463faefc7686aecebc202d2444ae237124978fd16a223b132c85ac14c29a5fd7

Analysis

max time kernel
168s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 20:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5bb1444e45b006817a7c64a262e6220.exe
Size

896KB
MD5

e5bb1444e45b006817a7c64a262e6220
SHA1

783f338a38b96af3f544f2a104049f18fea77b7b
SHA256

463faefc7686aecebc202d2444ae237124978fd16a223b132c85ac14c29a5fd7
SHA512

f5e79659840398a16655fd1d511991f5321c80aa280af1694eea3e6104c1f1e93d3fb4676f66f60945ab644564a89e499f5eed11a52915a7848439d6ae3d723d
SSDEEP

24576:Dj9TRTGryZ5d9TRTGryaITRTGryZ5d9TRTGryeLTRTGryZ5d9TRTGryaITRTGryb:Dj99bD99wI9bD99e9bD99wI9bD99

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alhpkldp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aejmdegn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkbddo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bigbgehl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbnggpfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgfqgkib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngikpjml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdhkchlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olgnlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mllcocna.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oplfekdp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgaiqian.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nejpckgc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfpidk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfmigmgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifbbbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ioeineap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdjbel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afnefieo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mniafbfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pklkmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkbddo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddfikaeq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkchpoka.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dalhgfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dibmfb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejhkdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqnofkkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmnlnfcb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kipkaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pekkhn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngjcgdba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klhdjj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihagfb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caojigoh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klhdjj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klbgpi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alhpkldp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apbngn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qcbfjqkp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fceihh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Peajngoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lejngd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ecpmod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhiocdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccopfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifcpgiji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibijbc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifbbbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Peaokh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klpjji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpchbhjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qkqdnkge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnhlgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pekkhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mphfjhjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfoahd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhlpom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lemhnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfoclflo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jqihjbod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dojqcjgi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oegejc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfopcgpk.exe

Executes dropped EXE 64 IoCs

pid	Process
4792	Oeffnl32.exe
812	Pfpidk32.exe
808	Afnefieo.exe
116	Anncek32.exe
2004	Ciogobcm.exe
1112	Cldjkl32.exe
3188	Dblnid32.exe
3220	Fhiphi32.exe
4848	Geklckkd.exe
1248	Labkempb.exe
4664	Lipmoo32.exe
2896	Mpchbhjl.exe
1416	Pgihanii.exe
1692	Qkqdnkge.exe
3436	Ajodef32.exe
4436	Bdgehobe.exe
4964	Cnhlgc32.exe
1572	Cjaiac32.exe
3512	Dgmpkg32.exe
3460	Enedio32.exe
4212	Eecfah32.exe
2532	Hebkid32.exe
1252	Ijgjpaao.exe
4124	Jfdafa32.exe
4236	Lbnggpfj.exe
3540	Lbcabo32.exe
4784	Mbjgcnll.exe
3384	Ofooqinh.exe
4176	Qibmoa32.exe
3656	Alhpkldp.exe
4704	Bdhkchlg.exe
3400	Bnehgmob.exe
1520	Cjofambd.exe
3724	Cnokmkfh.exe
4332	Dkehlo32.exe
4316	Dqbadf32.exe
2792	Djjemlhf.exe
3680	Dedceddg.exe
5008	Eakdje32.exe
1352	Fnkdpgnh.exe
3140	Gmggac32.exe
3768	Gjpaffhl.exe
1800	Hmecba32.exe
3276	Haeino32.exe
2868	Ikpjmd32.exe
4344	Ionbcb32.exe
3332	Ikechced.exe
1236	Lkchpoka.exe
1260	Lfpcngdo.exe
2608	Mfgiof32.exe
5104	Mihbpalh.exe
1356	Mflbjejb.exe
4424	Neaokboj.exe
1064	Neclpamg.exe
1840	Npkmcj32.exe
2308	Npmjij32.exe
1440	Obnbjdfi.exe
4668	Pekkhn32.exe
3440	Aofemaog.exe
4216	Bgfpdmho.exe
4156	Cllkcbnl.exe
1392	Dlfniafa.exe
3844	Djlkhe32.exe
4272	Eqkmpo32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ojopki32.exe	Nkqpcnig.exe
File created	C:\Windows\SysWOW64\Dlnjek32.dll	Hnokeqll.exe
File created	C:\Windows\SysWOW64\Olgnlb32.exe	Okbhgq32.exe
File opened for modification	C:\Windows\SysWOW64\Pkngco32.exe	Peaokh32.exe
File created	C:\Windows\SysWOW64\Hbhbfh32.dll	Bdbndjld.exe
File created	C:\Windows\SysWOW64\Jenmlmll.exe	Jpqedfne.exe
File opened for modification	C:\Windows\SysWOW64\Afnefieo.exe	Pfpidk32.exe
File created	C:\Windows\SysWOW64\Kdfmcobk.exe	Kojdkhdd.exe
File opened for modification	C:\Windows\SysWOW64\Lemhnn32.exe	Kaophp32.exe
File created	C:\Windows\SysWOW64\Pnmojp32.exe	Phajgf32.exe
File created	C:\Windows\SysWOW64\Cgaiqian.exe	Baephacf.exe
File created	C:\Windows\SysWOW64\Ckgmjh32.dll	Ioeineap.exe
File opened for modification	C:\Windows\SysWOW64\Afpjoaeo.exe	Aodejohd.exe
File created	C:\Windows\SysWOW64\Cidkie32.dll	Dqmjqb32.exe
File created	C:\Windows\SysWOW64\Dacmol32.dll	Pmmelo32.exe
File opened for modification	C:\Windows\SysWOW64\Dpmknf32.exe	Djqbeonf.exe
File created	C:\Windows\SysWOW64\Lhjafhlf.dll	Ofooqinh.exe
File created	C:\Windows\SysWOW64\Npglho32.dll	Odkjgm32.exe
File opened for modification	C:\Windows\SysWOW64\Ceqngekl.exe	Cenaaf32.exe
File opened for modification	C:\Windows\SysWOW64\Ajfejknb.exe	Ihhmaehj.exe
File opened for modification	C:\Windows\SysWOW64\Cgdefhok.exe	Cpjmjn32.exe
File opened for modification	C:\Windows\SysWOW64\Klbgpi32.exe	Klpjji32.exe
File created	C:\Windows\SysWOW64\Fcqlqnpo.dll	Ciogobcm.exe
File opened for modification	C:\Windows\SysWOW64\Ofooqinh.exe	Mbjgcnll.exe
File created	C:\Windows\SysWOW64\Jibapflb.dll	Hdhlhd32.exe
File created	C:\Windows\SysWOW64\Lenpnjke.dll	Jkgpleaf.exe
File created	C:\Windows\SysWOW64\Mklkepal.exe	Ljfhjn32.exe
File created	C:\Windows\SysWOW64\Domabi32.dll	Cdicdi32.exe
File created	C:\Windows\SysWOW64\Cldjkl32.exe	Ciogobcm.exe
File created	C:\Windows\SysWOW64\Gdcdlb32.exe	Gfngke32.exe
File opened for modification	C:\Windows\SysWOW64\Eefhcimp.exe	Edgkif32.exe
File created	C:\Windows\SysWOW64\Hmblee32.dll	Ibijbc32.exe
File created	C:\Windows\SysWOW64\Fjjccl32.dll	Kihdqkaf.exe
File created	C:\Windows\SysWOW64\Lkjlciem.exe	Knfliefc.exe
File created	C:\Windows\SysWOW64\Nejpckgc.exe	Njdlfbgm.exe
File created	C:\Windows\SysWOW64\Mnjmbl32.dll	Njdlfbgm.exe
File created	C:\Windows\SysWOW64\Jbkjcgaj.exe	Jfopcgpk.exe
File created	C:\Windows\SysWOW64\Nkqpcnig.exe	Ndpafe32.exe
File created	C:\Windows\SysWOW64\Cigknc32.exe	Cdjbel32.exe
File opened for modification	C:\Windows\SysWOW64\Aklddmep.exe	Qcobjk32.exe
File created	C:\Windows\SysWOW64\Fbkblb32.exe	Fkajoiok.exe
File created	C:\Windows\SysWOW64\Bmijllek.dll	Dcgjie32.exe
File opened for modification	C:\Windows\SysWOW64\Ihhmaehj.exe	Hiofeigg.exe
File opened for modification	C:\Windows\SysWOW64\Blenhmph.exe	Bplammmf.exe
File created	C:\Windows\SysWOW64\Iabhnedc.dll	Mlflog32.exe
File created	C:\Windows\SysWOW64\Jqogfdbb.dll	Iapjeq32.exe
File created	C:\Windows\SysWOW64\Lemjlcgo.exe	Lejngd32.exe
File opened for modification	C:\Windows\SysWOW64\Hfmigmgf.exe	Hhihnihm.exe
File created	C:\Windows\SysWOW64\Kqlbncjp.dll	Efopeeao.exe
File created	C:\Windows\SysWOW64\Fjccpo32.exe	Fcikcekm.exe
File opened for modification	C:\Windows\SysWOW64\Hbanfk32.exe	Hmdend32.exe
File created	C:\Windows\SysWOW64\Gdobgp32.exe	Giinjg32.exe
File created	C:\Windows\SysWOW64\Mfgiof32.exe	Lfpcngdo.exe
File created	C:\Windows\SysWOW64\Folcdd32.dll	Oooodcci.exe
File created	C:\Windows\SysWOW64\Ifihbhkb.dll	Jbkjcgaj.exe
File opened for modification	C:\Windows\SysWOW64\Nbljaf32.exe	Mehjhbma.exe
File created	C:\Windows\SysWOW64\Gpqjaanf.exe	Gfhehlhe.exe
File opened for modification	C:\Windows\SysWOW64\Mklkepal.exe	Ljfhjn32.exe
File created	C:\Windows\SysWOW64\Geklckkd.exe	Fhiphi32.exe
File opened for modification	C:\Windows\SysWOW64\Cjaiac32.exe	Cnhlgc32.exe
File created	C:\Windows\SysWOW64\Pifjfofk.dll	Bdapon32.exe
File created	C:\Windows\SysWOW64\Ibdiln32.exe	Hfmigmgf.exe
File created	C:\Windows\SysWOW64\Eainnn32.exe	Ejofacfb.exe
File created	C:\Windows\SysWOW64\Bbmjjk32.exe	Afclpk32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lenpnjke.dll"	Jkgpleaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjnmmcel.dll"	Fkgiea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ingkdn32.dll"	Cldjkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kacpncqg.dll"	Gglpbh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgdpgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgmbimbb.dll"	Bhmbjb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dojqcjgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lbnggpfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fngpnm32.dll"	Neaokboj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmnmqdee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndobfjpn.dll"	Heqnokaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkijcp32.dll"	Kajfmqda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dddajj32.dll"	Ionbcb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmmelo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ejofacfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eainnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpihpm32.dll"	Ppphkq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaoigndf.dll"	Ifbbbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmagah32.dll"	Lnnakg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blemnk32.dll"	Fcikcekm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Meembc32.dll"	Lemjlcgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dabhmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpqfhc32.dll"	Bacjmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npkmcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Coepob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbdjeiek.dll"	Hheoci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgkoolil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmggbcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Habndbpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnlpff32.dll"	Mgagll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfmigmgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Plcdbghi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqlbncjp.dll"	Efopeeao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgfblh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Folcdd32.dll"	Oooodcci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djelqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eakdje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gcqhcgqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifihbhkb.dll"	Jbkjcgaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmnlnfcb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgefogop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbhjqp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfpmglkb.dll"	Jenmlmll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omkmcpgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdgehobe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edgkif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnfege32.dll"	Mlnpdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlnfgdnn.dll"	Pdkcnklf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndpelmaa.dll"	Hfmigmgf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcgnkgkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Apmhbf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	e5bb1444e45b006817a7c64a262e6220.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ongamagn.dll"	Gmqgjl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hhmmffbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbkjcgaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkeonggf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgmlehnj.dll"	Medqmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fpjjkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jaeadj32.dll"	Bmggbcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnokmkfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfopcgpk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Elpppcdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Niqgpncn.dll"	Fgiqocoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibdmph32.dll"	Maealn32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4792	4820	e5bb1444e45b006817a7c64a262e6220.exe	94
PID 4820 wrote to memory of 4792	4820	e5bb1444e45b006817a7c64a262e6220.exe	94
PID 4820 wrote to memory of 4792	4820	e5bb1444e45b006817a7c64a262e6220.exe	94
PID 4792 wrote to memory of 812	4792	Oeffnl32.exe	96
PID 4792 wrote to memory of 812	4792	Oeffnl32.exe	96
PID 4792 wrote to memory of 812	4792	Oeffnl32.exe	96
PID 812 wrote to memory of 808	812	Pfpidk32.exe	97
PID 812 wrote to memory of 808	812	Pfpidk32.exe	97
PID 812 wrote to memory of 808	812	Pfpidk32.exe	97
PID 808 wrote to memory of 116	808	Afnefieo.exe	98
PID 808 wrote to memory of 116	808	Afnefieo.exe	98
PID 808 wrote to memory of 116	808	Afnefieo.exe	98
PID 116 wrote to memory of 2004	116	Anncek32.exe	99
PID 116 wrote to memory of 2004	116	Anncek32.exe	99
PID 116 wrote to memory of 2004	116	Anncek32.exe	99
PID 2004 wrote to memory of 1112	2004	Ciogobcm.exe	100
PID 2004 wrote to memory of 1112	2004	Ciogobcm.exe	100
PID 2004 wrote to memory of 1112	2004	Ciogobcm.exe	100
PID 1112 wrote to memory of 3188	1112	Cldjkl32.exe	101
PID 1112 wrote to memory of 3188	1112	Cldjkl32.exe	101
PID 1112 wrote to memory of 3188	1112	Cldjkl32.exe	101
PID 3188 wrote to memory of 3220	3188	Dblnid32.exe	102
PID 3188 wrote to memory of 3220	3188	Dblnid32.exe	102
PID 3188 wrote to memory of 3220	3188	Dblnid32.exe	102
PID 3220 wrote to memory of 4848	3220	Fhiphi32.exe	103
PID 3220 wrote to memory of 4848	3220	Fhiphi32.exe	103
PID 3220 wrote to memory of 4848	3220	Fhiphi32.exe	103
PID 4848 wrote to memory of 1248	4848	Geklckkd.exe	104
PID 4848 wrote to memory of 1248	4848	Geklckkd.exe	104
PID 4848 wrote to memory of 1248	4848	Geklckkd.exe	104
PID 1248 wrote to memory of 4664	1248	Labkempb.exe	105
PID 1248 wrote to memory of 4664	1248	Labkempb.exe	105
PID 1248 wrote to memory of 4664	1248	Labkempb.exe	105
PID 4664 wrote to memory of 2896	4664	Lipmoo32.exe	106
PID 4664 wrote to memory of 2896	4664	Lipmoo32.exe	106
PID 4664 wrote to memory of 2896	4664	Lipmoo32.exe	106
PID 2896 wrote to memory of 1416	2896	Mpchbhjl.exe	107
PID 2896 wrote to memory of 1416	2896	Mpchbhjl.exe	107
PID 2896 wrote to memory of 1416	2896	Mpchbhjl.exe	107
PID 1416 wrote to memory of 1692	1416	Pgihanii.exe	108
PID 1416 wrote to memory of 1692	1416	Pgihanii.exe	108
PID 1416 wrote to memory of 1692	1416	Pgihanii.exe	108
PID 1692 wrote to memory of 3436	1692	Qkqdnkge.exe	109
PID 1692 wrote to memory of 3436	1692	Qkqdnkge.exe	109
PID 1692 wrote to memory of 3436	1692	Qkqdnkge.exe	109
PID 3436 wrote to memory of 4436	3436	Ajodef32.exe	110
PID 3436 wrote to memory of 4436	3436	Ajodef32.exe	110
PID 3436 wrote to memory of 4436	3436	Ajodef32.exe	110
PID 4436 wrote to memory of 4964	4436	Bdgehobe.exe	111
PID 4436 wrote to memory of 4964	4436	Bdgehobe.exe	111
PID 4436 wrote to memory of 4964	4436	Bdgehobe.exe	111
PID 4964 wrote to memory of 1572	4964	Cnhlgc32.exe	112
PID 4964 wrote to memory of 1572	4964	Cnhlgc32.exe	112
PID 4964 wrote to memory of 1572	4964	Cnhlgc32.exe	112
PID 1572 wrote to memory of 3512	1572	Cjaiac32.exe	114
PID 1572 wrote to memory of 3512	1572	Cjaiac32.exe	114
PID 1572 wrote to memory of 3512	1572	Cjaiac32.exe	114
PID 3512 wrote to memory of 3460	3512	Dgmpkg32.exe	115
PID 3512 wrote to memory of 3460	3512	Dgmpkg32.exe	115
PID 3512 wrote to memory of 3460	3512	Dgmpkg32.exe	115
PID 3460 wrote to memory of 4212	3460	Enedio32.exe	116
PID 3460 wrote to memory of 4212	3460	Enedio32.exe	116
PID 3460 wrote to memory of 4212	3460	Enedio32.exe	116
PID 4212 wrote to memory of 2532	4212	Eecfah32.exe	117

C:\Users\Admin\AppData\Local\Temp\e5bb1444e45b006817a7c64a262e6220.exe
"C:\Users\Admin\AppData\Local\Temp\e5bb1444e45b006817a7c64a262e6220.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Windows\SysWOW64\Oeffnl32.exe
  C:\Windows\system32\Oeffnl32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\SysWOW64\Pfpidk32.exe
    C:\Windows\system32\Pfpidk32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:812
  - - C:\Windows\SysWOW64\Afnefieo.exe
      C:\Windows\system32\Afnefieo.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:808
    - - C:\Windows\SysWOW64\Anncek32.exe
        
        C:\Windows\system32\Anncek32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:116
      - C:\Windows\SysWOW64\Ciogobcm.exe
        
        C:\Windows\system32\Ciogobcm.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2004
        
        C:\Windows\SysWOW64\Cldjkl32.exe
        
        C:\Windows\system32\Cldjkl32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Windows\SysWOW64\Dblnid32.exe
        
        C:\Windows\system32\Dblnid32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3188
        
        C:\Windows\SysWOW64\Fhiphi32.exe
        
        C:\Windows\system32\Fhiphi32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3220
        
        C:\Windows\SysWOW64\Geklckkd.exe
        
        C:\Windows\system32\Geklckkd.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4848
        
        C:\Windows\SysWOW64\Labkempb.exe
        
        C:\Windows\system32\Labkempb.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Windows\SysWOW64\Lipmoo32.exe
        
        C:\Windows\system32\Lipmoo32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SysWOW64\Mpchbhjl.exe
        
        C:\Windows\system32\Mpchbhjl.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\SysWOW64\Pgihanii.exe
        
        C:\Windows\system32\Pgihanii.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1416
        
        C:\Windows\SysWOW64\Qkqdnkge.exe
        
        C:\Windows\system32\Qkqdnkge.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1692
        
        C:\Windows\SysWOW64\Ajodef32.exe
        
        C:\Windows\system32\Ajodef32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3436
        
        C:\Windows\SysWOW64\Bdgehobe.exe
        
        C:\Windows\system32\Bdgehobe.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\SysWOW64\Cnhlgc32.exe
        
        C:\Windows\system32\Cnhlgc32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SysWOW64\Cjaiac32.exe
        
        C:\Windows\system32\Cjaiac32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Windows\SysWOW64\Dgmpkg32.exe
        
        C:\Windows\system32\Dgmpkg32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3512
        
        C:\Windows\SysWOW64\Enedio32.exe
        
        C:\Windows\system32\Enedio32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3460
        
        C:\Windows\SysWOW64\Eecfah32.exe
        
        C:\Windows\system32\Eecfah32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4212
        
        C:\Windows\SysWOW64\Hebkid32.exe
        
        C:\Windows\system32\Hebkid32.exe
        23⤵
        Executes dropped EXE
        
        PID:2532
        
        C:\Windows\SysWOW64\Ijgjpaao.exe
        
        C:\Windows\system32\Ijgjpaao.exe
        24⤵
        Executes dropped EXE
        
        PID:1252
        
        C:\Windows\SysWOW64\Jfdafa32.exe
        
        C:\Windows\system32\Jfdafa32.exe
        25⤵
        Executes dropped EXE
        
        PID:4124
        
        C:\Windows\SysWOW64\Lbnggpfj.exe
        
        C:\Windows\system32\Lbnggpfj.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4236
        
        C:\Windows\SysWOW64\Lbcabo32.exe
        
        C:\Windows\system32\Lbcabo32.exe
        27⤵
        Executes dropped EXE
        
        PID:3540
        
        C:\Windows\SysWOW64\Mbjgcnll.exe
        
        C:\Windows\system32\Mbjgcnll.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4784
        
        C:\Windows\SysWOW64\Ofooqinh.exe
        
        C:\Windows\system32\Ofooqinh.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3384
        
        C:\Windows\SysWOW64\Qibmoa32.exe
        
        C:\Windows\system32\Qibmoa32.exe
        30⤵
        Executes dropped EXE
        
        PID:4176
        
        C:\Windows\SysWOW64\Alhpkldp.exe
        
        C:\Windows\system32\Alhpkldp.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3656
        
        C:\Windows\SysWOW64\Bdhkchlg.exe
        
        C:\Windows\system32\Bdhkchlg.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4704
        
        C:\Windows\SysWOW64\Bnehgmob.exe
        
        C:\Windows\system32\Bnehgmob.exe
        33⤵
        Executes dropped EXE
        
        PID:3400
        
        C:\Windows\SysWOW64\Cjofambd.exe
        
        C:\Windows\system32\Cjofambd.exe
        34⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Windows\SysWOW64\Cnokmkfh.exe
        
        C:\Windows\system32\Cnokmkfh.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3724
        
        C:\Windows\SysWOW64\Dkehlo32.exe
        
        C:\Windows\system32\Dkehlo32.exe
        36⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\Dqbadf32.exe
        
        C:\Windows\system32\Dqbadf32.exe
        37⤵
        Executes dropped EXE
        
        PID:4316
        
        C:\Windows\SysWOW64\Djjemlhf.exe
        
        C:\Windows\system32\Djjemlhf.exe
        38⤵
        Executes dropped EXE
        
        PID:2792
        
        C:\Windows\SysWOW64\Dedceddg.exe
        
        C:\Windows\system32\Dedceddg.exe
        39⤵
        Executes dropped EXE
        
        PID:3680
        
        C:\Windows\SysWOW64\Eakdje32.exe
        
        C:\Windows\system32\Eakdje32.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5008
        
        C:\Windows\SysWOW64\Fnkdpgnh.exe
        
        C:\Windows\system32\Fnkdpgnh.exe
        41⤵
        Executes dropped EXE
        
        PID:1352
        
        C:\Windows\SysWOW64\Gmggac32.exe
        
        C:\Windows\system32\Gmggac32.exe
        42⤵
        Executes dropped EXE
        
        PID:3140
        
        C:\Windows\SysWOW64\Gjpaffhl.exe
        
        C:\Windows\system32\Gjpaffhl.exe
        43⤵
        Executes dropped EXE
        
        PID:3768
        
        C:\Windows\SysWOW64\Hmecba32.exe
        
        C:\Windows\system32\Hmecba32.exe
        44⤵
        Executes dropped EXE
        
        PID:1800
        
        C:\Windows\SysWOW64\Haeino32.exe
        
        C:\Windows\system32\Haeino32.exe
        45⤵
        Executes dropped EXE
        
        PID:3276
        
        C:\Windows\SysWOW64\Ikpjmd32.exe
        
        C:\Windows\system32\Ikpjmd32.exe
        46⤵
        Executes dropped EXE
        
        PID:2868
        
        C:\Windows\SysWOW64\Ionbcb32.exe
        
        C:\Windows\system32\Ionbcb32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4344
        
        C:\Windows\SysWOW64\Ikechced.exe
        
        C:\Windows\system32\Ikechced.exe
        48⤵
        Executes dropped EXE
        
        PID:3332
        
        C:\Windows\SysWOW64\Lkchpoka.exe
        
        C:\Windows\system32\Lkchpoka.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1236
        
        C:\Windows\SysWOW64\Lfpcngdo.exe
        
        C:\Windows\system32\Lfpcngdo.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1260
        
        C:\Windows\SysWOW64\Mfgiof32.exe
        
        C:\Windows\system32\Mfgiof32.exe
        51⤵
        Executes dropped EXE
        
        PID:2608
        
        C:\Windows\SysWOW64\Mihbpalh.exe
        
        C:\Windows\system32\Mihbpalh.exe
        52⤵
        Executes dropped EXE
        
        PID:5104
        
        C:\Windows\SysWOW64\Mflbjejb.exe
        
        C:\Windows\system32\Mflbjejb.exe
        53⤵
        Executes dropped EXE
        
        PID:1356
        
        C:\Windows\SysWOW64\Neaokboj.exe
        
        C:\Windows\system32\Neaokboj.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4424
        
        C:\Windows\SysWOW64\Neclpamg.exe
        
        C:\Windows\system32\Neclpamg.exe
        55⤵
        Executes dropped EXE
        
        PID:1064
        
        C:\Windows\SysWOW64\Npkmcj32.exe
        
        C:\Windows\system32\Npkmcj32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1840
        
        C:\Windows\SysWOW64\Npmjij32.exe
        
        C:\Windows\system32\Npmjij32.exe
        57⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Obnbjdfi.exe
        
        C:\Windows\system32\Obnbjdfi.exe
        58⤵
        Executes dropped EXE
        
        PID:1440
        
        C:\Windows\SysWOW64\Pekkhn32.exe
        
        C:\Windows\system32\Pekkhn32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4668
        
        C:\Windows\SysWOW64\Aofemaog.exe
        
        C:\Windows\system32\Aofemaog.exe
        60⤵
        Executes dropped EXE
        
        PID:3440
        
        C:\Windows\SysWOW64\Bgfpdmho.exe
        
        C:\Windows\system32\Bgfpdmho.exe
        61⤵
        Executes dropped EXE
        
        PID:4216
        
        C:\Windows\SysWOW64\Cllkcbnl.exe
        
        C:\Windows\system32\Cllkcbnl.exe
        62⤵
        Executes dropped EXE
        
        PID:4156
        
        C:\Windows\SysWOW64\Dlfniafa.exe
        
        C:\Windows\system32\Dlfniafa.exe
        63⤵
        Executes dropped EXE
        
        PID:1392
        
        C:\Windows\SysWOW64\Djlkhe32.exe
        
        C:\Windows\system32\Djlkhe32.exe
        64⤵
        Executes dropped EXE
        
        PID:3844
        
        C:\Windows\SysWOW64\Eqkmpo32.exe
        
        C:\Windows\system32\Eqkmpo32.exe
        65⤵
        Executes dropped EXE
        
        PID:4272
        
        C:\Windows\SysWOW64\Ejhkdc32.exe
        
        C:\Windows\system32\Ejhkdc32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:924
        
        C:\Windows\SysWOW64\Fnhppa32.exe
        
        C:\Windows\system32\Fnhppa32.exe
        67⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Fceihh32.exe
        
        C:\Windows\system32\Fceihh32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3468
        
        C:\Windows\SysWOW64\Fmmmqnaf.exe
        
        C:\Windows\system32\Fmmmqnaf.exe
        69⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Fgcang32.exe
        
        C:\Windows\system32\Fgcang32.exe
        70⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\Fmpjfn32.exe
        
        C:\Windows\system32\Fmpjfn32.exe
        71⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\Fjcjpb32.exe
        
        C:\Windows\system32\Fjcjpb32.exe
        72⤵
        
        PID:808
        
        C:\Windows\SysWOW64\Gcqhcgqi.exe
        
        C:\Windows\system32\Gcqhcgqi.exe
        73⤵
        Modifies registry class
        
        PID:440
        
        C:\Windows\SysWOW64\Gadimkpb.exe
        
        C:\Windows\system32\Gadimkpb.exe
        74⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Gmpcmkaa.exe
        
        C:\Windows\system32\Gmpcmkaa.exe
        75⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\Hfmqapcl.exe
        
        C:\Windows\system32\Hfmqapcl.exe
        76⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\Hmifcjif.exe
        
        C:\Windows\system32\Hmifcjif.exe
        77⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\Ihagfb32.exe
        
        C:\Windows\system32\Ihagfb32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:224
        
        C:\Windows\SysWOW64\Idjdqc32.exe
        
        C:\Windows\system32\Idjdqc32.exe
        79⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\Jgpfmncg.exe
        
        C:\Windows\system32\Jgpfmncg.exe
        80⤵
        
        PID:812
        
        C:\Windows\SysWOW64\Jajdff32.exe
        
        C:\Windows\system32\Jajdff32.exe
        81⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Jopaejlo.exe
        
        C:\Windows\system32\Jopaejlo.exe
        82⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Kojdkhdd.exe
        
        C:\Windows\system32\Kojdkhdd.exe
        83⤵
        Drops file in System32 directory
        
        PID:4008
        
        C:\Windows\SysWOW64\Kdfmcobk.exe
        
        C:\Windows\system32\Kdfmcobk.exe
        84⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Lkgkqh32.exe
        
        C:\Windows\system32\Lkgkqh32.exe
        85⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Lhnhplpg.exe
        
        C:\Windows\system32\Lhnhplpg.exe
        86⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Mgceqh32.exe
        
        C:\Windows\system32\Mgceqh32.exe
        87⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\Mglhgg32.exe
        
        C:\Windows\system32\Mglhgg32.exe
        88⤵
        
        PID:564
        
        C:\Windows\SysWOW64\Nqlbqlmm.exe
        
        C:\Windows\system32\Nqlbqlmm.exe
        89⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Nqnofkkj.exe
        
        C:\Windows\system32\Nqnofkkj.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2876
        
        C:\Windows\SysWOW64\Oooodcci.exe
        
        C:\Windows\system32\Oooodcci.exe
        91⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3804
        
        C:\Windows\SysWOW64\Oelhljaq.exe
        
        C:\Windows\system32\Oelhljaq.exe
        92⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\Obdbqm32.exe
        
        C:\Windows\system32\Obdbqm32.exe
        93⤵
        
        PID:624
        
        C:\Windows\SysWOW64\Ophbja32.exe
        
        C:\Windows\system32\Ophbja32.exe
        94⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\Oiagcg32.exe
        
        C:\Windows\system32\Oiagcg32.exe
        95⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Ppmleagi.exe
        
        C:\Windows\system32\Ppmleagi.exe
        96⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\Ppphkq32.exe
        
        C:\Windows\system32\Ppphkq32.exe
        97⤵
        Modifies registry class
        
        PID:1164
        
        C:\Windows\SysWOW64\Pelacg32.exe
        
        C:\Windows\system32\Pelacg32.exe
        98⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Peajngoi.exe
        
        C:\Windows\system32\Peajngoi.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1636
        
        C:\Windows\SysWOW64\Aejmdegn.exe
        
        C:\Windows\system32\Aejmdegn.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1708
        
        C:\Windows\SysWOW64\Apbngn32.exe
        
        C:\Windows\system32\Apbngn32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4708
        
        C:\Windows\SysWOW64\Bplammmf.exe
        
        C:\Windows\system32\Bplammmf.exe
        102⤵
        Drops file in System32 directory
        
        PID:456
        
        C:\Windows\SysWOW64\Blenhmph.exe
        
        C:\Windows\system32\Blenhmph.exe
        103⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Deiblamk.exe
        
        C:\Windows\system32\Deiblamk.exe
        104⤵
        
        PID:748
        
        C:\Windows\SysWOW64\Fcdbmb32.exe
        
        C:\Windows\system32\Fcdbmb32.exe
        105⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Fqjolfda.exe
        
        C:\Windows\system32\Fqjolfda.exe
        106⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Hboaql32.exe
        
        C:\Windows\system32\Hboaql32.exe
        107⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Hmdend32.exe
        
        C:\Windows\system32\Hmdend32.exe
        108⤵
        Drops file in System32 directory
        
        PID:4944
        
        C:\Windows\SysWOW64\Hbanfk32.exe
        
        C:\Windows\system32\Hbanfk32.exe
        109⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Habndbpf.exe
        
        C:\Windows\system32\Habndbpf.exe
        110⤵
        Modifies registry class
        
        PID:5192
        
        C:\Windows\SysWOW64\Hmioicek.exe
        
        C:\Windows\system32\Hmioicek.exe
        111⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Ifcpgiji.exe
        
        C:\Windows\system32\Ifcpgiji.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5296
        
        C:\Windows\SysWOW64\Iannpa32.exe
        
        C:\Windows\system32\Iannpa32.exe
        113⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Ibojgikg.exe
        
        C:\Windows\system32\Ibojgikg.exe
        114⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Iapjeq32.exe
        
        C:\Windows\system32\Iapjeq32.exe
        115⤵
        Drops file in System32 directory
        
        PID:5424
        
        C:\Windows\SysWOW64\Jmgkja32.exe
        
        C:\Windows\system32\Jmgkja32.exe
        116⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Jfopcgpk.exe
        
        C:\Windows\system32\Jfopcgpk.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\Jbkjcgaj.exe
        
        C:\Windows\system32\Jbkjcgaj.exe
        118⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Kilhqq32.exe
        
        C:\Windows\system32\Kilhqq32.exe
        119⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Kgbepdpf.exe
        
        C:\Windows\system32\Kgbepdpf.exe
        120⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Ldmlih32.exe
        
        C:\Windows\system32\Ldmlih32.exe
        121⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Mphfjhjf.exe
        
        C:\Windows\system32\Mphfjhjf.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5844
        
        C:\Windows\SysWOW64\Mpoljg32.exe
        
        C:\Windows\system32\Mpoljg32.exe
        123⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Ndpafe32.exe
        
        C:\Windows\system32\Ndpafe32.exe
        124⤵
        Drops file in System32 directory
        
        PID:5956
        
        C:\Windows\SysWOW64\Nkqpcnig.exe
        
        C:\Windows\system32\Nkqpcnig.exe
        125⤵
        Drops file in System32 directory
        
        PID:6032
        
        C:\Windows\SysWOW64\Ojopki32.exe
        
        C:\Windows\system32\Ojopki32.exe
        126⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Cdolbijg.exe
        
        C:\Windows\system32\Cdolbijg.exe
        127⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Coepob32.exe
        
        C:\Windows\system32\Coepob32.exe
        128⤵
        Modifies registry class
        
        PID:5236
        
        C:\Windows\SysWOW64\Chbncg32.exe
        
        C:\Windows\system32\Chbncg32.exe
        129⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Dboiaoff.exe
        
        C:\Windows\system32\Dboiaoff.exe
        130⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Dlgmjdlg.exe
        
        C:\Windows\system32\Dlgmjdlg.exe
        131⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Eddodfhp.exe
        
        C:\Windows\system32\Eddodfhp.exe
        132⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Edgkif32.exe
        
        C:\Windows\system32\Edgkif32.exe
        133⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1920
        
        C:\Windows\SysWOW64\Eefhcimp.exe
        
        C:\Windows\system32\Eefhcimp.exe
        134⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Elpppcdl.exe
        
        C:\Windows\system32\Elpppcdl.exe
        135⤵
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Fhljpcfk.exe
        
        C:\Windows\system32\Fhljpcfk.exe
        136⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Goabhl32.exe
        
        C:\Windows\system32\Goabhl32.exe
        137⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Gfngke32.exe
        
        C:\Windows\system32\Gfngke32.exe
        138⤵
        Drops file in System32 directory
        
        PID:4120
        
        C:\Windows\SysWOW64\Gdcdlb32.exe
        
        C:\Windows\system32\Gdcdlb32.exe
        139⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Gohhik32.exe
        
        C:\Windows\system32\Gohhik32.exe
        140⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Gdeqaa32.exe
        
        C:\Windows\system32\Gdeqaa32.exe
        141⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Gkoinlbg.exe
        
        C:\Windows\system32\Gkoinlbg.exe
        142⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Hfemkdbm.exe
        
        C:\Windows\system32\Hfemkdbm.exe
        143⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\Hmabnnhg.exe
        
        C:\Windows\system32\Hmabnnhg.exe
        144⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Hbnjfefo.exe
        
        C:\Windows\system32\Hbnjfefo.exe
        145⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Hijohoki.exe
        
        C:\Windows\system32\Hijohoki.exe
        146⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Hcpcehko.exe
        
        C:\Windows\system32\Hcpcehko.exe
        147⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Hmhhnmao.exe
        
        C:\Windows\system32\Hmhhnmao.exe
        148⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Ibeqgdpf.exe
        
        C:\Windows\system32\Ibeqgdpf.exe
        149⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\Ikmepj32.exe
        
        C:\Windows\system32\Ikmepj32.exe
        150⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\Ibgmldnd.exe
        
        C:\Windows\system32\Ibgmldnd.exe
        151⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\Iiaein32.exe
        
        C:\Windows\system32\Iiaein32.exe
        152⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Ibijbc32.exe
        
        C:\Windows\system32\Ibijbc32.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\SysWOW64\Iempingp.exe
        
        C:\Windows\system32\Iempingp.exe
        154⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Kekljlkp.exe
        
        C:\Windows\system32\Kekljlkp.exe
        155⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Kdllhdco.exe
        
        C:\Windows\system32\Kdllhdco.exe
        156⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Kihdqkaf.exe
        
        C:\Windows\system32\Kihdqkaf.exe
        157⤵
        Drops file in System32 directory
        
        PID:5372
        
        C:\Windows\SysWOW64\Kipkaj32.exe
        
        C:\Windows\system32\Kipkaj32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3724
        
        C:\Windows\SysWOW64\Mccofn32.exe
        
        C:\Windows\system32\Mccofn32.exe
        159⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Mllcocna.exe
        
        C:\Windows\system32\Mllcocna.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5644
        
        C:\Windows\SysWOW64\Mgagll32.exe
        
        C:\Windows\system32\Mgagll32.exe
        161⤵
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Mlnpdc32.exe
        
        C:\Windows\system32\Mlnpdc32.exe
        162⤵
        Modifies registry class
        
        PID:5884
        
        C:\Windows\SysWOW64\Mgddal32.exe
        
        C:\Windows\system32\Mgddal32.exe
        163⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Mmnlnfcb.exe
        
        C:\Windows\system32\Mmnlnfcb.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2516
        
        C:\Windows\SysWOW64\Mgfqgkib.exe
        
        C:\Windows\system32\Mgfqgkib.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5012
        
        C:\Windows\SysWOW64\Mpoepa32.exe
        
        C:\Windows\system32\Mpoepa32.exe
        166⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\Meknhh32.exe
        
        C:\Windows\system32\Meknhh32.exe
        167⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Ndmnfofi.exe
        
        C:\Windows\system32\Ndmnfofi.exe
        168⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Nneboemj.exe
        
        C:\Windows\system32\Nneboemj.exe
        169⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Ngmggj32.exe
        
        C:\Windows\system32\Ngmggj32.exe
        170⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Njnpie32.exe
        
        C:\Windows\system32\Njnpie32.exe
        171⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Ndfqlnno.exe
        
        C:\Windows\system32\Ndfqlnno.exe
        172⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\Ofijifbj.exe
        
        C:\Windows\system32\Ofijifbj.exe
        173⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Odkjgm32.exe
        
        C:\Windows\system32\Odkjgm32.exe
        174⤵
        Drops file in System32 directory
        
        PID:4056
        
        C:\Windows\SysWOW64\Ojgbpd32.exe
        
        C:\Windows\system32\Ojgbpd32.exe
        175⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Oqakln32.exe
        
        C:\Windows\system32\Oqakln32.exe
        176⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Onekeb32.exe
        
        C:\Windows\system32\Onekeb32.exe
        177⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\Ognpoheh.exe
        
        C:\Windows\system32\Ognpoheh.exe
        178⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\Omjhgoco.exe
        
        C:\Windows\system32\Omjhgoco.exe
        179⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Pgpmdh32.exe
        
        C:\Windows\system32\Pgpmdh32.exe
        180⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Pmmelo32.exe
        
        C:\Windows\system32\Pmmelo32.exe
        181⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5984
        
        C:\Windows\SysWOW64\Pgbijg32.exe
        
        C:\Windows\system32\Pgbijg32.exe
        182⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\Pqknbmhc.exe
        
        C:\Windows\system32\Pqknbmhc.exe
        183⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Pgefogop.exe
        
        C:\Windows\system32\Pgefogop.exe
        184⤵
        Modifies registry class
        
        PID:5044
        
        C:\Windows\SysWOW64\Pqmjhm32.exe
        
        C:\Windows\system32\Pqmjhm32.exe
        185⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Pjeoablq.exe
        
        C:\Windows\system32\Pjeoablq.exe
        186⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\Pdkcnklf.exe
        
        C:\Windows\system32\Pdkcnklf.exe
        187⤵
        Modifies registry class
        
        PID:1124
        
        C:\Windows\SysWOW64\Pjhlfb32.exe
        
        C:\Windows\system32\Pjhlfb32.exe
        188⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Cjindm32.exe
        
        C:\Windows\system32\Cjindm32.exe
        189⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Cenaaf32.exe
        
        C:\Windows\system32\Cenaaf32.exe
        190⤵
        Drops file in System32 directory
        
        PID:3256
        
        C:\Windows\SysWOW64\Ceqngekl.exe
        
        C:\Windows\system32\Ceqngekl.exe
        191⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\Cjmgomjc.exe
        
        C:\Windows\system32\Cjmgomjc.exe
        192⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Dalhgfmk.exe
        
        C:\Windows\system32\Dalhgfmk.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4508
        
        C:\Windows\SysWOW64\Feapdaof.exe
        
        C:\Windows\system32\Feapdaof.exe
        194⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Gkeonggf.exe
        
        C:\Windows\system32\Gkeonggf.exe
        195⤵
        Modifies registry class
        
        PID:2128
        
        C:\Windows\SysWOW64\Gglpbh32.exe
        
        C:\Windows\system32\Gglpbh32.exe
        196⤵
        Modifies registry class
        
        PID:376
        
        C:\Windows\SysWOW64\Gfomfo32.exe
        
        C:\Windows\system32\Gfomfo32.exe
        197⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Gklenf32.exe
        
        C:\Windows\system32\Gklenf32.exe
        198⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\Ghpehjph.exe
        
        C:\Windows\system32\Ghpehjph.exe
        199⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\Hbhjqp32.exe
        
        C:\Windows\system32\Hbhjqp32.exe
        200⤵
        Modifies registry class
        
        PID:3684
        
        C:\Windows\SysWOW64\Hnokeqll.exe
        
        C:\Windows\system32\Hnokeqll.exe
        201⤵
        Drops file in System32 directory
        
        PID:4336
        
        C:\Windows\SysWOW64\Hheoci32.exe
        
        C:\Windows\system32\Hheoci32.exe
        202⤵
        Modifies registry class
        
        PID:3160
        
        C:\Windows\SysWOW64\Hbmclobc.exe
        
        C:\Windows\system32\Hbmclobc.exe
        203⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\Hkehdd32.exe
        
        C:\Windows\system32\Hkehdd32.exe
        204⤵
        
        PID:368
        
        C:\Windows\SysWOW64\Hhihnihm.exe
        
        C:\Windows\system32\Hhihnihm.exe
        205⤵
        Drops file in System32 directory
        
        PID:3304
        
        C:\Windows\SysWOW64\Hfmigmgf.exe
        
        C:\Windows\system32\Hfmigmgf.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4164
        
        C:\Windows\SysWOW64\Ibdiln32.exe
        
        C:\Windows\system32\Ibdiln32.exe
        207⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Ihnbih32.exe
        
        C:\Windows\system32\Ihnbih32.exe
        208⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Ifbbbl32.exe
        
        C:\Windows\system32\Ifbbbl32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6184
        
        C:\Windows\SysWOW64\Ifdohl32.exe
        
        C:\Windows\system32\Ifdohl32.exe
        210⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Iiehjgnp.exe
        
        C:\Windows\system32\Iiehjgnp.exe
        211⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Jigdoglm.exe
        
        C:\Windows\system32\Jigdoglm.exe
        212⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Llpmhodc.exe
        
        C:\Windows\system32\Llpmhodc.exe
        213⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Lfeaegdi.exe
        
        C:\Windows\system32\Lfeaegdi.exe
        214⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Lpneom32.exe
        
        C:\Windows\system32\Lpneom32.exe
        215⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Lejngd32.exe
        
        C:\Windows\system32\Lejngd32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6608
        
        C:\Windows\SysWOW64\Lemjlcgo.exe
        
        C:\Windows\system32\Lemjlcgo.exe
        217⤵
        Modifies registry class
        
        PID:6660
        
        C:\Windows\SysWOW64\Lpbojlfd.exe
        
        C:\Windows\system32\Lpbojlfd.exe
        218⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Meogbcel.exe
        
        C:\Windows\system32\Meogbcel.exe
        219⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Mfoclflo.exe
        
        C:\Windows\system32\Mfoclflo.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6808
        
        C:\Windows\SysWOW64\Mpghel32.exe
        
        C:\Windows\system32\Mpghel32.exe
        221⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Medqmb32.exe
        
        C:\Windows\system32\Medqmb32.exe
        222⤵
        Modifies registry class
        
        PID:6892
        
        C:\Windows\SysWOW64\Molefh32.exe
        
        C:\Windows\system32\Molefh32.exe
        223⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Mhdjonng.exe
        
        C:\Windows\system32\Mhdjonng.exe
        224⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Mehjhbma.exe
        
        C:\Windows\system32\Mehjhbma.exe
        225⤵
        Drops file in System32 directory
        
        PID:7044
        
        C:\Windows\SysWOW64\Nbljaf32.exe
        
        C:\Windows\system32\Nbljaf32.exe
        226⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Nleojlbk.exe
        
        C:\Windows\system32\Nleojlbk.exe
        227⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Ngjcgdba.exe
        
        C:\Windows\system32\Ngjcgdba.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4224
        
        C:\Windows\SysWOW64\Nhlpom32.exe
        
        C:\Windows\system32\Nhlpom32.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6176
        
        C:\Windows\SysWOW64\Nbadmege.exe
        
        C:\Windows\system32\Nbadmege.exe
        230⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Nhnlelfm.exe
        
        C:\Windows\system32\Nhnlelfm.exe
        231⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Ngombd32.exe
        
        C:\Windows\system32\Ngombd32.exe
        232⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Nllekk32.exe
        
        C:\Windows\system32\Nllekk32.exe
        233⤵
        
        PID:812
        
        C:\Windows\SysWOW64\Pphjbgfj.exe
        
        C:\Windows\system32\Pphjbgfj.exe
        234⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\Pjpokm32.exe
        
        C:\Windows\system32\Pjpokm32.exe
        235⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Pchcdbck.exe
        
        C:\Windows\system32\Pchcdbck.exe
        236⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Plagmh32.exe
        
        C:\Windows\system32\Plagmh32.exe
        237⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Plcdbghi.exe
        
        C:\Windows\system32\Plcdbghi.exe
        238⤵
        Modifies registry class
        
        PID:6708
        
        C:\Windows\SysWOW64\Pflikm32.exe
        
        C:\Windows\system32\Pflikm32.exe
        239⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Qgkeep32.exe
        
        C:\Windows\system32\Qgkeep32.exe
        240⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Qcbfjqkp.exe
        
        C:\Windows\system32\Qcbfjqkp.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2560
        
        C:\Windows\SysWOW64\Amjjcf32.exe
        
        C:\Windows\system32\Amjjcf32.exe
        242⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Ajnkmjqj.exe
        
        C:\Windows\system32\Ajnkmjqj.exe
        243⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Ajqgbjoh.exe
        
        C:\Windows\system32\Ajqgbjoh.exe
        244⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Amcmie32.exe
        
        C:\Windows\system32\Amcmie32.exe
        245⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Dibmfb32.exe
        
        C:\Windows\system32\Dibmfb32.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6312
        
        C:\Windows\SysWOW64\Dcgackke.exe
        
        C:\Windows\system32\Dcgackke.exe
        247⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Didjkbim.exe
        
        C:\Windows\system32\Didjkbim.exe
        248⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Dhejij32.exe
        
        C:\Windows\system32\Dhejij32.exe
        249⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\Dannbogl.exe
        
        C:\Windows\system32\Dannbogl.exe
        250⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Djfckenm.exe
        
        C:\Windows\system32\Djfckenm.exe
        251⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\Ddngdj32.exe
        
        C:\Windows\system32\Ddngdj32.exe
        252⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Dabhmo32.exe
        
        C:\Windows\system32\Dabhmo32.exe
        253⤵
        Modifies registry class
        
        PID:916
        
        C:\Windows\SysWOW64\Efopeeao.exe
        
        C:\Windows\system32\Efopeeao.exe
        254⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4888
        
        C:\Windows\SysWOW64\Ejofacfb.exe
        
        C:\Windows\system32\Ejofacfb.exe
        255⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2144
        
        C:\Windows\SysWOW64\Eainnn32.exe
        
        C:\Windows\system32\Eainnn32.exe
        256⤵
        Modifies registry class
        
        PID:6844
        
        C:\Windows\SysWOW64\Embkhn32.exe
        
        C:\Windows\system32\Embkhn32.exe
        257⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Fphneijl.exe
        
        C:\Windows\system32\Fphneijl.exe
        258⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Fpjjkh32.exe
        
        C:\Windows\system32\Fpjjkh32.exe
        259⤵
        Modifies registry class
        
        PID:7028
        
        C:\Windows\SysWOW64\Gdhcagnp.exe
        
        C:\Windows\system32\Gdhcagnp.exe
        260⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Gmqgjl32.exe
        
        C:\Windows\system32\Gmqgjl32.exe
        261⤵
        Modifies registry class
        
        PID:7112
        
        C:\Windows\SysWOW64\Gkdhcqcj.exe
        
        C:\Windows\system32\Gkdhcqcj.exe
        262⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Hhoomd32.exe
        
        C:\Windows\system32\Hhoomd32.exe
        263⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\Hahcfi32.exe
        
        C:\Windows\system32\Hahcfi32.exe
        264⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Hkpgooim.exe
        
        C:\Windows\system32\Hkpgooim.exe
        265⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Hdhlhd32.exe
        
        C:\Windows\system32\Hdhlhd32.exe
        266⤵
        Drops file in System32 directory
        
        PID:3504
        
        C:\Windows\SysWOW64\Hkbddo32.exe
        
        C:\Windows\system32\Hkbddo32.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6416
        
        C:\Windows\SysWOW64\Inhgaipf.exe
        
        C:\Windows\system32\Inhgaipf.exe
        268⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Jqihjbod.exe
        
        C:\Windows\system32\Jqihjbod.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1504
        
        C:\Windows\SysWOW64\Kengqo32.exe
        
        C:\Windows\system32\Kengqo32.exe
        270⤵
        
        PID:928
        
        C:\Windows\SysWOW64\Knfliefc.exe
        
        C:\Windows\system32\Knfliefc.exe
        271⤵
        Drops file in System32 directory
        
        PID:340
        
        C:\Windows\SysWOW64\Lkjlciem.exe
        
        C:\Windows\system32\Lkjlciem.exe
        272⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Lgamhjja.exe
        
        C:\Windows\system32\Lgamhjja.exe
        273⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\Mlflog32.exe
        
        C:\Windows\system32\Mlflog32.exe
        274⤵
        Drops file in System32 directory
        
        PID:3472
        
        C:\Windows\SysWOW64\Maealn32.exe
        
        C:\Windows\system32\Maealn32.exe
        275⤵
        Modifies registry class
        
        PID:6232
        
        C:\Windows\SysWOW64\Mniafbfn.exe
        
        C:\Windows\system32\Mniafbfn.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6344
        
        C:\Windows\SysWOW64\Miofcked.exe
        
        C:\Windows\system32\Miofcked.exe
        277⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Mbgjlq32.exe
        
        C:\Windows\system32\Mbgjlq32.exe
        278⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Mehcnlie.exe
        
        C:\Windows\system32\Mehcnlie.exe
        279⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Njdlfbgm.exe
        
        C:\Windows\system32\Njdlfbgm.exe
        280⤵
        Drops file in System32 directory
        
        PID:5428
        
        C:\Windows\SysWOW64\Nejpckgc.exe
        
        C:\Windows\system32\Nejpckgc.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:456
        
        C:\Windows\SysWOW64\Nbnpmp32.exe
        
        C:\Windows\system32\Nbnpmp32.exe
        282⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Nogngp32.exe
        
        C:\Windows\system32\Nogngp32.exe
        283⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Nbefmopd.exe
        
        C:\Windows\system32\Nbefmopd.exe
        284⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Ohboeenl.exe
        
        C:\Windows\system32\Ohboeenl.exe
        285⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Okbhgq32.exe
        
        C:\Windows\system32\Okbhgq32.exe
        286⤵
        Drops file in System32 directory
        
        PID:6992
        
        C:\Windows\SysWOW64\Olgnlb32.exe
        
        C:\Windows\system32\Olgnlb32.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6016
        
        C:\Windows\SysWOW64\Pklkmo32.exe
        
        C:\Windows\system32\Pklkmo32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012
        
        C:\Windows\SysWOW64\Peaokh32.exe
        
        C:\Windows\system32\Peaokh32.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Pkngco32.exe
        
        C:\Windows\system32\Pkngco32.exe
        290⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Pedlpgqe.exe
        
        C:\Windows\system32\Pedlpgqe.exe
        291⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Plndma32.exe
        
        C:\Windows\system32\Plndma32.exe
        292⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Qcobjk32.exe
        
        C:\Windows\system32\Qcobjk32.exe
        293⤵
        Drops file in System32 directory
        
        PID:2496
        
        C:\Windows\SysWOW64\Aklddmep.exe
        
        C:\Windows\system32\Aklddmep.exe
        294⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Bfbahcfc.exe
        
        C:\Windows\system32\Bfbahcfc.exe
        295⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Dcgjie32.exe
        
        C:\Windows\system32\Dcgjie32.exe
        296⤵
        Drops file in System32 directory
        
        PID:5348
        
        C:\Windows\SysWOW64\Djqbeonf.exe
        
        C:\Windows\system32\Djqbeonf.exe
        297⤵
        Drops file in System32 directory
        
        PID:5484
        
        C:\Windows\SysWOW64\Dpmknf32.exe
        
        C:\Windows\system32\Dpmknf32.exe
        298⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Djelqo32.exe
        
        C:\Windows\system32\Djelqo32.exe
        299⤵
        Modifies registry class
        
        PID:1248
        
        C:\Windows\SysWOW64\Djhifnho.exe
        
        C:\Windows\system32\Djhifnho.exe
        300⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Ecpmod32.exe
        
        C:\Windows\system32\Ecpmod32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2288
        
        C:\Windows\SysWOW64\Eplgod32.exe
        
        C:\Windows\system32\Eplgod32.exe
        302⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Fjfegl32.exe
        
        C:\Windows\system32\Fjfegl32.exe
        303⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Fmikoggm.exe
        
        C:\Windows\system32\Fmikoggm.exe
        304⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Gfhehlhe.exe
        
        C:\Windows\system32\Gfhehlhe.exe
        305⤵
        Drops file in System32 directory
        
        PID:5300
        
        C:\Windows\SysWOW64\Gpqjaanf.exe
        
        C:\Windows\system32\Gpqjaanf.exe
        306⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Giinjg32.exe
        
        C:\Windows\system32\Giinjg32.exe
        307⤵
        Drops file in System32 directory
        
        PID:5440
        
        C:\Windows\SysWOW64\Gdobgp32.exe
        
        C:\Windows\system32\Gdobgp32.exe
        308⤵
        
        PID:468
        
        C:\Windows\SysWOW64\Gljgkb32.exe
        
        C:\Windows\system32\Gljgkb32.exe
        309⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Hmnmqdee.exe
        
        C:\Windows\system32\Hmnmqdee.exe
        310⤵
        Modifies registry class
        
        PID:1716
        
        C:\Windows\SysWOW64\Hlcjaq32.exe
        
        C:\Windows\system32\Hlcjaq32.exe
        311⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Jcmkehcg.exe
        
        C:\Windows\system32\Jcmkehcg.exe
        312⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Jpalomaq.exe
        
        C:\Windows\system32\Jpalomaq.exe
        313⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Jkgpleaf.exe
        
        C:\Windows\system32\Jkgpleaf.exe
        314⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6456
        
        C:\Windows\SysWOW64\Kcgnkgkl.exe
        
        C:\Windows\system32\Kcgnkgkl.exe
        315⤵
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Kdigkjpl.exe
        
        C:\Windows\system32\Kdigkjpl.exe
        316⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Ljfhjn32.exe
        
        C:\Windows\system32\Ljfhjn32.exe
        317⤵
        Drops file in System32 directory
        
        PID:5928
        
        C:\Windows\SysWOW64\Mklkepal.exe
        
        C:\Windows\system32\Mklkepal.exe
        318⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Oegejc32.exe
        
        C:\Windows\system32\Oegejc32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5164
        
        C:\Windows\SysWOW64\Poimigfm.exe
        
        C:\Windows\system32\Poimigfm.exe
        320⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Pajekb32.exe
        
        C:\Windows\system32\Pajekb32.exe
        321⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Palbpb32.exe
        
        C:\Windows\system32\Palbpb32.exe
        322⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Qdmkbmnl.exe
        
        C:\Windows\system32\Qdmkbmnl.exe
        323⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\Qmepkb32.exe
        
        C:\Windows\system32\Qmepkb32.exe
        324⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Aeodapcl.exe
        
        C:\Windows\system32\Aeodapcl.exe
        325⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Bdbndjld.exe
        
        C:\Windows\system32\Bdbndjld.exe
        326⤵
        Drops file in System32 directory
        
        PID:4964
        
        C:\Windows\SysWOW64\Bahkcn32.exe
        
        C:\Windows\system32\Bahkcn32.exe
        327⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Cdicdi32.exe
        
        C:\Windows\system32\Cdicdi32.exe
        328⤵
        Drops file in System32 directory
        
        PID:1344
        
        C:\Windows\SysWOW64\Cbmdnmdf.exe
        
        C:\Windows\system32\Cbmdnmdf.exe
        329⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Domdcpib.exe
        
        C:\Windows\system32\Domdcpib.exe
        330⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Emenhcdf.exe
        
        C:\Windows\system32\Emenhcdf.exe
        331⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Ekmhnpfl.exe
        
        C:\Windows\system32\Ekmhnpfl.exe
        332⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\Holfhfij.exe
        
        C:\Windows\system32\Holfhfij.exe
        333⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Iemdep32.exe
        
        C:\Windows\system32\Iemdep32.exe
        334⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Ioeineap.exe
        
        C:\Windows\system32\Ioeineap.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5352
        
        C:\Windows\SysWOW64\Jeidan32.exe
        
        C:\Windows\system32\Jeidan32.exe
        336⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\Jpnhof32.exe
        
        C:\Windows\system32\Jpnhof32.exe
        337⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\Jpqedfne.exe
        
        C:\Windows\system32\Jpqedfne.exe
        338⤵
        Drops file in System32 directory
        
        PID:5056
        
        C:\Windows\SysWOW64\Jenmlmll.exe
        
        C:\Windows\system32\Jenmlmll.exe
        339⤵
        Modifies registry class
        
        PID:6044
        
        C:\Windows\SysWOW64\Jofaeb32.exe
        
        C:\Windows\system32\Jofaeb32.exe
        340⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Kcfgaq32.exe
        
        C:\Windows\system32\Kcfgaq32.exe
        341⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Kloljf32.exe
        
        C:\Windows\system32\Kloljf32.exe
        342⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Kgdpgo32.exe
        
        C:\Windows\system32\Kgdpgo32.exe
        343⤵
        Modifies registry class
        
        PID:2352
        
        C:\Windows\SysWOW64\Kfimhkbo.exe
        
        C:\Windows\system32\Kfimhkbo.exe
        344⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\Kcmmap32.exe
        
        C:\Windows\system32\Kcmmap32.exe
        345⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Kjgenjhe.exe
        
        C:\Windows\system32\Kjgenjhe.exe
        346⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Kcpjgo32.exe
        
        C:\Windows\system32\Kcpjgo32.exe
        347⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Lgmbmn32.exe
        
        C:\Windows\system32\Lgmbmn32.exe
        348⤵
        
        PID:832
        
        C:\Windows\SysWOW64\Lngkjhmi.exe
        
        C:\Windows\system32\Lngkjhmi.exe
        349⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\Loigap32.exe
        
        C:\Windows\system32\Loigap32.exe
        350⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\Lfbpnjjd.exe
        
        C:\Windows\system32\Lfbpnjjd.exe
        351⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\Lokdgpqe.exe
        
        C:\Windows\system32\Lokdgpqe.exe
        352⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Lmodqdpo.exe
        
        C:\Windows\system32\Lmodqdpo.exe
        353⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Lcimmn32.exe
        
        C:\Windows\system32\Lcimmn32.exe
        354⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Lnnakg32.exe
        
        C:\Windows\system32\Lnnakg32.exe
        355⤵
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Mfjfoidl.exe
        
        C:\Windows\system32\Mfjfoidl.exe
        356⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Mgkoolil.exe
        
        C:\Windows\system32\Mgkoolil.exe
        357⤵
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Mjlhpgfn.exe
        
        C:\Windows\system32\Mjlhpgfn.exe
        358⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Nmomga32.exe
        
        C:\Windows\system32\Nmomga32.exe
        359⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Njcnafpe.exe
        
        C:\Windows\system32\Njcnafpe.exe
        360⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\Nclbjk32.exe
        
        C:\Windows\system32\Nclbjk32.exe
        361⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\Ngikpjml.exe
        
        C:\Windows\system32\Ngikpjml.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1536
        
        C:\Windows\SysWOW64\Npepdl32.exe
        
        C:\Windows\system32\Npepdl32.exe
        363⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Omkmcpgo.exe
        
        C:\Windows\system32\Omkmcpgo.exe
        364⤵
        Modifies registry class
        
        PID:6196
        
        C:\Windows\SysWOW64\Oplfekdp.exe
        
        C:\Windows\system32\Oplfekdp.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5044
        
        C:\Windows\SysWOW64\Ogeklh32.exe
        
        C:\Windows\system32\Ogeklh32.exe
        366⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Opqopj32.exe
        
        C:\Windows\system32\Opqopj32.exe
        367⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Oapljmgm.exe
        
        C:\Windows\system32\Oapljmgm.exe
        368⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Pfoahd32.exe
        
        C:\Windows\system32\Pfoahd32.exe
        369⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1784
        
        C:\Windows\SysWOW64\Pmkfjn32.exe
        
        C:\Windows\system32\Pmkfjn32.exe
        370⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Phajgf32.exe
        
        C:\Windows\system32\Phajgf32.exe
        371⤵
        Drops file in System32 directory
        
        PID:4784
        
        C:\Windows\SysWOW64\Pnmojp32.exe
        
        C:\Windows\system32\Pnmojp32.exe
        372⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Qdldgg32.exe
        
        C:\Windows\system32\Qdldgg32.exe
        373⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Aodejohd.exe
        
        C:\Windows\system32\Aodejohd.exe
        374⤵
        Drops file in System32 directory
        
        PID:2592
        
        C:\Windows\SysWOW64\Afpjoaeo.exe
        
        C:\Windows\system32\Afpjoaeo.exe
        375⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Apmhbf32.exe
        
        C:\Windows\system32\Apmhbf32.exe
        376⤵
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Bonhqnpi.exe
        
        C:\Windows\system32\Bonhqnpi.exe
        377⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Bhhiocdg.exe
        
        C:\Windows\system32\Bhhiocdg.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6608
        
        C:\Windows\SysWOW64\Bobalm32.exe
        
        C:\Windows\system32\Bobalm32.exe
        379⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Bacjmh32.exe
        
        C:\Windows\system32\Bacjmh32.exe
        380⤵
        Modifies registry class
        
        PID:6780
        
        C:\Windows\SysWOW64\Bhmbjb32.exe
        
        C:\Windows\system32\Bhmbjb32.exe
        381⤵
        Modifies registry class
        
        PID:3552
        
        C:\Windows\SysWOW64\Cajqng32.exe
        
        C:\Windows\system32\Cajqng32.exe
        382⤵
        
        PID:184
        
        C:\Windows\SysWOW64\Conagl32.exe
        
        C:\Windows\system32\Conagl32.exe
        383⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Cponodge.exe
        
        C:\Windows\system32\Cponodge.exe
        384⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\Caojigoh.exe
        
        C:\Windows\system32\Caojigoh.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5892
        
        C:\Windows\SysWOW64\Dojqcjgi.exe
        
        C:\Windows\system32\Dojqcjgi.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:532
        
        C:\Windows\SysWOW64\Ddfikaeq.exe
        
        C:\Windows\system32\Ddfikaeq.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5696
        
        C:\Windows\SysWOW64\Dkqahk32.exe
        
        C:\Windows\system32\Dkqahk32.exe
        388⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Dqmjqb32.exe
        
        C:\Windows\system32\Dqmjqb32.exe
        389⤵
        Drops file in System32 directory
        
        PID:6604
        
        C:\Windows\SysWOW64\Eojijg32.exe
        
        C:\Windows\system32\Eojijg32.exe
        390⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Fkajoiok.exe
        
        C:\Windows\system32\Fkajoiok.exe
        391⤵
        Drops file in System32 directory
        
        PID:2160
        
        C:\Windows\SysWOW64\Fbkblb32.exe
        
        C:\Windows\system32\Fbkblb32.exe
        392⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\Fagenneg.exe
        
        C:\Windows\system32\Fagenneg.exe
        393⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Gganjh32.exe
        
        C:\Windows\system32\Gganjh32.exe
        394⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Gicgjk32.exe
        
        C:\Windows\system32\Gicgjk32.exe
        395⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\Hhmmffbg.exe
        
        C:\Windows\system32\Hhmmffbg.exe
        396⤵
        Modifies registry class
        
        PID:6924
        
        C:\Windows\SysWOW64\Heqnokaq.exe
        
        C:\Windows\system32\Heqnokaq.exe
        397⤵
        Modifies registry class
        
        PID:392
        
        C:\Windows\SysWOW64\Hlkfle32.exe
        
        C:\Windows\system32\Hlkfle32.exe
        398⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Hbenio32.exe
        
        C:\Windows\system32\Hbenio32.exe
        399⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\Hiofeigg.exe
        
        C:\Windows\system32\Hiofeigg.exe
        400⤵
        Drops file in System32 directory
        
        PID:4124
        
        C:\Windows\SysWOW64\Ihhmaehj.exe
        
        C:\Windows\system32\Ihhmaehj.exe
        401⤵
        Drops file in System32 directory
        
        PID:5104
        
        C:\Windows\SysWOW64\Ajfejknb.exe
        
        C:\Windows\system32\Ajfejknb.exe
        402⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Abcgdm32.exe
        
        C:\Windows\system32\Abcgdm32.exe
        403⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Amkhfegn.exe
        
        C:\Windows\system32\Amkhfegn.exe
        404⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\Afclpk32.exe
        
        C:\Windows\system32\Afclpk32.exe
        405⤵
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\Bbmjjk32.exe
        
        C:\Windows\system32\Bbmjjk32.exe
        406⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Bigbgehl.exe
        
        C:\Windows\system32\Bigbgehl.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2064
        
        C:\Windows\SysWOW64\Bpqjcp32.exe
        
        C:\Windows\system32\Bpqjcp32.exe
        408⤵
        
        PID:912
        
        C:\Windows\SysWOW64\Bjfoqhpo.exe
        
        C:\Windows\system32\Bjfoqhpo.exe
        409⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Bdocin32.exe
        
        C:\Windows\system32\Bdocin32.exe
        410⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Bmggbcmp.exe
        
        C:\Windows\system32\Bmggbcmp.exe
        411⤵
        Modifies registry class
        
        PID:812
        
        C:\Windows\SysWOW64\Bdapon32.exe
        
        C:\Windows\system32\Bdapon32.exe
        412⤵
        Drops file in System32 directory
        
        PID:1672
        
        C:\Windows\SysWOW64\Baephacf.exe
        
        C:\Windows\system32\Baephacf.exe
        413⤵
        Drops file in System32 directory
        
        PID:1680
        
        C:\Windows\SysWOW64\Cgaiqian.exe
        
        C:\Windows\system32\Cgaiqian.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5200
        
        C:\Windows\SysWOW64\Cpjmjn32.exe
        
        C:\Windows\system32\Cpjmjn32.exe
        415⤵
        Drops file in System32 directory
        
        PID:4788
        
        C:\Windows\SysWOW64\Cgdefhok.exe
        
        C:\Windows\system32\Cgdefhok.exe
        416⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Cmnncb32.exe
        
        C:\Windows\system32\Cmnncb32.exe
        417⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Cgfblh32.exe
        
        C:\Windows\system32\Cgfblh32.exe
        418⤵
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Cdjbel32.exe
        
        C:\Windows\system32\Cdjbel32.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6576
        
        C:\Windows\SysWOW64\Cigknc32.exe
        
        C:\Windows\system32\Cigknc32.exe
        420⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Ccopfi32.exe
        
        C:\Windows\system32\Ccopfi32.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6712
        
        C:\Windows\SysWOW64\Cmedca32.exe
        
        C:\Windows\system32\Cmedca32.exe
        422⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\Dcbllh32.exe
        
        C:\Windows\system32\Dcbllh32.exe
        423⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Ddaifk32.exe
        
        C:\Windows\system32\Ddaifk32.exe
        424⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Dinanb32.exe
        
        C:\Windows\system32\Dinanb32.exe
        425⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Ecphmfbg.exe
        
        C:\Windows\system32\Ecphmfbg.exe
        426⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Eaaikn32.exe
        
        C:\Windows\system32\Eaaikn32.exe
        427⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Egnacd32.exe
        
        C:\Windows\system32\Egnacd32.exe
        428⤵
        
        PID:1692
        
        C:\Windows\SysWOW64\Ejagkodl.exe
        
        C:\Windows\system32\Ejagkodl.exe
        429⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\Fcikcekm.exe
        
        C:\Windows\system32\Fcikcekm.exe
        430⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Fjccpo32.exe
        
        C:\Windows\system32\Fjccpo32.exe
        431⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Fqmlmiif.exe
        
        C:\Windows\system32\Fqmlmiif.exe
        432⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Fggdic32.exe
        
        C:\Windows\system32\Fggdic32.exe
        433⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Fgiqocoq.exe
        
        C:\Windows\system32\Fgiqocoq.exe
        434⤵
        Modifies registry class
        
        PID:7052
        
        C:\Windows\SysWOW64\Fboellof.exe
        
        C:\Windows\system32\Fboellof.exe
        435⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\Fkgiea32.exe
        
        C:\Windows\system32\Fkgiea32.exe
        436⤵
        Modifies registry class
        
        PID:6356
        
        C:\Windows\SysWOW64\Gnjollpe.exe
        
        C:\Windows\system32\Gnjollpe.exe
        437⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\Jhcecmjq.exe
        
        C:\Windows\system32\Jhcecmjq.exe
        438⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Jeolmpcb.exe
        
        C:\Windows\system32\Jeolmpcb.exe
        439⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Klhdjj32.exe
        
        C:\Windows\system32\Klhdjj32.exe
        440⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6884
        
        C:\Windows\SysWOW64\Kaemba32.exe
        
        C:\Windows\system32\Kaemba32.exe
        441⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Klkaojhl.exe
        
        C:\Windows\system32\Klkaojhl.exe
        442⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Kahihagd.exe
        
        C:\Windows\system32\Kahihagd.exe
        443⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Kkpnqf32.exe
        
        C:\Windows\system32\Kkpnqf32.exe
        444⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Kajfmqda.exe
        
        C:\Windows\system32\Kajfmqda.exe
        445⤵
        Modifies registry class
        
        PID:6168
        
        C:\Windows\SysWOW64\Klpjji32.exe
        
        C:\Windows\system32\Klpjji32.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5436
        
        C:\Windows\SysWOW64\Klbgpi32.exe
        
        C:\Windows\system32\Klbgpi32.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2088
        
        C:\Windows\SysWOW64\Kaophp32.exe
        
        C:\Windows\system32\Kaophp32.exe
        448⤵
        Drops file in System32 directory
        
        PID:6848
        
        C:\Windows\SysWOW64\Lemhnn32.exe
        
        C:\Windows\system32\Lemhnn32.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6480
        
        C:\Windows\SysWOW64\Loemgdmc.exe
        
        C:\Windows\system32\Loemgdmc.exe
        450⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\Lhmapi32.exe
        
        C:\Windows\system32\Lhmapi32.exe
        451⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\Leabincm.exe
        
        C:\Windows\system32\Leabincm.exe
        452⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Lcebcbaf.exe
        
        C:\Windows\system32\Lcebcbaf.exe
        453⤵
        
        PID:3504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afnefieo.exe

Filesize
896KB

MD5
c7f76e5e40292cc5691f8ec30c7be35c

SHA1
d564f6ad8b2309ebf68190e41c5b0c673b95248b

SHA256
89e24d85dbb4d822350c07786c33f25f75538f00095ce574e3b27bbfef36dc1f

SHA512
6b1d09196debe8a21057148fab23e6e927d8c051865602ae7fcfeba0db0c40dc2bcf28f8dab7675e67e9ec669d32e909890a2616e137180ed3c0812e77782661

Download Submit
C:\Windows\SysWOW64\Ajodef32.exe

Filesize
896KB

MD5
0a9798cf8c82962c46c3cdc1c8f2ed42

SHA1
fea11c1b37ec176d7845ed9cf49f615efb07a2b1

SHA256
6c77fda5224c8f5afd0e54f7dc75e56e906913719bfb9e6c84ab89ab51c36c03

SHA512
c6f0348e233c0656d2a9ecf2fee4fe768f287b7bedafc433da69091945478d72332bc44dd71b0570cc2168173315de63f27284fdbf11a93eb18dc9d1f0f2469a

Download Submit
C:\Windows\SysWOW64\Alhpkldp.exe

Filesize
512KB

MD5
c10bbcbfc2da007a462b47bb08b61b92

SHA1
aea69e9b9ff2b5716c6c9a4771abb8a926d5fb81

SHA256
78c254116ec3eb2199f0fbcb906a0f923f51734d4331e51e6b28482bc8523cbe

SHA512
b5d642755a43afc62dacbdb73a52d2c3499a6544c25d2065970a96ee804f378835abe68b778fc967d071c1fa2136888f74d98948f3e905aa64d77fc96e27709f

Download Submit
C:\Windows\SysWOW64\Alhpkldp.exe

Filesize
384KB

MD5
a579fff9669a1b65b9e340081583107e

SHA1
aeeb48df2c2a8bfacc62b6d71775086c84f78c95

SHA256
83b39dd5085968ddf09b4efd5717320fbe3f3498ff03f1d8c81e36383c00b798

SHA512
01a92dab0a0cecae2c2bfdc17ed85124a57383cceb9213990fdca3c59f42d08e3b99b5c9fefd1b1bae8ea603ffc037c9492c0ab38f32d3b58bc8091e3af31e1f

Download Submit
C:\Windows\SysWOW64\Anncek32.exe

Filesize
896KB

MD5
ccd9437fda7977d9c0f16c076b903984

SHA1
6c7503ebaba93aee93838e0975ae803beedc607f

SHA256
4b47b83934b96514426555cb8cdafa70511a1aa499871a31e30efa9830f63f5b

SHA512
2cd49eb74dfa2acfeb25a665ace6b422490b9dfbe0e38cb1a48ec4f9f7ac86844e9a15d9d070e8fbbd33e285af663a03ee19a74338b60b86b69ed560530ee4c4

Download Submit
C:\Windows\SysWOW64\Bdgehobe.exe

Filesize
896KB

MD5
444e551c4f853a63757e4f4414f9e015

SHA1
3f3dee10586beb2b5a8f6cf23892e4fce76cc9bd

SHA256
10ad2afda009bf4b87ad0a32785d638cfe89884353512e12981965fd891b3981

SHA512
ecb384577eb70d08203dfc48dc1690d41c9be6b7b6e1028fe45a5f9c0e1353dc8add51defac4b784ed2616928375ce97ab7d11fd2d6b78649b61f898be388d5b

Download Submit
C:\Windows\SysWOW64\Bdhkchlg.exe

Filesize
896KB

MD5
eb1e74a1748817f7d28f0053ae85cd66

SHA1
bc10ab8e37b2c04363541437bef159863f6b3f82

SHA256
90d15fdb390762f2dd0d7d0ec53ba3730f691110f13c57fca0dff0b16dd739bd

SHA512
c70dce142f5d292657d63ad600ba1f4fe84dd2c82905c95c367ca54f4220503bd6f7006fd52bc7516c4a68a11483f3f75ef3beb0ec846673d7f6ab418ac228b1

Download Submit
C:\Windows\SysWOW64\Bfbahcfc.exe

Filesize
896KB

MD5
fd5423386836c91a422bfbe2f53ae14e

SHA1
302b63232421ebde49845abd77fe023a2428b1cc

SHA256
6cb9e9715199033ca711e37ca9c8a6efb9ecfe7cfed9b4d548e150f9ce572251

SHA512
d68e13de1181ba502a7b2b51e3903c375470b4fb50fb505cadff106a6857aafc3afb84783a3993a6ac14ceeb3a144dae615087e839e8c3c2c6477e176272e4aa

Download Submit
C:\Windows\SysWOW64\Bnehgmob.exe

Filesize
896KB

MD5
728da895456e824352747a6c35043ec7

SHA1
0204edd02dd8fe18fffde92152b383980742e9b9

SHA256
3eeb7c7ac14c20cf3269474a133e21b75e0594e9e628edc896556c11fcab7f51

SHA512
20c95d8afc49d1d652dd6e874cd30ce58621dcd52f8abc9ee6be4946e21ba9d12a38b430a6a5224e3983540ee7ddcd37717da5c84d62acd1871b76947daaa4c2

Download Submit
C:\Windows\SysWOW64\Ciogobcm.exe

Filesize
896KB

MD5
02a28010d02bbd76a65b136879e92948

SHA1
1ca0f2dd4e234fb8d00cc41b2db76f3d99aa8c19

SHA256
36164989a8f032bace6cf140fa1dc6618a8c3a5305d38df0e6dad5e6d742d533

SHA512
566b5789f81103f18108356863d0e433484b7b8b60d4fe27463f829217e85120b557258a6c7a645fe7fd2585af0a09489bee3f1151497e688e17b413bb86a5b8

Download Submit
C:\Windows\SysWOW64\Cjaiac32.exe

Filesize
896KB

MD5
59bcb5ae4c1efe79e64dbdafe43be5cf

SHA1
cba33485ffcb9ce8d8d721b3e7ed552474186f28

SHA256
74f4b39d914667ab7ca0e9d0c3386cc50c7bf5e0f232b1dda6a78265f2a1ba6f

SHA512
d7c9a6a454465b2478d0b7846adc9b7071a3212ae3b0b58911bbf3c2bb48daa529cb7b417432106ff44a97253908ed65a4a03c7b9324de59b8614cc12dd24a23

Download Submit
C:\Windows\SysWOW64\Cldjkl32.exe

Filesize
896KB

MD5
533516623238da44032c9b343635fa9d

SHA1
7979c27def91eadb2ec1b214a0a8cde7c0a147de

SHA256
701ec0897b5ec71e44ba27dbef68d53444e93b197d4de80f605970eaa0037c70

SHA512
5cb840ebbc6dcb3871e93b51deb0a6109f22f2edd011f6265ffe2538227946b02c06250830ac40964d858df10524a4e3239d97bde59c33fea4edac495a0e6723

Download Submit
C:\Windows\SysWOW64\Cnhlgc32.exe

Filesize
896KB

MD5
109c3c2760c14a13c5ea0ab9a06772bf

SHA1
4b9b1af2abdc48b9a011f89179ff7d779294d4c8

SHA256
7b2b53354bf49092f253e7d7e77d48a98eb207bec33195800f3c6d388ed3a5ed

SHA512
ddeb9714fe6f0963e8f92578bc5b8d0ccdf1fcdd2d66d2f0b75a6f9f7690877ed8f34a894741d58abb1f05266751acb59aa7634ed4b7e3c865cdf08931b462db

Download Submit
C:\Windows\SysWOW64\Dblnid32.exe

Filesize
896KB

MD5
ee79a171c03dd40614f57f603f786eca

SHA1
bbe220687b6793a7f47b30d06a08cf24f80d69bb

SHA256
c05cf1d5089268d72464399a16974bb4761843e78535caa66adf687841f42d04

SHA512
d30959472419f1b4ac2fcd1353281f6aa09c299981bc8973f37d896fc1b31a66b65b0fce2c3196e4eabc9c505f4f44784f94b12be1ebd872c9ebf7db1320b5d6

Download Submit
C:\Windows\SysWOW64\Dgmpkg32.exe

Filesize
896KB

MD5
fe0cd295d2b93ebde9f5363ed19916a3

SHA1
6f4d0a13cc7bb90ffbd6f79d598623b7c8329fc6

SHA256
e72aea468efcd31af35facf7ad4636389651e7d3d67f1c6576716631982b2ddf

SHA512
519b15094725e3634979699d6bda947321c291ca446b3a5dd0e3752dd50b2539a8b302839429a67692946b6cec12dc8010f1fdaab7191fe20b98093e8bde7e1f

Download Submit
C:\Windows\SysWOW64\Eecfah32.exe

Filesize
896KB

MD5
abb3c915cd8315b639220660e8cb7c96

SHA1
7c917bebb42e04e89acdf7ed78da59713c0c5700

SHA256
be8d37c94621767e5b15e7707f54afea1bd8918ba626b4701b9a6b09255c7375

SHA512
6a1cacae3d02fcd6448e6d9f2f2ee6790987b800bb38588730753ac254ba4db53bb561cbbd7ff4d74a063fdecb4e53b45ef7d36d62cf6e3b7e2c62ba44aaae2b

Download Submit
C:\Windows\SysWOW64\Embkhn32.exe

Filesize
896KB

MD5
45b3ef4b84a456ee97f1214ba85b22fa

SHA1
6ce7abdba072d8e5e97f3147128d81337a9fa8c5

SHA256
edd704505e6df04d05ab30275be900cc818564b2f4533e51acd3bc5fd0e16f05

SHA512
d5fa08eec652d8f97355c828d13f27332a5bfccec6c0f29d9cf328a7b57c36724754eeef9418df801a7dea41f8ddbb4629b2aab8288025e5e34325fb84b8b6a5

Download Submit
C:\Windows\SysWOW64\Enedio32.exe

Filesize
896KB

MD5
51931235a8e3ce5916285f523272f194

SHA1
edd005038bd185ec794bdad433dd9eecc1e3ac4f

SHA256
1f307c4f5bef96f121a529e09d5f5e967c08ebec178386730005a13bde56e41e

SHA512
7d33cdfa40c2c6b8711eb0f2c189bf15c6941a17e1c023958de6bc2b270584426052a75ace6c58c792e394e9c29a0aa6e6f0d49d088f4038c70ada63eb9a48df

Download Submit
C:\Windows\SysWOW64\Fhiphi32.exe

Filesize
896KB

MD5
600f2f4c932bd3b41d6310658d33e784

SHA1
8a7a1547dfbc1187e4b466bbe948183bcc96412e

SHA256
627ed1ba7470724b0f8c4bf7aeb70977754714983ae9f1e9be987a0d56aa659a

SHA512
a76d813926907baa2eb3af9c62cbddcac8e3ddb626964042b5b36a40b8dde67e7b5da3cb181494d99b9420eec93073c1f9042ffc9c982a13bd7b996eb6d14e6f

Download Submit
C:\Windows\SysWOW64\Geklckkd.exe

Filesize
896KB

MD5
2a1a1fcae88daf6da77ffabf08d3df3c

SHA1
14f5f1bbc9705f9628be59f4c2efbeab4879ad62

SHA256
f83e0a435cff286c4aa759ba9b47854ea31e0fe1a4faea6f1552c0e4e71a9dc7

SHA512
27e3b9c51c5cba90c0946a9f4358e6e12084dde5ae1c9aa68e7d3eda21e8459595275b634a751ac8e4899ad3095efea00866c16d1256068878063301441d0035

Download Submit
C:\Windows\SysWOW64\Gmggac32.exe

Filesize
704KB

MD5
8db867e1cedea85a755136e1a44fbcec

SHA1
484c4081c1ce9395f75ff6cb574927d0738ed3c9

SHA256
86ebdf35162e877b1139f13bbe7c34617d9e8eaa0d11a0d33987207d5c28106b

SHA512
c3d4e399d0520464a09ebfac68eb01f4d2a9e26dedf6ac7991b845e8680414100e87e9eb5b580c548ffe37bc8338e5c43b954203ddfeaf28b84682e0ac112119

Download Submit
C:\Windows\SysWOW64\Gmpcmkaa.exe

Filesize
704KB

MD5
5795755e2379f177b0f37055e2c56517

SHA1
7ac5599729a121ca896b0655b6f152751c1305b9

SHA256
fa19fed2ec47efa7a68a28ad4bbf65ad5274f8094350a4b96490d96f69d5ec5c

SHA512
6a3890f0140508b8ad3f61b82c3fdbd09c00160e8fd5a0daf56f2ae18e72d9c92988f955c07048ac87335ddc163924f175f5546ac0e7c89afe40c4a9ab3e376b

Download Submit
C:\Windows\SysWOW64\Hebkid32.exe

Filesize
896KB

MD5
3f0659b00ad99194d4d38fc2d3266102

SHA1
9b52f4189a257b2beacb192258c96c00fa54a560

SHA256
c187ff19ac6c81b9bdb402ea3dc452e6e5990bd3463d1b745ee7f713685b3055

SHA512
eee85fbbe31b95baa59763c73cc4e1cd86b9de408a9455af11766e988f4a09a726dda164e78684c86dec5283988f38f57ebae3400a98a478becd71f9b55f823b

Download Submit
C:\Windows\SysWOW64\Ifcpgiji.exe

Filesize
896KB

MD5
aeb5f71a8dcf0b70a646df6a8265218c

SHA1
d3b00242364408b800d21c009a134f5ff3cc1614

SHA256
bdca155f5779ca613702d224e938317579eacc3465e47c014983394157394062

SHA512
0feb356305c9a763e64fe76096bec0e9c1b745fadf3a59284f47f347737ef9b9ddc12c1e775c6d8c0742ffd95d595f6e6ba3f53c62c544e7db394b1f30da889a

Download Submit
C:\Windows\SysWOW64\Ijgjpaao.exe

Filesize
896KB

MD5
53982c11d4a593bbe6187e669a19a23c

SHA1
df2b1cc7773593e3ee7adc9086728907fa7b06d1

SHA256
d88fe207997e178033a763eb076789dd2f1f51f95df453131b2db32c891ad353

SHA512
9b78a2cb6e616ad8d1a7a2b5d34fc5648ca0afce4bc4a2c8f41765b00d732a7631fe065b520296b9748a41f7a8de32e6da551e4a9e48068e6461d218d6e28415

Download Submit
C:\Windows\SysWOW64\Jajdff32.exe

Filesize
896KB

MD5
13bb9412d21f433bf7121bd34cf32dee

SHA1
d2e1c2ed492935bf01399b5b5a62bda8be0385b9

SHA256
2eb5848d69487980cd03959ca6cdc005f2fba0b3995d8720d98e50c10a22307e

SHA512
0ad8afd419e74fc5dcf30929204ead4edfd9b5ec92c38eabe63c0860f9a2070b943ce39725c33697302a1e84a9adb1b82dd8e064b0c9b652bc70f8070f63e966

Download Submit
C:\Windows\SysWOW64\Jfdafa32.exe

Filesize
896KB

MD5
b12044037ffb9f8972e67123898d3b3e

SHA1
6fc871ce39bd11e0118473dd2d9434634d942bbc

SHA256
3cc723dc8193778507ca8c5bcc375a079782652c7b2e0e6013c9c21d69e63932

SHA512
a32d4b78da707bbd7884ca7dd43dd3d4be1d4c4bec2716802fe1ad7dea0c2b1e63c54449aa0728622554e4dafc0cd3fb98f63d9764ad6cb5d5a74dd2f241243d

Download Submit
C:\Windows\SysWOW64\Kfimhkbo.exe

Filesize
640KB

MD5
1ab2250fa88c24b2c9fa345a7a0ec138

SHA1
1f2d75dccf1bd445bb20f9ab0ebff83b870ee9ef

SHA256
0beb0233a161040563198aae5561a6a6bac77ef80d89625ca59643e72bce6a6f

SHA512
dcc565fbfbdd754c01c427e4b5a3e1f0b4347bbaa84815ed9e6fdc7fa6f199959032cb86534a12d5faff862cf5ba83b0c2b445bf5f48fc6443c9d8227b7f24ae

Download Submit
C:\Windows\SysWOW64\Labkempb.exe

Filesize
896KB

MD5
dafcef77360905d31fd9af9cf46db34c

SHA1
dcc84c20bfece01a9650d0bd2def06087fcde85d

SHA256
0e6fb4bdc2a55a6b50081c31ce4c4d161037394588e32bc22f1b5a17a269a337

SHA512
15a8a57c1e60ae6cafdd4a03c49277d90a01391275dd90cf83a615aef7f301620e3213ff9228071814e42bde47a41856d281bebe471bb3999c7f9dd8e81aaf01

Download Submit
C:\Windows\SysWOW64\Lbcabo32.exe

Filesize
896KB

MD5
13ff79ec0747fc6f5df8e20a9a70ea71

SHA1
669cc4c50c4aa8141b31752bef8eee1438a6c149

SHA256
8dfa6704fce1269c7200e7f0ef249344c65ff84b13c9e5b4cc62bf8515d70c58

SHA512
c5d23e87170ae71ecd3c49b2eb308bb1693fae14dd1c79ec80cfd3e0de89ff02d48c4c3b906f551efe383154676f8fc78358a323c67f4e3052927fd8d1d8980a

Download Submit
C:\Windows\SysWOW64\Lbnggpfj.exe

Filesize
896KB

MD5
cfefdcd6041efc7fe3063d45be6b41fd

SHA1
44cb7cf1caa20dd73334ed1b24b3637941cd562e

SHA256
3a0c13c200d9072b2c9343d993892df1210988a38f9310ae8a2fe1ad5bc6992a

SHA512
687f7fee94f8a7061995e652ab7db529059a5ce24803a276b1ff402753fe304bb95e2a4e1860b3f6b319c64af04ec45c8e62cb1ff435a9945ac02c3e3bc7bfbb

Download Submit
C:\Windows\SysWOW64\Lhmapi32.exe

Filesize
320KB

MD5
c78808276dbad482e0ff78c12f0146ce

SHA1
d4af8f6ccccbc64b3dffb6fcca3edd4d7483d7f5

SHA256
7b2b412f68a18ce32241c4aec57ee180767ec246b269b53e52af6fcf31b1eb43

SHA512
a74c3bd1cd01322e80e23659d95fbc3f9e23e792b2816aad680453c272975abcde0177a7754aeda694b0032c32ae257511e05faf3d27a946c3aefa01e0cbef9b

Download Submit
C:\Windows\SysWOW64\Lipmoo32.exe

Filesize
896KB

MD5
a3c13630122757a0400ac0f076a04020

SHA1
db5be76204a871b848da86c5adc74ef6dca5d77c

SHA256
b9ea3e2cc627d6947fca6405444578e0c85a4c9dcd7420ed1f8a7d19a043a868

SHA512
600adc3734182dfbbc8dd38b4b7260eadfc9e078afad4a3f170cd407f4656ed18379f966a562b5db8658d2353c1a59074de9fe8d4828b6ca5d4a14e0702135e3

Download Submit
C:\Windows\SysWOW64\Mbjgcnll.exe

Filesize
896KB

MD5
c66de6bf01068f57f5b839052fd52957

SHA1
9bd9e9865157ffc989c30355c772e55585a68e59

SHA256
0f3b286d98e75f159b60c9899360d8425252846242efa46a8f9533e4c338f66b

SHA512
57ed3e3b5644b0b813531b8290be762681ff5337239197260cb68d2a9f4a5c3bafbe2d5924dde6e2d08c6a37cab337305ea7b0eb07652ae247cbabb723a71f3e

Download Submit
C:\Windows\SysWOW64\Mpchbhjl.exe

Filesize
896KB

MD5
3b7d58e69046196850ed36543fe45e16

SHA1
49f92fae500bd7cada04e2bd60ca32968b7fce71

SHA256
4bbcf079345719a77c5edc5d2580aedb64a7e08b2d6c3df43119ed864b51407f

SHA512
c98765f8ca1457cc338212168188187632403ee9922a975c4b8e83ca2e32f12329112dcf649b7098d5925ea664c59aff77d82eae755c68c9865ea5369bce1e55

Download Submit
C:\Windows\SysWOW64\Neaokboj.exe

Filesize
896KB

MD5
ccb3b520641f3f2ffa1a392c3134018f

SHA1
ee257414f24a8d5fd2764a5f29aea6bcc2977d0e

SHA256
c5afc8ea280eef4e3d1ef30ee05c571cac078238a5b2364ce2237fffed9cbfb6

SHA512
2a2e79acbd6eafc8c3fb9814e4e6c169236ca183ff07f40fcb35e10ea4d49480929335931e5ce4969572340ba21f6606ad5b281c77076fe9227841b3c6ec8de6

Download Submit
C:\Windows\SysWOW64\Oeffnl32.exe

Filesize
896KB

MD5
07d1528a795d10ea26a7594a0b81a786

SHA1
98acaa3baf567002b3a0c348d8f71ac51d99b78e

SHA256
edbd44d402237d994017efce0596410e0192b8dbd1d43b36e5145bada0824c42

SHA512
4029d6ab77907bf16e8fbdfcf9dba66ba1f65c78069dbad028967eb5345f8fc65fc1e88ac9e264d5654e3b3aa80ff8545c471d880717cb051ecac8f15282c12e

Download Submit
C:\Windows\SysWOW64\Ofooqinh.exe

Filesize
896KB

MD5
35ab924d85634f34205feb376a07b614

SHA1
ca53166bd16cb87e2624e998b6fca97f7da9ea24

SHA256
d5b5ce6b4a1743e674ae5ae934719e996d5eaa20029e5548c0d41df5fd53894b

SHA512
dd247b37543a3271aae9aa7a1e465e565dc986fc700ec43e516af65935456fa0785ddc1fbef859886da0166683d6d65605658fc5f05159fa15a2ed90193978ba

Download Submit
C:\Windows\SysWOW64\Oiagcg32.exe

Filesize
896KB

MD5
26b06cc1e7818f9e366e9b49bd61ee58

SHA1
bf09b13b555fae7ed3c51a322f5467c0ce5b2865

SHA256
aedc108c8eac4a2aebdee1b30f185a7bb14253edc2f4e731dc58726c08405948

SHA512
d8535498169f4166841896907154c99a242d2a55593d207f81cfb77ca9c123d76bb5ec410e157ac885c9424f87312fb2d8d2326865a3d33cca2d48b478a60909

Download Submit
C:\Windows\SysWOW64\Pfpidk32.exe

Filesize
896KB

MD5
52e44c423886379a6ed2a8a913dcc7f4

SHA1
99334c9f7dca43262dcba0e20ebba47f9db680e0

SHA256
55c3225f1915f72bb9a6f607ea12f95f78bcf2cce23e043dd081aa0fc65fe53e

SHA512
7c0d7ae2160bb6d1cb6d4bfc8e3e2a22bf5f1090c52914a5df5a9d261b766f0eeade7346223b8ad42aa680e14313dea59269a0b81fd0a8de4b9effdd82402afa

Download Submit
C:\Windows\SysWOW64\Pgihanii.exe

Filesize
896KB

MD5
51cd96337a4560bfb1b3e66ee14e4656

SHA1
ed131a87b3f22c3e2ecbeb70cbd3241170f41216

SHA256
b04f2d22e2afea07d0b0bc4a6457458c618d29689c1555b34f4551ee2715ee9b

SHA512
3562f6cefed9da57a0bb293483dae6ff5e22dd57a656a6ea92679ae0f0ea118bc541ff9757961d1165d8bf719a3cdc7314d19bd395cc18ce780ea8f641d3f15d

Download Submit
C:\Windows\SysWOW64\Qibmoa32.exe

Filesize
896KB

MD5
27491589bebe1b6e36392f7f9bfcfcb2

SHA1
02356dbc4d1b11b3dd2f87750e9b528993f12976

SHA256
a22d4afe06e4cd122dbb19675ae1553433cd9f2a4f1586fc7217a6aaf8e26e45

SHA512
b9c045ee7ad3051f87933cb31ff156b9103c47939172f5564c79c672bd50c3abdf90ea30166e01a91245af3dd160dc0a2d73fe5b9fc1aaf9d73247c530f4bc8b

Download Submit
C:\Windows\SysWOW64\Qkqdnkge.exe

Filesize
896KB

MD5
f838b4ef2343d23e0ceb1616274e81b7

SHA1
607b6bc504ab05c5e37921e57c2da881d30e9187

SHA256
59529177a9e81c7344ee912c6d49f6e6469691df610516c91fddaf6c6f8c7f9d

SHA512
141ad47dcda6dc6d8addd172c2b265630847bb4e050a10cc1596d1d1cede860b1dd728cff1a48535913fa404162156734827828fe2e73d468d52cb6554fa0005

Download Submit
memory/116-142-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/116-34-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/808-122-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/808-26-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/812-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/812-117-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1064-432-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1112-50-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1112-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1236-397-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1248-83-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1248-213-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1252-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1252-196-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1260-406-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1352-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1356-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1392-511-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1416-111-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1416-247-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1440-456-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1520-490-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1520-289-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1572-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1572-301-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1692-126-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1800-361-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1840-438-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2004-151-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2004-42-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2308-444-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2532-363-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2532-188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2608-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2792-314-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2868-370-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-246-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-99-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3140-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3188-58-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3188-179-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3220-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3220-184-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3276-368-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3332-388-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3384-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3400-284-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3400-489-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3436-131-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3440-493-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3460-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3460-333-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3512-162-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3512-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3540-223-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3540-400-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3656-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3680-321-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3724-295-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3768-351-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4124-387-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4124-205-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4156-503-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4176-252-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4176-460-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4212-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4216-494-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4236-219-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4316-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4332-307-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4344-376-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4424-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4436-135-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4436-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4664-230-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4664-91-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4668-492-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4704-488-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4704-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4784-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4784-414-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4792-107-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4792-10-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4820-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4820-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4820-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4820-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4820-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4848-206-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4848-76-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4964-280-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4964-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5008-334-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5104-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads