHA512
5cea2a124d9f69a0cd7b3879943ed5b0b6c65bc844910db36d10160d9109be6d9288f145582c7a7356825dcfda4670c14b7ee57e9fb48fc60db3a28eaeee251b

Download Submit
C:\Windows\SysWOW64\Opemca32.exe

Filesize
400KB

MD5
022abd28d8f4448cae5245f829b304c3

SHA1
3ca55e2880656aac9234405c3c76878b23b1fa5f

SHA256
cb973aa326e448b2771ca75dc2b296c6d8611929cdbe56a742f465b214bc0991

SHA512
8594aad0e16b3c259a16095c011c685eb5a0ddae8a075e0f62fa3ef85e5876e9789bd14b6a513d07438f3b1c47c67012ed3cdf17c6271812f00ae805f811a666

Download Submit
C:\Windows\SysWOW64\Opemca32.exe

Filesize
400KB

MD5
022abd28d8f4448cae5245f829b304c3

SHA1
3ca55e2880656aac9234405c3c76878b23b1fa5f

SHA256
cb973aa326e448b2771ca75dc2b296c6d8611929cdbe56a742f465b214bc0991

SHA512
8594aad0e16b3c259a16095c011c685eb5a0ddae8a075e0f62fa3ef85e5876e9789bd14b6a513d07438f3b1c47c67012ed3cdf17c6271812f00ae805f811a666

Download Submit
C:\Windows\SysWOW64\Pcmlfl32.exe

Filesize
400KB

MD5
65e66119dc44e0f55a7ca3a5f8056fee

SHA1
6ff3136144020f8b535979852d53deabbcca1fb1

SHA256
0660bda1354e4c96bf29cdeb1e1857fcfcac829e2179caac27fd0f6149bd8a1a

SHA512
8c83e33b58cf1625fbbeb51d76504a03342da4cccb04d9d36de3c4be93f4da7c331e7c84b86ffc547cc559b3387c92d1bf17d259c34249deda0e899d8b129cc2

Download Submit
C:\Windows\SysWOW64\Pcmlfl32.exe

Filesize
400KB

MD5
65e66119dc44e0f55a7ca3a5f8056fee

SHA1
6ff3136144020f8b535979852d53deabbcca1fb1

SHA256
0660bda1354e4c96bf29cdeb1e1857fcfcac829e2179caac27fd0f6149bd8a1a

SHA512
8c83e33b58cf1625fbbeb51d76504a03342da4cccb04d9d36de3c4be93f4da7c331e7c84b86ffc547cc559b3387c92d1bf17d259c34249deda0e899d8b129cc2

Download Submit
C:\Windows\SysWOW64\Pedbahod.exe

Filesize
400KB

MD5
de7d9dd9826bfd2005ea014f38d82d6d

SHA1
b808afa0b1b79708a69980ca28cddcb48cf6bbe3

SHA256
a8bf6bb51b5ac85692ea6d787317c1ae5dc6f7860186886e2887fab40c38a45b

SHA512
e2050f5ba8d8733501a8058d55959031108dbeb98a577528e3a371a5fb457c8864b2ab5b2cffd35268f5b2ce1148c4ec01eeb950855cfb8f3abe368037f355d4

Download Submit
C:\Windows\SysWOW64\Pedbahod.exe

Filesize
400KB

MD5
de7d9dd9826bfd2005ea014f38d82d6d

SHA1
b808afa0b1b79708a69980ca28cddcb48cf6bbe3

SHA256
a8bf6bb51b5ac85692ea6d787317c1ae5dc6f7860186886e2887fab40c38a45b

SHA512
e2050f5ba8d8733501a8058d55959031108dbeb98a577528e3a371a5fb457c8864b2ab5b2cffd35268f5b2ce1148c4ec01eeb950855cfb8f3abe368037f355d4

Download Submit
C:\Windows\SysWOW64\Plagcbdn.exe

Filesize
400KB

MD5
14a31eee8efaf7c0197c392d5d836051

SHA1
d97b89e53a6b4044e63b594d3c224f7b6657db12

SHA256
cd6a77fdbc87a0d2d921564c1813674f0d71d25319ff6b71651e6883c7115f38

SHA512
ba1930a87d4c6d0336d49d7ef1c97ef83e4a0b64d8c9accce14d4a6fd8a9064e03beaa5c5cf66811e4a1f1da94c42b1142ac462cecc5dc2031b100b559c5032d

Download Submit
C:\Windows\SysWOW64\Plagcbdn.exe

Filesize
400KB

MD5
14a31eee8efaf7c0197c392d5d836051

SHA1
d97b89e53a6b4044e63b594d3c224f7b6657db12

SHA256
cd6a77fdbc87a0d2d921564c1813674f0d71d25319ff6b71651e6883c7115f38

SHA512
ba1930a87d4c6d0336d49d7ef1c97ef83e4a0b64d8c9accce14d4a6fd8a9064e03beaa5c5cf66811e4a1f1da94c42b1142ac462cecc5dc2031b100b559c5032d

Download Submit
C:\Windows\SysWOW64\Pleaoa32.exe

Filesize
400KB

MD5
d7b60a5590b6f69c0851e129f767b6de

SHA1
bc4c26f6c36db1026baee44f47d8a3d80492f9ff

SHA256
fb482d2a2b1b86ca0779d470d9362d0893d10bf550c12f90d9ac4309ac344ab2

SHA512
3c47a0221f48563bf71dc028278cacec4fe91626ec587a2eaca9030918f06cedeb46afcf4a47b40351448cf0c88130de292204a620e51fde8a2fe42b828fd94a

Download Submit
C:\Windows\SysWOW64\Pleaoa32.exe

Filesize
400KB

MD5
d7b60a5590b6f69c0851e129f767b6de

SHA1
bc4c26f6c36db1026baee44f47d8a3d80492f9ff

SHA256
fb482d2a2b1b86ca0779d470d9362d0893d10bf550c12f90d9ac4309ac344ab2

SHA512
3c47a0221f48563bf71dc028278cacec4fe91626ec587a2eaca9030918f06cedeb46afcf4a47b40351448cf0c88130de292204a620e51fde8a2fe42b828fd94a

Download Submit
C:\Windows\SysWOW64\Pomgjn32.exe

Filesize
400KB

MD5
8ae4166253cf15389b3025d88c948be1

SHA1
3f27db16b02cbe2bd75edb9f674d72169d0d90ef

SHA256
0248c2254a2d1881ff4c7235cc5b9759ccd63627558498ae3a2e914409c4a24e

SHA512
9e4f5ae08849690e92fe415d41621a71bf23527d4a2ed0301151620d825efd2f86ad76b9513922f4d9c7e3319358129f334ff6faf727c55aff308a87ee61088b

Download Submit
C:\Windows\SysWOW64\Pomgjn32.exe

Filesize
400KB

MD5
8ae4166253cf15389b3025d88c948be1

SHA1
3f27db16b02cbe2bd75edb9f674d72169d0d90ef

SHA256
0248c2254a2d1881ff4c7235cc5b9759ccd63627558498ae3a2e914409c4a24e

SHA512
9e4f5ae08849690e92fe415d41621a71bf23527d4a2ed0301151620d825efd2f86ad76b9513922f4d9c7e3319358129f334ff6faf727c55aff308a87ee61088b

Download Submit
C:\Windows\SysWOW64\Qcbfakec.exe

Filesize
400KB

MD5
eee1b75a6eab2d8d8346254a6ff99e66

SHA1
255390a9b33c3429a67638be4f537b5e200c5ef6

SHA256
fa494754b034d3bf5fce895d1688b770f94ad208a77a43e4ab9d0d54c4dcd393

SHA512
c362589597adc8ebc529ddd76fcb0485e383223f48761a8ee3fda7359e2a43bd3caae6ed521b4abaa825ef9213f6bcc5895ee14d85279d543dd34483c0ffd05b

Download Submit
C:\Windows\SysWOW64\Qcbfakec.exe

Filesize
400KB

MD5
eee1b75a6eab2d8d8346254a6ff99e66

SHA1
255390a9b33c3429a67638be4f537b5e200c5ef6

SHA256
fa494754b034d3bf5fce895d1688b770f94ad208a77a43e4ab9d0d54c4dcd393

SHA512
c362589597adc8ebc529ddd76fcb0485e383223f48761a8ee3fda7359e2a43bd3caae6ed521b4abaa825ef9213f6bcc5895ee14d85279d543dd34483c0ffd05b

Download Submit
C:\Windows\SysWOW64\Qlmgopjq.exe

Filesize
400KB

MD5
ff1fa9b73a621b4a2c17cf0b16f35887

SHA1
8b216697be3878f6f94c695883963b83421462af

SHA256
989b23d5cd045b0f2dcb9cee66d34ee69ca9131d328dc7e9ba5c2c504346d7dd

SHA512
213c63e1e087a7db4470d02897fd22ef589e72013504fed99449715af51ca1e1337c8a98d53baef7d2d37a8af702fb3eafd1d13d1c0de1320d5e4f7d65502372

Download Submit
C:\Windows\SysWOW64\Qlmgopjq.exe

Filesize
400KB

MD5
ff1fa9b73a621b4a2c17cf0b16f35887

SHA1
8b216697be3878f6f94c695883963b83421462af

SHA256
989b23d5cd045b0f2dcb9cee66d34ee69ca9131d328dc7e9ba5c2c504346d7dd

SHA512
213c63e1e087a7db4470d02897fd22ef589e72013504fed99449715af51ca1e1337c8a98d53baef7d2d37a8af702fb3eafd1d13d1c0de1320d5e4f7d65502372

Download Submit
memory/688-462-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/692-47-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/892-193-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/928-152-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/944-293-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/984-402-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1028-326-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1032-40-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1096-372-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1180-338-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1516-390-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1580-128-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1584-313-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1672-267-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1696-189-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1716-408-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1748-298-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/1844-281-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2124-484-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2224-201-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2452-103-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2532-0-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2732-426-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2836-266-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/2952-55-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3136-64-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3140-15-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3144-119-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3188-96-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3192-327-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3376-277-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3472-384-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3504-72-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3728-450-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3748-31-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3768-136-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3948-438-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3956-79-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/3996-240-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4000-371-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4020-250-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4092-176-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4128-28-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4156-432-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4264-369-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4308-478-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4412-444-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4440-225-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4608-420-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4636-456-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4644-7-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4660-111-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4748-167-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4804-468-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4812-378-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4820-144-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4828-307-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4840-396-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4888-88-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4912-160-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4936-364-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4968-414-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/5052-300-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/5096-210-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads