b480e48973525b2be3252c60473726037084606f8fb3bc2f2ee3b470b1913172

Analysis

max time kernel
69s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
12/11/2023, 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.6030c8683babac27dcc05debf7fa5f0a.exe
Size

186KB
MD5

6030c8683babac27dcc05debf7fa5f0a
SHA1

a6faf4923747f2ba3c009fe7b849f15150dd254a
SHA256

b480e48973525b2be3252c60473726037084606f8fb3bc2f2ee3b470b1913172
SHA512

20976b7d45f2dd636bf4b6675129dceb3cade154a686cb77c7f2b34c762ef4129136f304852c064d49b165ee3f481f96782b2163dce86ea4fd9357ea2ed4359d
SSDEEP

3072:MUtRSdxkjgMGcppHpp5ppHppHppkppkppkppgGppppppppppgZpp7ppppppQd5W3:MqobMG/5EF+Jk/4AcgHuv

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qlomemlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Addahh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cphgca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imjgbb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djihhoao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbghpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpinac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckidoc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhchhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fncibg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnbbg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hchihhng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcbded32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Homadjin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilbnkiba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkoinlbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnoefagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onjebpml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chlomnfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qpmmfbfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obccpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acdioc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjlhipbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbgafqla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lckglc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejojljqa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npognfpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpkliaol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcojdnfm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odcojm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhnichde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hahlnefd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jcknee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Piikhc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckqoapgd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oddmoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cphgca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oookgbpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oljkcpnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddpjjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qckbggad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdffah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpljdjnd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dpjfgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajggjq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlfniafa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfedmfqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbehienn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phkaqqoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndinck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkgaglpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlobmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbefolao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpfdkiac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdmcdhhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjlhipbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifckkhfi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfaijand.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cqiehnml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdfnmhnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clnanlhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbqdmodg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlgegcng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fchdnkpi.exe

Executes dropped EXE 64 IoCs

pid	Process
5060	Afcmfe32.exe
2212	Jbieebha.exe
3188	Dpjfgf32.exe
3172	Kmiqfoie.exe
760	Ejojljqa.exe
3132	Eddnic32.exe
2808	Eqkondfl.exe
2356	Fncibg32.exe
2268	Kfndlphp.exe
3776	Gjcmngnj.exe
4564	Gkcigjel.exe
448	Hepgkohh.exe
3512	Cajblmci.exe
4316	Hjdedepg.exe
228	Igjbci32.exe
2096	Indkpcdk.exe
4900	Jdmcdhhe.exe
4136	Jeolckne.exe
880	Khabke32.exe
4344	Kajfdk32.exe
3664	Eabjkdcc.exe
3524	Qckbggad.exe
4992	Lddble32.exe
4212	Ajggjq32.exe
3140	Loopdmpk.exe
3424	Lehhqg32.exe
1920	Dampal32.exe
4596	Pmgcoaie.exe
2016	Jpdqlgdc.exe
1264	Ilbnkiba.exe
4964	Genobp32.exe
464	WerFault.exe
2384	Kpncbemh.exe
4520	Addahh32.exe
4512	Pijcpmhc.exe
4640	Pdqcenmg.exe
3136	Pbddobla.exe
972	Pmoagk32.exe
2140	Gkoinlbg.exe
1352	Qelcamcj.exe
2308	Qpbgnecp.exe
4440	Afnlpohj.exe
1452	Aimhmkgn.exe
1668	Acbmjcgd.exe
980	Acdioc32.exe
2960	Apngjd32.exe
2796	Bfhofnpp.exe
2176	Bboplo32.exe
4624	Bcnleb32.exe
3808	Jcbibeki.exe
3984	Cfjeckpj.exe
4620	Clgmkbna.exe
2288	Hejono32.exe
1400	Dpefaq32.exe
3708	Dfonnk32.exe
2296	Feella32.exe
4996	Dedkogqm.exe
5024	Hfemkdbm.exe
1360	Kmbdkj32.exe
3336	Deidjf32.exe
4328	Dpoiho32.exe
1324	Gkbnkfei.exe
1800	Pnlafaio.exe
2232	Fgkfqgce.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Adlafb32.dll	Dpefaq32.exe
File opened for modification	C:\Windows\SysWOW64\Abipfifn.exe	Afpbkicl.exe
File opened for modification	C:\Windows\SysWOW64\Ifleji32.exe	Iobmmoed.exe
File created	C:\Windows\SysWOW64\Poifgc32.dll	Jbghpc32.exe
File opened for modification	C:\Windows\SysWOW64\Liofdigo.exe	Lbenho32.exe
File opened for modification	C:\Windows\SysWOW64\Mfhpilbc.exe	Ckidoc32.exe
File created	C:\Windows\SysWOW64\Caqpkjcl.exe	Afcmfe32.exe
File opened for modification	C:\Windows\SysWOW64\Ngemjg32.exe	Mdddhlbl.exe
File opened for modification	C:\Windows\SysWOW64\Fidbgm32.exe	Eoladdeo.exe
File opened for modification	C:\Windows\SysWOW64\Odcfdc32.exe	Ehcndkaa.exe
File opened for modification	C:\Windows\SysWOW64\Kcfnqccd.exe	Nkqpcnig.exe
File created	C:\Windows\SysWOW64\Ckqoapgd.exe	Cdfgdf32.exe
File opened for modification	C:\Windows\SysWOW64\Ejojljqa.exe	Kmiqfoie.exe
File created	C:\Windows\SysWOW64\Lehhqg32.exe	Loopdmpk.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmjlio.exe	Genobp32.exe
File created	C:\Windows\SysWOW64\Pijcpmhc.exe	Addahh32.exe
File created	C:\Windows\SysWOW64\Hcbpme32.exe	Hmhhpkcj.exe
File created	C:\Windows\SysWOW64\Imjgbb32.exe	Ignnjk32.exe
File opened for modification	C:\Windows\SysWOW64\Mfjlolpp.exe	Pjalpida.exe
File created	C:\Windows\SysWOW64\Pbphca32.dll	Qelcamcj.exe
File created	C:\Windows\SysWOW64\Fpbibenl.dll	Gkbnkfei.exe
File created	C:\Windows\SysWOW64\Hkfdijnh.dll	Jfokff32.exe
File created	C:\Windows\SysWOW64\Iqbjnc32.dll	Lbqdmodg.exe
File created	C:\Windows\SysWOW64\Acngqpog.dll	Pgmkbg32.exe
File opened for modification	C:\Windows\SysWOW64\Dgcoaock.exe	Dnhncjom.exe
File created	C:\Windows\SysWOW64\Lbenho32.exe	Lkkekdhe.exe
File opened for modification	C:\Windows\SysWOW64\Lennpb32.exe	Lndfchdj.exe
File created	C:\Windows\SysWOW64\Edmleg32.dll	Ppdjpcng.exe
File created	C:\Windows\SysWOW64\Ieiajckh.exe	Ikcmmjkb.exe
File created	C:\Windows\SysWOW64\Jomeoggk.exe	Jhcmbm32.exe
File created	C:\Windows\SysWOW64\Lkkekdhe.exe	Ljjicl32.exe
File created	C:\Windows\SysWOW64\Eddnic32.exe	Ejojljqa.exe
File created	C:\Windows\SysWOW64\Ogeigbeb.dll	Fncibg32.exe
File opened for modification	C:\Windows\SysWOW64\Jeolckne.exe	Jdmcdhhe.exe
File created	C:\Windows\SysWOW64\Mgfkhqoc.dll	Dpglmjoj.exe
File created	C:\Windows\SysWOW64\Goadfa32.exe	Geipnl32.exe
File opened for modification	C:\Windows\SysWOW64\Oplmdnpc.exe	Obhlkjaj.exe
File created	C:\Windows\SysWOW64\Dggkcakg.dll	Aimhmkgn.exe
File created	C:\Windows\SysWOW64\Fmnfnl32.dll	Odcojm32.exe
File opened for modification	C:\Windows\SysWOW64\Pboblika.exe	Blakhgoo.exe
File opened for modification	C:\Windows\SysWOW64\Akipic32.exe	Apcllk32.exe
File opened for modification	C:\Windows\SysWOW64\Dgliapic.exe	Dqbadf32.exe
File created	C:\Windows\SysWOW64\Cpdmho32.dll	Dfnbbg32.exe
File opened for modification	C:\Windows\SysWOW64\Minipm32.exe	Mpedgghj.exe
File created	C:\Windows\SysWOW64\Eabjkdcc.exe	Egjebn32.exe
File created	C:\Windows\SysWOW64\Jeolckne.exe	Jdmcdhhe.exe
File created	C:\Windows\SysWOW64\Nbefolao.exe	Nlknbb32.exe
File opened for modification	C:\Windows\SysWOW64\Fnmqegle.exe	Fhchhm32.exe
File created	C:\Windows\SysWOW64\Oddmoj32.exe	Onjebpml.exe
File created	C:\Windows\SysWOW64\Fkmpjb32.dll	Eoekde32.exe
File opened for modification	C:\Windows\SysWOW64\Gjcmngnj.exe	Kfndlphp.exe
File created	C:\Windows\SysWOW64\Lbcedmnl.exe	Eabjkdcc.exe
File created	C:\Windows\SysWOW64\Afnlpohj.exe	Qpbgnecp.exe
File created	C:\Windows\SysWOW64\Fibmebpm.dll	Ofnhfbjl.exe
File created	C:\Windows\SysWOW64\Ajmcke32.dll	Jckeokan.exe
File created	C:\Windows\SysWOW64\Dgcoaock.exe	Dnhncjom.exe
File created	C:\Windows\SysWOW64\Fagcfc32.exe	Ejmkiiha.exe
File opened for modification	C:\Windows\SysWOW64\Ohbfeh32.exe	Onmahojj.exe
File created	C:\Windows\SysWOW64\Qfpebmne.dll	Aiclodaj.exe
File created	C:\Windows\SysWOW64\Adkelplc.exe	Qggebl32.exe
File created	C:\Windows\SysWOW64\Mjjbjjdd.exe	Mmfaafej.exe
File created	C:\Windows\SysWOW64\Cogbfgli.dll	Odnfonag.exe
File created	C:\Windows\SysWOW64\Pfjbli32.dll	Elhnhm32.exe
File opened for modification	C:\Windows\SysWOW64\Ihheqd32.exe	Icklhnop.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10204	3288	WerFault.exe	796

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Beobcdoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmblhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dccjlblm.dll"	Djihhoao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljjicl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnmoglij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	NEAS.6030c8683babac27dcc05debf7fa5f0a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ailabddb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjnqap32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjlhipbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdgdca32.dll"	Oookgbpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iabodcnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dqbadf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfemkdbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldoafodd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbenho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chpangnk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgkfqgce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifckkhfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imjgbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfokff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfedfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnkemhbc.dll"	Kiikkada.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hebkid32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odkcpi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afpbkicl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Apcllk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aknmjgje.dll"	Qpbgnecp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edkkbopd.dll"	Nmkkle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlqmgaad.dll"	Cegnol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Egnhcgeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipqigjkp.dll"	Dbehienn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohkpigmd.dll"	Cpljdjnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmoikj32.dll"	Pmgcoaie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hejono32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlgjfqgj.dll"	Gmfpgmil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfonfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aiclodaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opmcod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcbded32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejjakmcg.dll"	Peimcaae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Philfgdh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anfmeldl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nmkkle32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnhncjom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Khabke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmdjha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pbphca32.dll"	Qelcamcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amfemoei.dll"	Ggjgofkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggjgofkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eaecci32.dll"	Kmiqfoie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beobcdoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcojdnfm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acemjd32.dll"	Feella32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jinloboo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcknee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Deidjf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imfmgcdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdqekdcj.dll"	Cqiehnml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljephmgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fgkfqgce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iokgno32.dll"	Kpbmme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Algbfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ieiajckh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmdbil32.dll"	Mfjlolpp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 5060	2160	NEAS.6030c8683babac27dcc05debf7fa5f0a.exe	92
PID 2160 wrote to memory of 5060	2160	NEAS.6030c8683babac27dcc05debf7fa5f0a.exe	92
PID 2160 wrote to memory of 5060	2160	NEAS.6030c8683babac27dcc05debf7fa5f0a.exe	92
PID 5060 wrote to memory of 2212	5060	Afcmfe32.exe	344
PID 5060 wrote to memory of 2212	5060	Afcmfe32.exe	344
PID 5060 wrote to memory of 2212	5060	Afcmfe32.exe	344
PID 2212 wrote to memory of 3188	2212	Jbieebha.exe	94
PID 2212 wrote to memory of 3188	2212	Jbieebha.exe	94
PID 2212 wrote to memory of 3188	2212	Jbieebha.exe	94
PID 3188 wrote to memory of 3172	3188	Dpjfgf32.exe	702
PID 3188 wrote to memory of 3172	3188	Dpjfgf32.exe	702
PID 3188 wrote to memory of 3172	3188	Dpjfgf32.exe	702
PID 3172 wrote to memory of 760	3172	Kmiqfoie.exe	96
PID 3172 wrote to memory of 760	3172	Kmiqfoie.exe	96
PID 3172 wrote to memory of 760	3172	Kmiqfoie.exe	96
PID 760 wrote to memory of 3132	760	Ejojljqa.exe	95
PID 760 wrote to memory of 3132	760	Ejojljqa.exe	95
PID 760 wrote to memory of 3132	760	Ejojljqa.exe	95
PID 3132 wrote to memory of 2808	3132	Eddnic32.exe	98
PID 3132 wrote to memory of 2808	3132	Eddnic32.exe	98
PID 3132 wrote to memory of 2808	3132	Eddnic32.exe	98
PID 2808 wrote to memory of 2356	2808	Eqkondfl.exe	99
PID 2808 wrote to memory of 2356	2808	Eqkondfl.exe	99
PID 2808 wrote to memory of 2356	2808	Eqkondfl.exe	99
PID 2356 wrote to memory of 2268	2356	Fncibg32.exe	926
PID 2356 wrote to memory of 2268	2356	Fncibg32.exe	926
PID 2356 wrote to memory of 2268	2356	Fncibg32.exe	926
PID 2268 wrote to memory of 3776	2268	Kfndlphp.exe	100
PID 2268 wrote to memory of 3776	2268	Kfndlphp.exe	100
PID 2268 wrote to memory of 3776	2268	Kfndlphp.exe	100
PID 3776 wrote to memory of 4564	3776	Gjcmngnj.exe	102
PID 3776 wrote to memory of 4564	3776	Gjcmngnj.exe	102
PID 3776 wrote to memory of 4564	3776	Gjcmngnj.exe	102
PID 4564 wrote to memory of 448	4564	Gkcigjel.exe	103
PID 4564 wrote to memory of 448	4564	Gkcigjel.exe	103
PID 4564 wrote to memory of 448	4564	Gkcigjel.exe	103
PID 448 wrote to memory of 3512	448	Hepgkohh.exe	749
PID 448 wrote to memory of 3512	448	Hepgkohh.exe	749
PID 448 wrote to memory of 3512	448	Hepgkohh.exe	749
PID 3512 wrote to memory of 4316	3512	Cajblmci.exe	106
PID 3512 wrote to memory of 4316	3512	Cajblmci.exe	106
PID 3512 wrote to memory of 4316	3512	Cajblmci.exe	106
PID 4316 wrote to memory of 228	4316	Hjdedepg.exe	105
PID 4316 wrote to memory of 228	4316	Hjdedepg.exe	105
PID 4316 wrote to memory of 228	4316	Hjdedepg.exe	105
PID 228 wrote to memory of 2096	228	Igjbci32.exe	107
PID 228 wrote to memory of 2096	228	Igjbci32.exe	107
PID 228 wrote to memory of 2096	228	Igjbci32.exe	107
PID 2096 wrote to memory of 4900	2096	Indkpcdk.exe	108
PID 2096 wrote to memory of 4900	2096	Indkpcdk.exe	108
PID 2096 wrote to memory of 4900	2096	Indkpcdk.exe	108
PID 4900 wrote to memory of 4136	4900	Jdmcdhhe.exe	111
PID 4900 wrote to memory of 4136	4900	Jdmcdhhe.exe	111
PID 4900 wrote to memory of 4136	4900	Jdmcdhhe.exe	111
PID 4136 wrote to memory of 880	4136	Jeolckne.exe	109
PID 4136 wrote to memory of 880	4136	Jeolckne.exe	109
PID 4136 wrote to memory of 880	4136	Jeolckne.exe	109
PID 880 wrote to memory of 4344	880	Khabke32.exe	110
PID 880 wrote to memory of 4344	880	Khabke32.exe	110
PID 880 wrote to memory of 4344	880	Khabke32.exe	110
PID 4344 wrote to memory of 3664	4344	Kajfdk32.exe	916
PID 4344 wrote to memory of 3664	4344	Kajfdk32.exe	916
PID 4344 wrote to memory of 3664	4344	Kajfdk32.exe	916
PID 3664 wrote to memory of 3524	3664	Eabjkdcc.exe	406

C:\Users\Admin\AppData\Local\Temp\NEAS.6030c8683babac27dcc05debf7fa5f0a.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.6030c8683babac27dcc05debf7fa5f0a.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\SysWOW64\Afcmfe32.exe
  C:\Windows\system32\Afcmfe32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\Caqpkjcl.exe
    C:\Windows\system32\Caqpkjcl.exe
    3⤵
    PID:2212
  - - C:\Windows\SysWOW64\Dpjfgf32.exe
      C:\Windows\system32\Dpjfgf32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3188
    - - C:\Windows\SysWOW64\Dcphdqmj.exe
        
        C:\Windows\system32\Dcphdqmj.exe
        5⤵
        
        PID:3172

C:\Windows\SysWOW64\Eddnic32.exe
C:\Windows\system32\Eddnic32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\SysWOW64\Eqkondfl.exe
  C:\Windows\system32\Eqkondfl.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\SysWOW64\Fncibg32.exe
    C:\Windows\system32\Fncibg32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\SysWOW64\Ggccllai.exe
      C:\Windows\system32\Ggccllai.exe
      4⤵
      PID:2268
    - - C:\Windows\SysWOW64\Kmhlijpm.exe
        
        C:\Windows\system32\Kmhlijpm.exe
        5⤵
        
        PID:3248
      - C:\Windows\SysWOW64\Kcbded32.exe
        
        C:\Windows\system32\Kcbded32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8004
        
        C:\Windows\SysWOW64\Kjlmbnof.exe
        
        C:\Windows\system32\Kjlmbnof.exe
        7⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\Kbgafqla.exe
        
        C:\Windows\system32\Kbgafqla.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4424
        
        C:\Windows\SysWOW64\Kiajck32.exe
        
        C:\Windows\system32\Kiajck32.exe
        9⤵
        
        PID:4428

C:\Windows\SysWOW64\Ejojljqa.exe
C:\Windows\system32\Ejojljqa.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\Gjcmngnj.exe
C:\Windows\system32\Gjcmngnj.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776
- C:\Windows\SysWOW64\Gkcigjel.exe
  C:\Windows\system32\Gkcigjel.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Windows\SysWOW64\Hepgkohh.exe
    C:\Windows\system32\Hepgkohh.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\Windows\SysWOW64\Hcjmhk32.exe
      C:\Windows\system32\Hcjmhk32.exe
      4⤵
      PID:3512
    - - C:\Windows\SysWOW64\Hjdedepg.exe
        
        C:\Windows\system32\Hjdedepg.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4316

C:\Windows\SysWOW64\Igjbci32.exe
C:\Windows\system32\Igjbci32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228
- C:\Windows\SysWOW64\Indkpcdk.exe
  C:\Windows\system32\Indkpcdk.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\Jdmcdhhe.exe
    C:\Windows\system32\Jdmcdhhe.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Windows\SysWOW64\Jeolckne.exe
      C:\Windows\system32\Jeolckne.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4136

C:\Windows\SysWOW64\Khabke32.exe
C:\Windows\system32\Khabke32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\Kajfdk32.exe
  C:\Windows\system32\Kajfdk32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\SysWOW64\Kopcbo32.exe
    C:\Windows\system32\Kopcbo32.exe
    3⤵
    PID:3664
  - - C:\Windows\SysWOW64\Elhnhm32.exe
      C:\Windows\system32\Elhnhm32.exe
      4⤵
      Drops file in System32 directory
      PID:8396
    - - C:\Windows\SysWOW64\Emikpeig.exe
        
        C:\Windows\system32\Emikpeig.exe
        5⤵
        
        PID:9180
      - C:\Windows\SysWOW64\Ecccmo32.exe
        
        C:\Windows\system32\Ecccmo32.exe
        6⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Ejmkiiha.exe
        
        C:\Windows\system32\Ejmkiiha.exe
        7⤵
        Drops file in System32 directory
        
        PID:3232
        
        C:\Windows\SysWOW64\Fagcfc32.exe
        
        C:\Windows\system32\Fagcfc32.exe
        8⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Iecmcpoj.exe
        
        C:\Windows\system32\Iecmcpoj.exe
        9⤵
        
        PID:9088
      - C:\Windows\SysWOW64\Mgddal32.exe
        
        C:\Windows\system32\Mgddal32.exe
        6⤵
        
        PID:9624

C:\Windows\SysWOW64\Lddble32.exe
C:\Windows\system32\Lddble32.exe
1⤵
- Executes dropped EXE
PID:4992
- C:\Windows\SysWOW64\Lojfin32.exe
  C:\Windows\system32\Lojfin32.exe
  2⤵
  PID:4212

C:\Windows\SysWOW64\Lehhqg32.exe
C:\Windows\system32\Lehhqg32.exe
1⤵
- Executes dropped EXE
PID:3424
- C:\Windows\SysWOW64\Mekdffee.exe
  C:\Windows\system32\Mekdffee.exe
  2⤵
  PID:1920

C:\Windows\SysWOW64\Madbagif.exe
C:\Windows\system32\Madbagif.exe
1⤵
PID:4596
- C:\Windows\SysWOW64\Mhnjna32.exe
  C:\Windows\system32\Mhnjna32.exe
  2⤵
  PID:2016

C:\Windows\SysWOW64\Mdghhb32.exe
C:\Windows\system32\Mdghhb32.exe
1⤵
PID:1264
- C:\Windows\SysWOW64\Nefdbekh.exe
  C:\Windows\system32\Nefdbekh.exe
  2⤵
  PID:4964
- C:\Windows\SysWOW64\Iblfgc32.exe
  C:\Windows\system32\Iblfgc32.exe
  2⤵
  PID:9084
- - C:\Windows\SysWOW64\Ildkpiqo.exe
    C:\Windows\system32\Ildkpiqo.exe
    3⤵
    PID:4524

C:\Windows\SysWOW64\Nkcmjlio.exe
C:\Windows\system32\Nkcmjlio.exe
1⤵
PID:464
- C:\Windows\SysWOW64\Noaeqjpe.exe
  C:\Windows\system32\Noaeqjpe.exe
  2⤵
  PID:2384
- - C:\Windows\SysWOW64\Ocdgahag.exe
    C:\Windows\system32\Ocdgahag.exe
    3⤵
    PID:4520
  - - C:\Windows\SysWOW64\Pijcpmhc.exe
      C:\Windows\system32\Pijcpmhc.exe
      4⤵
      Executes dropped EXE
      PID:4512

C:\Windows\SysWOW64\Loopdmpk.exe
C:\Windows\system32\Loopdmpk.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3140

C:\Windows\SysWOW64\Lbcedmnl.exe
C:\Windows\system32\Lbcedmnl.exe
1⤵
PID:3524

C:\Windows\SysWOW64\Pdqcenmg.exe
C:\Windows\system32\Pdqcenmg.exe
1⤵
- Executes dropped EXE
PID:4640
- C:\Windows\SysWOW64\Pbddobla.exe
  C:\Windows\system32\Pbddobla.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- - C:\Windows\SysWOW64\Pmoagk32.exe
    C:\Windows\system32\Pmoagk32.exe
    3⤵
    - Executes dropped EXE
    PID:972
  - - C:\Windows\SysWOW64\Pcijce32.exe
      C:\Windows\system32\Pcijce32.exe
      4⤵
      PID:2140

C:\Windows\SysWOW64\Qelcamcj.exe
C:\Windows\system32\Qelcamcj.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:1352
- C:\Windows\SysWOW64\Qpbgnecp.exe
  C:\Windows\system32\Qpbgnecp.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  PID:2308
- - C:\Windows\SysWOW64\Afnlpohj.exe
    C:\Windows\system32\Afnlpohj.exe
    3⤵
    - Executes dropped EXE
    PID:4440

C:\Windows\SysWOW64\Aimhmkgn.exe
C:\Windows\system32\Aimhmkgn.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1452
- C:\Windows\SysWOW64\Acbmjcgd.exe
  C:\Windows\system32\Acbmjcgd.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- - C:\Windows\SysWOW64\Acdioc32.exe
    C:\Windows\system32\Acdioc32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    PID:980

C:\Windows\SysWOW64\Apngjd32.exe
C:\Windows\system32\Apngjd32.exe
1⤵
- Executes dropped EXE
PID:2960
- C:\Windows\SysWOW64\Bfhofnpp.exe
  C:\Windows\system32\Bfhofnpp.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- - C:\Windows\SysWOW64\Bboplo32.exe
    C:\Windows\system32\Bboplo32.exe
    3⤵
    - Executes dropped EXE
    PID:2176
  - - C:\Windows\SysWOW64\Bcnleb32.exe
      C:\Windows\system32\Bcnleb32.exe
      4⤵
      Executes dropped EXE
      PID:4624
    - - C:\Windows\SysWOW64\Bbcignbo.exe
        
        C:\Windows\system32\Bbcignbo.exe
        5⤵
        
        PID:3808

C:\Windows\SysWOW64\Cfjeckpj.exe
C:\Windows\system32\Cfjeckpj.exe
1⤵
- Executes dropped EXE
PID:3984
- C:\Windows\SysWOW64\Clgmkbna.exe
  C:\Windows\system32\Clgmkbna.exe
  2⤵
  - Executes dropped EXE
  PID:4620

C:\Windows\SysWOW64\Dmifkecb.exe
C:\Windows\system32\Dmifkecb.exe
1⤵
PID:2296
- C:\Windows\SysWOW64\Dedkogqm.exe
  C:\Windows\system32\Dedkogqm.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- - C:\Windows\SysWOW64\Dibdeegc.exe
    C:\Windows\system32\Dibdeegc.exe
    3⤵
    PID:5024

C:\Windows\SysWOW64\Ddhhbngi.exe
C:\Windows\system32\Ddhhbngi.exe
1⤵
PID:1360
- C:\Windows\SysWOW64\Deidjf32.exe
  C:\Windows\system32\Deidjf32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:3336
- - C:\Windows\SysWOW64\Dpoiho32.exe
    C:\Windows\system32\Dpoiho32.exe
    3⤵
    - Executes dropped EXE
    PID:4328
  - - C:\Windows\SysWOW64\Dghadidj.exe
      C:\Windows\system32\Dghadidj.exe
      4⤵
      PID:1324
    - - C:\Windows\SysWOW64\Ecoaijio.exe
        
        C:\Windows\system32\Ecoaijio.exe
        5⤵
        
        PID:1800
      - C:\Windows\SysWOW64\Fgkfqgce.exe
        
        C:\Windows\system32\Fgkfqgce.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2232
        
        C:\Windows\SysWOW64\Gqmnpk32.exe
        
        C:\Windows\system32\Gqmnpk32.exe
        7⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\Gqagkjne.exe
        
        C:\Windows\system32\Gqagkjne.exe
        8⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Hmhhpkcj.exe
        
        C:\Windows\system32\Hmhhpkcj.exe
        9⤵
        Drops file in System32 directory
        
        PID:5204
        
        C:\Windows\SysWOW64\Hcbpme32.exe
        
        C:\Windows\system32\Hcbpme32.exe
        10⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Hjlhipbc.exe
        
        C:\Windows\system32\Hjlhipbc.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5284
        
        C:\Windows\SysWOW64\Hdffah32.exe
        
        C:\Windows\system32\Hdffah32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5348
        
        C:\Windows\SysWOW64\Ienlbf32.exe
        
        C:\Windows\system32\Ienlbf32.exe
        13⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Igqbiacj.exe
        
        C:\Windows\system32\Igqbiacj.exe
        14⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Inkjfk32.exe
        
        C:\Windows\system32\Inkjfk32.exe
        15⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Kfanflne.exe
        
        C:\Windows\system32\Kfanflne.exe
        16⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Ldoafodd.exe
        
        C:\Windows\system32\Ldoafodd.exe
        17⤵
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Lndfchdj.exe
        
        C:\Windows\system32\Lndfchdj.exe
        18⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Lennpb32.exe
        
        C:\Windows\system32\Lennpb32.exe
        19⤵
        
        PID:5764
- C:\Windows\SysWOW64\Kpbmme32.exe
  C:\Windows\system32\Kpbmme32.exe
  2⤵
  - Modifies registry class
  PID:8980

C:\Windows\SysWOW64\Dfonnk32.exe
C:\Windows\system32\Dfonnk32.exe
1⤵
- Executes dropped EXE
PID:3708

C:\Windows\SysWOW64\Dpefaq32.exe
C:\Windows\system32\Dpefaq32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1400

C:\Windows\SysWOW64\Cbaehl32.exe
C:\Windows\system32\Cbaehl32.exe
1⤵
PID:2288

C:\Windows\SysWOW64\Lkbmih32.exe
C:\Windows\system32\Lkbmih32.exe
1⤵
PID:5864
- C:\Windows\SysWOW64\Mginniij.exe
  C:\Windows\system32\Mginniij.exe
  2⤵
  PID:5904
- - C:\Windows\SysWOW64\Mhhjhlqm.exe
    C:\Windows\system32\Mhhjhlqm.exe
    3⤵
    PID:5944

C:\Windows\SysWOW64\Ldhdlnli.exe
C:\Windows\system32\Ldhdlnli.exe
1⤵
PID:5808

C:\Windows\SysWOW64\Mkicjgnn.exe
C:\Windows\system32\Mkicjgnn.exe
1⤵
PID:5988
- C:\Windows\SysWOW64\Mackfa32.exe
  C:\Windows\system32\Mackfa32.exe
  2⤵
  PID:6032
- - C:\Windows\SysWOW64\Mdddhlbl.exe
    C:\Windows\system32\Mdddhlbl.exe
    3⤵
    - Drops file in System32 directory
    PID:6080
  - - C:\Windows\SysWOW64\Ngemjg32.exe
      C:\Windows\system32\Ngemjg32.exe
      4⤵
      PID:6120
    - - C:\Windows\SysWOW64\Nnoefagj.exe
        
        C:\Windows\system32\Nnoefagj.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5164
      - C:\Windows\SysWOW64\Ndinck32.exe
        
        C:\Windows\system32\Ndinck32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5212
        
        C:\Windows\SysWOW64\Nkbfpeec.exe
        
        C:\Windows\system32\Nkbfpeec.exe
        7⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Onhhmpoo.exe
        
        C:\Windows\system32\Onhhmpoo.exe
        8⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\Onjebpml.exe
        
        C:\Windows\system32\Onjebpml.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Oddmoj32.exe
        
        C:\Windows\system32\Oddmoj32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5432
        
        C:\Windows\SysWOW64\Okneldkf.exe
        
        C:\Windows\system32\Okneldkf.exe
        11⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Onmahojj.exe
        
        C:\Windows\system32\Onmahojj.exe
        12⤵
        Drops file in System32 directory
        
        PID:2908
        
        C:\Windows\SysWOW64\Ohbfeh32.exe
        
        C:\Windows\system32\Ohbfeh32.exe
        13⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Oolnabal.exe
        
        C:\Windows\system32\Oolnabal.exe
        14⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Odifjipd.exe
        
        C:\Windows\system32\Odifjipd.exe
        15⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Oookgbpj.exe
        
        C:\Windows\system32\Oookgbpj.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Odkcpi32.exe
        
        C:\Windows\system32\Odkcpi32.exe
        17⤵
        Modifies registry class
        
        PID:5952
        
        C:\Windows\SysWOW64\Poagma32.exe
        
        C:\Windows\system32\Poagma32.exe
        18⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Philfgdh.exe
        
        C:\Windows\system32\Philfgdh.exe
        19⤵
        Modifies registry class
        
        PID:6064
        
        C:\Windows\SysWOW64\Pbfjjlgc.exe
        
        C:\Windows\system32\Pbfjjlgc.exe
        20⤵
        
        PID:2676

C:\Windows\SysWOW64\Pbifol32.exe
C:\Windows\system32\Pbifol32.exe
1⤵
PID:5860
- C:\Windows\SysWOW64\Phbolflm.exe
  C:\Windows\system32\Phbolflm.exe
  2⤵
  PID:2816
- - C:\Windows\SysWOW64\Anfmeldl.exe
    C:\Windows\system32\Anfmeldl.exe
    3⤵
    - Modifies registry class
    PID:3840
  - - C:\Windows\SysWOW64\Ailabddb.exe
      C:\Windows\system32\Ailabddb.exe
      4⤵
      Modifies registry class
      PID:3728
    - - C:\Windows\SysWOW64\Aofjoo32.exe
        
        C:\Windows\system32\Aofjoo32.exe
        5⤵
        
        PID:5652
      - C:\Windows\SysWOW64\Afpbkicl.exe
        
        C:\Windows\system32\Afpbkicl.exe
        6⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Abipfifn.exe
        
        C:\Windows\system32\Abipfifn.exe
        7⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Biedhclh.exe
        
        C:\Windows\system32\Biedhclh.exe
        8⤵
        
        PID:1536
- - C:\Windows\SysWOW64\Dodjemee.exe
    C:\Windows\system32\Dodjemee.exe
    3⤵
    PID:10120
  - - C:\Windows\SysWOW64\Dfnbbg32.exe
      C:\Windows\system32\Dfnbbg32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Drops file in System32 directory
      PID:5792
    - - C:\Windows\SysWOW64\Dmhkoaco.exe
        
        C:\Windows\system32\Dmhkoaco.exe
        5⤵
        
        PID:5476
      - C:\Windows\SysWOW64\Dcbckk32.exe
        
        C:\Windows\system32\Dcbckk32.exe
        6⤵
        
        PID:2476

C:\Windows\SysWOW64\Pkonbamc.exe
C:\Windows\system32\Pkonbamc.exe
1⤵
PID:5192

C:\Windows\SysWOW64\Beobcdoi.exe
C:\Windows\system32\Beobcdoi.exe
1⤵
- Modifies registry class
PID:2940
- C:\Windows\SysWOW64\Bkhjpn32.exe
  C:\Windows\system32\Bkhjpn32.exe
  2⤵
  PID:5556
- - C:\Windows\SysWOW64\Bbbblhnc.exe
    C:\Windows\system32\Bbbblhnc.exe
    3⤵
    PID:6112
  - - C:\Windows\SysWOW64\Cpklql32.exe
      C:\Windows\system32\Cpklql32.exe
      4⤵
      PID:1096
    - - C:\Windows\SysWOW64\Cfedmfqd.exe
        
        C:\Windows\system32\Cfedmfqd.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4856
      - C:\Windows\SysWOW64\Clffalkf.exe
        
        C:\Windows\system32\Clffalkf.exe
        6⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Cbqonf32.exe
        
        C:\Windows\system32\Cbqonf32.exe
        7⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Dimcppgm.exe
        
        C:\Windows\system32\Dimcppgm.exe
        8⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Dpglmjoj.exe
        
        C:\Windows\system32\Dpglmjoj.exe
        9⤵
        Drops file in System32 directory
        
        PID:4404
        
        C:\Windows\SysWOW64\Dbehienn.exe
        
        C:\Windows\system32\Dbehienn.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5396
        
        C:\Windows\SysWOW64\Dlbfmjqi.exe
        
        C:\Windows\system32\Dlbfmjqi.exe
        11⤵
        
        PID:848
        
        C:\Windows\SysWOW64\Eekjep32.exe
        
        C:\Windows\system32\Eekjep32.exe
        12⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\Eoekde32.exe
        
        C:\Windows\system32\Eoekde32.exe
        13⤵
        Drops file in System32 directory
        
        PID:5484
        
        C:\Windows\SysWOW64\Fpimgjbm.exe
        
        C:\Windows\system32\Fpimgjbm.exe
        7⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Ffcedd32.exe
        
        C:\Windows\system32\Ffcedd32.exe
        8⤵
        
        PID:5252

C:\Windows\SysWOW64\Eohhie32.exe
C:\Windows\system32\Eohhie32.exe
1⤵
PID:5704
- C:\Windows\SysWOW64\Eimlgnij.exe
  C:\Windows\system32\Eimlgnij.exe
  2⤵
  PID:5972
- - C:\Windows\SysWOW64\Epgdch32.exe
    C:\Windows\system32\Epgdch32.exe
    3⤵
    PID:3876
  - - C:\Windows\SysWOW64\Efampahd.exe
      C:\Windows\system32\Efampahd.exe
      4⤵
      PID:4952
    - - C:\Windows\SysWOW64\Eoladdeo.exe
        
        C:\Windows\system32\Eoladdeo.exe
        5⤵
        Drops file in System32 directory
        
        PID:1680
      - C:\Windows\SysWOW64\Fidbgm32.exe
        
        C:\Windows\system32\Fidbgm32.exe
        6⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Fcmgpbjc.exe
        
        C:\Windows\system32\Fcmgpbjc.exe
        7⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Fifomlap.exe
        
        C:\Windows\system32\Fifomlap.exe
        8⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Fpqgjf32.exe
        
        C:\Windows\system32\Fpqgjf32.exe
        9⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\Fcodfa32.exe
        
        C:\Windows\system32\Fcodfa32.exe
        10⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Fiilblom.exe
        
        C:\Windows\system32\Fiilblom.exe
        11⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Fpcdof32.exe
        
        C:\Windows\system32\Fpcdof32.exe
        12⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\Fgmllpng.exe
        
        C:\Windows\system32\Fgmllpng.exe
        13⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Fhnichde.exe
        
        C:\Windows\system32\Fhnichde.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5048
        
        C:\Windows\SysWOW64\Gohapb32.exe
        
        C:\Windows\system32\Gohapb32.exe
        15⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Geipnl32.exe
        
        C:\Windows\system32\Geipnl32.exe
        16⤵
        Drops file in System32 directory
        
        PID:5592
        
        C:\Windows\SysWOW64\Goadfa32.exe
        
        C:\Windows\system32\Goadfa32.exe
        17⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Hnfehm32.exe
        
        C:\Windows\system32\Hnfehm32.exe
        16⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Hphbpehj.exe
        
        C:\Windows\system32\Hphbpehj.exe
        17⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\Hfajlp32.exe
        
        C:\Windows\system32\Hfajlp32.exe
        18⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Hmlbij32.exe
        
        C:\Windows\system32\Hmlbij32.exe
        19⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Idfkednq.exe
        
        C:\Windows\system32\Idfkednq.exe
        20⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Ijpcbn32.exe
        
        C:\Windows\system32\Ijpcbn32.exe
        21⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Iajkohmj.exe
        
        C:\Windows\system32\Iajkohmj.exe
        22⤵
        
        PID:10456
  - - C:\Windows\SysWOW64\Gfodpbpl.exe
      C:\Windows\system32\Gfodpbpl.exe
      4⤵
      PID:5320

C:\Windows\SysWOW64\Icklhnop.exe
C:\Windows\system32\Icklhnop.exe
1⤵
- Drops file in System32 directory
PID:6224
- C:\Windows\SysWOW64\Ihheqd32.exe
  C:\Windows\system32\Ihheqd32.exe
  2⤵
  PID:6268
- - C:\Windows\SysWOW64\Iobmmoed.exe
    C:\Windows\system32\Iobmmoed.exe
    3⤵
    - Drops file in System32 directory
    PID:6312
  - - C:\Windows\SysWOW64\Ifleji32.exe
      C:\Windows\system32\Ifleji32.exe
      4⤵
      PID:6360
    - - C:\Windows\SysWOW64\Imfmgcdn.exe
        
        C:\Windows\system32\Imfmgcdn.exe
        5⤵
        Modifies registry class
        
        PID:6432

C:\Windows\SysWOW64\Ignnjk32.exe
C:\Windows\system32\Ignnjk32.exe
1⤵
- Drops file in System32 directory
PID:6468
- C:\Windows\SysWOW64\Imjgbb32.exe
  C:\Windows\system32\Imjgbb32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Modifies registry class
  PID:6512
- - C:\Windows\SysWOW64\Ioicnn32.exe
    C:\Windows\system32\Ioicnn32.exe
    3⤵
    PID:6564
  - - C:\Windows\SysWOW64\Ifckkhfi.exe
      C:\Windows\system32\Ifckkhfi.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Modifies registry class
      PID:6604
    - - C:\Windows\SysWOW64\Jjqdafmp.exe
        
        C:\Windows\system32\Jjqdafmp.exe
        5⤵
        
        PID:6640
      - C:\Windows\SysWOW64\Jonlimkg.exe
        
        C:\Windows\system32\Jonlimkg.exe
        6⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Jckeokan.exe
        
        C:\Windows\system32\Jckeokan.exe
        7⤵
        Drops file in System32 directory
        
        PID:6744
        
        C:\Windows\SysWOW64\Jjemle32.exe
        
        C:\Windows\system32\Jjemle32.exe
        8⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Jmdjha32.exe
        
        C:\Windows\system32\Jmdjha32.exe
        9⤵
        Modifies registry class
        
        PID:6872
        
        C:\Windows\SysWOW64\Jfokff32.exe
        
        C:\Windows\system32\Jfokff32.exe
        10⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6936
        
        C:\Windows\SysWOW64\Kaihonhl.exe
        
        C:\Windows\system32\Kaihonhl.exe
        11⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Kgcqlh32.exe
        
        C:\Windows\system32\Kgcqlh32.exe
        12⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Kidmcqeg.exe
        
        C:\Windows\system32\Kidmcqeg.exe
        13⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Kppbejka.exe
        
        C:\Windows\system32\Kppbejka.exe
        14⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Ljjpnb32.exe
        
        C:\Windows\system32\Ljjpnb32.exe
        15⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Libido32.exe
        
        C:\Windows\system32\Libido32.exe
        16⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Lplaaiqd.exe
        
        C:\Windows\system32\Lplaaiqd.exe
        17⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Lhcjbfag.exe
        
        C:\Windows\system32\Lhcjbfag.exe
        18⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Malnklgg.exe
        
        C:\Windows\system32\Malnklgg.exe
        19⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Aejmdegn.exe
        
        C:\Windows\system32\Aejmdegn.exe
        18⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Blenhmph.exe
        
        C:\Windows\system32\Blenhmph.exe
        15⤵
        
        PID:10344

C:\Windows\SysWOW64\Mfmpob32.exe
C:\Windows\system32\Mfmpob32.exe
1⤵
PID:6596
- C:\Windows\SysWOW64\Mpedgghj.exe
  C:\Windows\system32\Mpedgghj.exe
  2⤵
  - Drops file in System32 directory
  PID:6708
- - C:\Windows\SysWOW64\Minipm32.exe
    C:\Windows\system32\Minipm32.exe
    3⤵
    PID:6796
  - - C:\Windows\SysWOW64\Mphamg32.exe
      C:\Windows\system32\Mphamg32.exe
      4⤵
      PID:6824
    - - C:\Windows\SysWOW64\Nfaijand.exe
        
        C:\Windows\system32\Nfaijand.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6952
      - C:\Windows\SysWOW64\Nagngjmj.exe
        
        C:\Windows\system32\Nagngjmj.exe
        6⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Nieoal32.exe
        
        C:\Windows\system32\Nieoal32.exe
        7⤵
        
        PID:3488

C:\Windows\SysWOW64\Npognfpo.exe
C:\Windows\system32\Npognfpo.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6300
- C:\Windows\SysWOW64\Nkdlkope.exe
  C:\Windows\system32\Nkdlkope.exe
  2⤵
  PID:6460

C:\Windows\SysWOW64\Ngklppei.exe
C:\Windows\system32\Ngklppei.exe
1⤵
PID:6584
- C:\Windows\SysWOW64\Naqqmieo.exe
  C:\Windows\system32\Naqqmieo.exe
  2⤵
  PID:6688
- - C:\Windows\SysWOW64\Aacjofkp.exe
    C:\Windows\system32\Aacjofkp.exe
    3⤵
    PID:6964
  - - C:\Windows\SysWOW64\Ahnclp32.exe
      C:\Windows\system32\Ahnclp32.exe
      4⤵
      PID:6344
    - - C:\Windows\SysWOW64\Bafgdfim.exe
        
        C:\Windows\system32\Bafgdfim.exe
        5⤵
        
        PID:6576
      - C:\Windows\SysWOW64\Blkkaohc.exe
        
        C:\Windows\system32\Blkkaohc.exe
        6⤵
        
        PID:6272

C:\Windows\SysWOW64\Oacmchcl.exe
C:\Windows\system32\Oacmchcl.exe
1⤵
PID:6812
- C:\Windows\SysWOW64\Ohmepbki.exe
  C:\Windows\system32\Ohmepbki.exe
  2⤵
  PID:6964
- - C:\Windows\SysWOW64\Oinbgk32.exe
    C:\Windows\system32\Oinbgk32.exe
    3⤵
    PID:7040
  - - C:\Windows\SysWOW64\Odcfdc32.exe
      C:\Windows\system32\Odcfdc32.exe
      4⤵
      PID:6292
    - - C:\Windows\SysWOW64\Opmcod32.exe
        
        C:\Windows\system32\Opmcod32.exe
        5⤵
        Modifies registry class
        
        PID:6396
      - C:\Windows\SysWOW64\Onqdhh32.exe
        
        C:\Windows\system32\Onqdhh32.exe
        6⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Pgihanii.exe
        
        C:\Windows\system32\Pgihanii.exe
        7⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Pncanhaf.exe
        
        C:\Windows\system32\Pncanhaf.exe
        8⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Pdmikb32.exe
        
        C:\Windows\system32\Pdmikb32.exe
        9⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Pkgaglpp.exe
        
        C:\Windows\system32\Pkgaglpp.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6588
        
        C:\Windows\SysWOW64\Ppdjpcng.exe
        
        C:\Windows\system32\Ppdjpcng.exe
        11⤵
        Drops file in System32 directory
        
        PID:6768
        
        C:\Windows\SysWOW64\Phkaqqoi.exe
        
        C:\Windows\system32\Phkaqqoi.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6996
        
        C:\Windows\SysWOW64\Pacfjfej.exe
        
        C:\Windows\system32\Pacfjfej.exe
        13⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Phmnfp32.exe
        
        C:\Windows\system32\Phmnfp32.exe
        14⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Pjoknhbe.exe
        
        C:\Windows\system32\Pjoknhbe.exe
        15⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Pddokabk.exe
        
        C:\Windows\system32\Pddokabk.exe
        16⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Qhbhapha.exe
        
        C:\Windows\system32\Qhbhapha.exe
        17⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Qpmmfbfl.exe
        
        C:\Windows\system32\Qpmmfbfl.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7240

C:\Windows\SysWOW64\Qggebl32.exe
C:\Windows\system32\Qggebl32.exe
1⤵
- Drops file in System32 directory
PID:7276
- C:\Windows\SysWOW64\Adkelplc.exe
  C:\Windows\system32\Adkelplc.exe
  2⤵
  PID:7328
- - C:\Windows\SysWOW64\Aglnnkid.exe
    C:\Windows\system32\Aglnnkid.exe
    3⤵
    PID:7392
  - - C:\Windows\SysWOW64\Adpogp32.exe
      C:\Windows\system32\Adpogp32.exe
      4⤵
      PID:7436
    - - C:\Windows\SysWOW64\Aklciimh.exe
        
        C:\Windows\system32\Aklciimh.exe
        5⤵
        
        PID:7476
      - C:\Windows\SysWOW64\Aqilaplo.exe
        
        C:\Windows\system32\Aqilaplo.exe
        6⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Agcdnjcl.exe
        
        C:\Windows\system32\Agcdnjcl.exe
        7⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Anmmkd32.exe
        
        C:\Windows\system32\Anmmkd32.exe
        8⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Bggnijof.exe
        
        C:\Windows\system32\Bggnijof.exe
        9⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Cjomldfp.exe
        
        C:\Windows\system32\Cjomldfp.exe
        10⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Cqiehnml.exe
        
        C:\Windows\system32\Cqiehnml.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7768
        
        C:\Windows\SysWOW64\Cgcmeh32.exe
        
        C:\Windows\system32\Cgcmeh32.exe
        12⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Cnmebblf.exe
        
        C:\Windows\system32\Cnmebblf.exe
        13⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Cegnol32.exe
        
        C:\Windows\system32\Cegnol32.exe
        14⤵
        Modifies registry class
        
        PID:7904
        
        C:\Windows\SysWOW64\Ckafkfkp.exe
        
        C:\Windows\system32\Ckafkfkp.exe
        15⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        16⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Dijppjfd.exe
        
        C:\Windows\system32\Dijppjfd.exe
        17⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Dpcpei32.exe
        
        C:\Windows\system32\Dpcpei32.exe
        8⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Dadlmanj.exe
        
        C:\Windows\system32\Dadlmanj.exe
        9⤵
        
        PID:6404
    - - C:\Windows\SysWOW64\Hpgkeodo.exe
        
        C:\Windows\system32\Hpgkeodo.exe
        5⤵
        
        PID:7572
      - C:\Windows\SysWOW64\Iippne32.exe
        
        C:\Windows\system32\Iippne32.exe
        6⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Iiblcdil.exe
        
        C:\Windows\system32\Iiblcdil.exe
        7⤵
        
        PID:7452
  - - C:\Windows\SysWOW64\Dekobaki.exe
      C:\Windows\system32\Dekobaki.exe
      4⤵
      PID:11128
    - - C:\Windows\SysWOW64\Dpqcoj32.exe
        
        C:\Windows\system32\Dpqcoj32.exe
        5⤵
        
        PID:10320
      - C:\Windows\SysWOW64\Dabpgbpm.exe
        
        C:\Windows\system32\Dabpgbpm.exe
        6⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Djihhoao.exe
        
        C:\Windows\system32\Djihhoao.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7568

C:\Windows\SysWOW64\Deejpjgc.exe
C:\Windows\system32\Deejpjgc.exe
1⤵
PID:8136
- C:\Windows\SysWOW64\Dlobmd32.exe
  C:\Windows\system32\Dlobmd32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:8176
- - C:\Windows\SysWOW64\Dbijinfl.exe
    C:\Windows\system32\Dbijinfl.exe
    3⤵
    PID:7248
  - - C:\Windows\SysWOW64\Jdcplkoe.exe
      C:\Windows\system32\Jdcplkoe.exe
      4⤵
      PID:7060

C:\Windows\SysWOW64\Eaqdpjia.exe
C:\Windows\system32\Eaqdpjia.exe
1⤵
PID:7284
- C:\Windows\SysWOW64\Ehklmd32.exe
  C:\Windows\system32\Ehklmd32.exe
  2⤵
  PID:7356

C:\Windows\SysWOW64\Eijigg32.exe
C:\Windows\system32\Eijigg32.exe
1⤵
PID:7072
- C:\Windows\SysWOW64\Ebbmpmnb.exe
  C:\Windows\system32\Ebbmpmnb.exe
  2⤵
  PID:7468
- - C:\Windows\SysWOW64\Ehofhdli.exe
    C:\Windows\system32\Ehofhdli.exe
    3⤵
    PID:7548
  - - C:\Windows\SysWOW64\Eoindndf.exe
      C:\Windows\system32\Eoindndf.exe
      4⤵
      PID:7744

C:\Windows\SysWOW64\Fhdocc32.exe
C:\Windows\system32\Fhdocc32.exe
1⤵
PID:7820
- C:\Windows\SysWOW64\Ficlmf32.exe
  C:\Windows\system32\Ficlmf32.exe
  2⤵
  PID:7896
- - C:\Windows\SysWOW64\Foqdem32.exe
    C:\Windows\system32\Foqdem32.exe
    3⤵
    PID:8068
  - - C:\Windows\SysWOW64\Fbqiak32.exe
      C:\Windows\system32\Fbqiak32.exe
      4⤵
      PID:7208
    - - C:\Windows\SysWOW64\Giddddad.exe
        
        C:\Windows\system32\Giddddad.exe
        5⤵
        
        PID:7340
      - C:\Windows\SysWOW64\Hcofbifb.exe
        
        C:\Windows\system32\Hcofbifb.exe
        6⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Hlgjko32.exe
        
        C:\Windows\system32\Hlgjko32.exe
        7⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Hcabhido.exe
        
        C:\Windows\system32\Hcabhido.exe
        8⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Hligqnjp.exe
        
        C:\Windows\system32\Hligqnjp.exe
        9⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Hohcmjic.exe
        
        C:\Windows\system32\Hohcmjic.exe
        10⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Hebkid32.exe
        
        C:\Windows\system32\Hebkid32.exe
        11⤵
        Modifies registry class
        
        PID:8028
  - - C:\Windows\SysWOW64\Kgmlde32.exe
      C:\Windows\system32\Kgmlde32.exe
      4⤵
      PID:6348
    - - C:\Windows\SysWOW64\Kabpan32.exe
        
        C:\Windows\system32\Kabpan32.exe
        5⤵
        
        PID:10372

C:\Windows\SysWOW64\Hllcfnhm.exe
C:\Windows\system32\Hllcfnhm.exe
1⤵
PID:3476
- C:\Windows\SysWOW64\Hahlnefd.exe
  C:\Windows\system32\Hahlnefd.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:6656
- - C:\Windows\SysWOW64\Hlnqln32.exe
    C:\Windows\system32\Hlnqln32.exe
    3⤵
    PID:7136
  - - C:\Windows\SysWOW64\Hchihhng.exe
      C:\Windows\system32\Hchihhng.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:2784
    - - C:\Windows\SysWOW64\Iibaeb32.exe
        
        C:\Windows\system32\Iibaeb32.exe
        5⤵
        
        PID:3704
      - C:\Windows\SysWOW64\Ikcmmjkb.exe
        
        C:\Windows\system32\Ikcmmjkb.exe
        6⤵
        Drops file in System32 directory
        
        PID:7212
        
        C:\Windows\SysWOW64\Ieiajckh.exe
        
        C:\Windows\system32\Ieiajckh.exe
        7⤵
        Modifies registry class
        
        PID:3080

C:\Windows\SysWOW64\Ilcjgm32.exe
C:\Windows\system32\Ilcjgm32.exe
1⤵
PID:5820
- C:\Windows\SysWOW64\Icmbcg32.exe
  C:\Windows\system32\Icmbcg32.exe
  2⤵
  PID:7424
- - C:\Windows\SysWOW64\Ihjjln32.exe
    C:\Windows\system32\Ihjjln32.exe
    3⤵
    PID:1500
  - - C:\Windows\SysWOW64\Iabodcnj.exe
      C:\Windows\system32\Iabodcnj.exe
      4⤵
      Modifies registry class
      PID:3464
    - - C:\Windows\SysWOW64\Ihlgan32.exe
        
        C:\Windows\system32\Ihlgan32.exe
        5⤵
        
        PID:4740
- - C:\Windows\SysWOW64\Lajfbmmi.exe
    C:\Windows\system32\Lajfbmmi.exe
    3⤵
    PID:7080

C:\Windows\SysWOW64\Ifphkbep.exe
C:\Windows\system32\Ifphkbep.exe
1⤵
PID:6428
- C:\Windows\SysWOW64\Ikmpcicg.exe
  C:\Windows\system32\Ikmpcicg.exe
  2⤵
  PID:7076
- - C:\Windows\SysWOW64\Jbghpc32.exe
    C:\Windows\system32\Jbghpc32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Drops file in System32 directory
    PID:2160
  - - C:\Windows\SysWOW64\Jjnqap32.exe
      C:\Windows\system32\Jjnqap32.exe
      4⤵
      Modifies registry class
      PID:3676
    - - C:\Windows\SysWOW64\Jkomhhae.exe
        
        C:\Windows\system32\Jkomhhae.exe
        5⤵
        
        PID:7308
      - C:\Windows\SysWOW64\Jbieebha.exe
        
        C:\Windows\system32\Jbieebha.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\SysWOW64\Jhcmbm32.exe
        
        C:\Windows\system32\Jhcmbm32.exe
        7⤵
        Drops file in System32 directory
        
        PID:2604
        
        C:\Windows\SysWOW64\Jomeoggk.exe
        
        C:\Windows\system32\Jomeoggk.exe
        8⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\Jfgnka32.exe
        
        C:\Windows\system32\Jfgnka32.exe
        9⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Jlafhkfe.exe
        
        C:\Windows\system32\Jlafhkfe.exe
        10⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Jcknee32.exe
        
        C:\Windows\system32\Jcknee32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6924
        
        C:\Windows\SysWOW64\Jhjcbljf.exe
        
        C:\Windows\system32\Jhjcbljf.exe
        12⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\Mpmodg32.exe
        
        C:\Windows\system32\Mpmodg32.exe
        10⤵
        
        PID:7512

C:\Windows\SysWOW64\Iofpnhmc.exe
C:\Windows\system32\Iofpnhmc.exe
1⤵
PID:4476

C:\Windows\SysWOW64\Jodlof32.exe
C:\Windows\system32\Jodlof32.exe
1⤵
PID:7260
- C:\Windows\SysWOW64\Kfndlphp.exe
  C:\Windows\system32\Kfndlphp.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2268

C:\Windows\SysWOW64\Kcfnqccd.exe
C:\Windows\system32\Kcfnqccd.exe
1⤵
PID:7592
- C:\Windows\SysWOW64\Kfejmobh.exe
  C:\Windows\system32\Kfejmobh.exe
  2⤵
  PID:6420
- - C:\Windows\SysWOW64\Kkabefqp.exe
    C:\Windows\system32\Kkabefqp.exe
    3⤵
    PID:4484
- C:\Windows\SysWOW64\Pkebekgo.exe
  C:\Windows\system32\Pkebekgo.exe
  2⤵
  PID:5360
- - C:\Windows\SysWOW64\Pcagjndj.exe
    C:\Windows\system32\Pcagjndj.exe
    3⤵
    PID:8224

C:\Windows\SysWOW64\Kcikfcab.exe
C:\Windows\system32\Kcikfcab.exe
1⤵
PID:7164
- C:\Windows\SysWOW64\Lckglc32.exe
  C:\Windows\system32\Lckglc32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:7940
- - C:\Windows\SysWOW64\Ljephmgl.exe
    C:\Windows\system32\Ljephmgl.exe
    3⤵
    - Modifies registry class
    PID:4716
  - - C:\Windows\SysWOW64\Lkflpe32.exe
      C:\Windows\system32\Lkflpe32.exe
      4⤵
      PID:4488
    - - C:\Windows\SysWOW64\Lbqdmodg.exe
        
        C:\Windows\system32\Lbqdmodg.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6844
      - C:\Windows\SysWOW64\Lijlii32.exe
        
        C:\Windows\system32\Lijlii32.exe
        6⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Lcpqgbkj.exe
        
        C:\Windows\system32\Lcpqgbkj.exe
        7⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\Ljjicl32.exe
        
        C:\Windows\system32\Ljjicl32.exe
        8⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4000
        
        C:\Windows\SysWOW64\Lkkekdhe.exe
        
        C:\Windows\system32\Lkkekdhe.exe
        9⤵
        Drops file in System32 directory
        
        PID:3888

C:\Windows\SysWOW64\Lbenho32.exe
C:\Windows\system32\Lbenho32.exe
1⤵
- Drops file in System32 directory
- Modifies registry class
PID:3160
- C:\Windows\SysWOW64\Liofdigo.exe
  C:\Windows\system32\Liofdigo.exe
  2⤵
  PID:8240
- - C:\Windows\SysWOW64\Lpinac32.exe
    C:\Windows\system32\Lpinac32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:8288
  - - C:\Windows\SysWOW64\Ljoboloa.exe
      C:\Windows\system32\Ljoboloa.exe
      4⤵
      PID:8332

C:\Windows\SysWOW64\Lmmokgne.exe
C:\Windows\system32\Lmmokgne.exe
1⤵
PID:8368
- C:\Windows\SysWOW64\Mpnglbkf.exe
  C:\Windows\system32\Mpnglbkf.exe
  2⤵
  PID:8436
- C:\Windows\SysWOW64\Peddhb32.exe
  C:\Windows\system32\Peddhb32.exe
  2⤵
  PID:2856
- - C:\Windows\SysWOW64\Pjalpida.exe
    C:\Windows\system32\Pjalpida.exe
    3⤵
    - Drops file in System32 directory
    PID:8544

C:\Windows\SysWOW64\Mldhacpj.exe
C:\Windows\system32\Mldhacpj.exe
1⤵
PID:8544
- C:\Windows\SysWOW64\Mfjlolpp.exe
  C:\Windows\system32\Mfjlolpp.exe
  2⤵
  - Modifies registry class
  PID:8588
- - C:\Windows\SysWOW64\Mlgegcng.exe
    C:\Windows\system32\Mlgegcng.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:8652
- C:\Windows\SysWOW64\Pegqmbch.exe
  C:\Windows\system32\Pegqmbch.exe
  2⤵
  PID:8668
- - C:\Windows\SysWOW64\Peimcaae.exe
    C:\Windows\system32\Peimcaae.exe
    3⤵
    - Modifies registry class
    PID:2424
  - - C:\Windows\SysWOW64\Pbmnlf32.exe
      C:\Windows\system32\Pbmnlf32.exe
      4⤵
      PID:8772
    - - C:\Windows\SysWOW64\Pcojdnfm.exe
        
        C:\Windows\system32\Pcojdnfm.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7592

C:\Windows\SysWOW64\Mmfaafej.exe
C:\Windows\system32\Mmfaafej.exe
1⤵
- Drops file in System32 directory
PID:8708
- C:\Windows\SysWOW64\Mjjbjjdd.exe
  C:\Windows\system32\Mjjbjjdd.exe
  2⤵
  PID:8768
- - C:\Windows\SysWOW64\Nlknbb32.exe
    C:\Windows\system32\Nlknbb32.exe
    3⤵
    - Drops file in System32 directory
    PID:8816
  - - C:\Windows\SysWOW64\Nbefolao.exe
      C:\Windows\system32\Nbefolao.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:8856
    - - C:\Windows\SysWOW64\Nmkkle32.exe
        
        C:\Windows\system32\Nmkkle32.exe
        5⤵
        Modifies registry class
        
        PID:8996
      - C:\Windows\SysWOW64\Nidhffef.exe
        
        C:\Windows\system32\Nidhffef.exe
        6⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Niiaae32.exe
        
        C:\Windows\system32\Niiaae32.exe
        7⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Odnfonag.exe
        
        C:\Windows\system32\Odnfonag.exe
        8⤵
        Drops file in System32 directory
        
        PID:9148
        
        C:\Windows\SysWOW64\Oljkcpnb.exe
        
        C:\Windows\system32\Oljkcpnb.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9200

C:\Windows\SysWOW64\Obccpj32.exe
C:\Windows\system32\Obccpj32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8196
- C:\Windows\SysWOW64\Oinkmdml.exe
  C:\Windows\system32\Oinkmdml.exe
  2⤵
  PID:8268
- - C:\Windows\SysWOW64\Odcojm32.exe
    C:\Windows\system32\Odcojm32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Drops file in System32 directory
    PID:8320
  - - C:\Windows\SysWOW64\Ojmgggdo.exe
      C:\Windows\system32\Ojmgggdo.exe
      4⤵
      PID:8388

C:\Windows\SysWOW64\Olndnp32.exe
C:\Windows\system32\Olndnp32.exe
1⤵
PID:8416
- C:\Windows\SysWOW64\Obhlkjaj.exe
  C:\Windows\system32\Obhlkjaj.exe
  2⤵
  - Drops file in System32 directory
  PID:8456
- - C:\Windows\SysWOW64\Oplmdnpc.exe
    C:\Windows\system32\Oplmdnpc.exe
    3⤵
    PID:8572

C:\Windows\SysWOW64\Plcmiofg.exe
C:\Windows\system32\Plcmiofg.exe
1⤵
PID:8648
- C:\Windows\SysWOW64\Pghaghfn.exe
  C:\Windows\system32\Pghaghfn.exe
  2⤵
  PID:4736
- - C:\Windows\SysWOW64\Plejoode.exe
    C:\Windows\system32\Plejoode.exe
    3⤵
    PID:8760
  - - C:\Windows\SysWOW64\Pboblika.exe
      C:\Windows\system32\Pboblika.exe
      4⤵
      PID:8804
    - - C:\Windows\SysWOW64\Piikhc32.exe
        
        C:\Windows\system32\Piikhc32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4576
      - C:\Windows\SysWOW64\Pdoofl32.exe
        
        C:\Windows\system32\Pdoofl32.exe
        6⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\Pgmkbg32.exe
        
        C:\Windows\system32\Pgmkbg32.exe
        7⤵
        Drops file in System32 directory
        
        PID:8892
        
        C:\Windows\SysWOW64\Pmgcoaie.exe
        
        C:\Windows\system32\Pmgcoaie.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4596
        
        C:\Windows\SysWOW64\Pindcboi.exe
        
        C:\Windows\system32\Pindcboi.exe
        9⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\Pphlpl32.exe
        
        C:\Windows\system32\Pphlpl32.exe
        10⤵
        
        PID:9140
- - C:\Windows\SysWOW64\Dkbgeb32.exe
    C:\Windows\system32\Dkbgeb32.exe
    3⤵
    PID:9000
  - - C:\Windows\SysWOW64\Dampal32.exe
      C:\Windows\system32\Dampal32.exe
      4⤵
      Executes dropped EXE
      PID:1920
    - - C:\Windows\SysWOW64\Dememj32.exe
        
        C:\Windows\system32\Dememj32.exe
        5⤵
        
        PID:8072
      - C:\Windows\SysWOW64\Dcaefo32.exe
        
        C:\Windows\system32\Dcaefo32.exe
        6⤵
        
        PID:2696

C:\Windows\SysWOW64\Qkmqne32.exe
C:\Windows\system32\Qkmqne32.exe
1⤵
PID:9184
- C:\Windows\SysWOW64\Qlomemlj.exe
  C:\Windows\system32\Qlomemlj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:1980
- - C:\Windows\SysWOW64\Qlajkm32.exe
    C:\Windows\system32\Qlajkm32.exe
    3⤵
    PID:1576
  - - C:\Windows\SysWOW64\Qckbggad.exe
      C:\Windows\system32\Qckbggad.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      PID:3524
    - - C:\Windows\SysWOW64\Anqfepaj.exe
        
        C:\Windows\system32\Anqfepaj.exe
        5⤵
        
        PID:5000
      - C:\Windows\SysWOW64\Adjnaj32.exe
        
        C:\Windows\system32\Adjnaj32.exe
        6⤵
        
        PID:8528

C:\Windows\SysWOW64\Ajggjq32.exe
C:\Windows\system32\Ajggjq32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4212
- C:\Windows\SysWOW64\Ajjcoqdl.exe
  C:\Windows\system32\Ajjcoqdl.exe
  2⤵
  PID:8728
- - C:\Windows\SysWOW64\Apcllk32.exe
    C:\Windows\system32\Apcllk32.exe
    3⤵
    - Drops file in System32 directory
    - Modifies registry class
    PID:8808

C:\Windows\SysWOW64\Agpqnd32.exe
C:\Windows\system32\Agpqnd32.exe
1⤵
PID:4244
- C:\Windows\SysWOW64\Almifk32.exe
  C:\Windows\system32\Almifk32.exe
  2⤵
  PID:5040
- - C:\Windows\SysWOW64\Addahh32.exe
    C:\Windows\system32\Addahh32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4520
  - - C:\Windows\SysWOW64\Bdfnmhnj.exe
      C:\Windows\system32\Bdfnmhnj.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:1292
    - - C:\Windows\SysWOW64\Cgnmpbec.exe
        
        C:\Windows\system32\Cgnmpbec.exe
        5⤵
        
        PID:4288

C:\Windows\SysWOW64\Akipic32.exe
C:\Windows\system32\Akipic32.exe
1⤵
PID:8948

C:\Windows\SysWOW64\Cnmoglij.exe
C:\Windows\system32\Cnmoglij.exe
1⤵
- Modifies registry class
PID:2992
- C:\Windows\SysWOW64\Cdfgdf32.exe
  C:\Windows\system32\Cdfgdf32.exe
  2⤵
  - Drops file in System32 directory
  PID:8796

C:\Windows\SysWOW64\Ckqoapgd.exe
C:\Windows\system32\Ckqoapgd.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4368
- C:\Windows\SysWOW64\Cmblhh32.exe
  C:\Windows\system32\Cmblhh32.exe
  2⤵
  - Modifies registry class
  PID:8900
- - C:\Windows\SysWOW64\Ccldebeo.exe
    C:\Windows\system32\Ccldebeo.exe
    3⤵
    PID:9132
  - - C:\Windows\SysWOW64\Dcnqkb32.exe
      C:\Windows\system32\Dcnqkb32.exe
      4⤵
      PID:400
    - - C:\Windows\SysWOW64\Djhiglji.exe
        
        C:\Windows\system32\Djhiglji.exe
        5⤵
        
        PID:1152
      - C:\Windows\SysWOW64\Dqbadf32.exe
        
        C:\Windows\system32\Dqbadf32.exe
        6⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8236
        
        C:\Windows\SysWOW64\Dgliapic.exe
        
        C:\Windows\system32\Dgliapic.exe
        7⤵
        
        PID:456
    - - C:\Windows\SysWOW64\Flqigq32.exe
        
        C:\Windows\system32\Flqigq32.exe
        5⤵
        
        PID:8752
      - C:\Windows\SysWOW64\Gcmnijkd.exe
        
        C:\Windows\system32\Gcmnijkd.exe
        6⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Gcojoj32.exe
        
        C:\Windows\system32\Gcojoj32.exe
        7⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Gkjocm32.exe
        
        C:\Windows\system32\Gkjocm32.exe
        8⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Dnhncjom.exe
        
        C:\Windows\system32\Dnhncjom.exe
        7⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4976

C:\Windows\SysWOW64\Dnfanjqp.exe
C:\Windows\system32\Dnfanjqp.exe
1⤵
PID:8392
- C:\Windows\SysWOW64\Ddpjjd32.exe
  C:\Windows\system32\Ddpjjd32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:2432

C:\Windows\SysWOW64\Dgcoaock.exe
C:\Windows\system32\Dgcoaock.exe
1⤵
PID:2168
- C:\Windows\SysWOW64\Gkoinlbg.exe
  C:\Windows\system32\Gkoinlbg.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  PID:2140
- - C:\Windows\SysWOW64\Hfemkdbm.exe
    C:\Windows\system32\Hfemkdbm.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5024
  - - C:\Windows\SysWOW64\Homadjin.exe
      C:\Windows\system32\Homadjin.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:9116
    - - C:\Windows\SysWOW64\Helfbqeb.exe
        
        C:\Windows\system32\Helfbqeb.exe
        5⤵
        
        PID:2716
    - - C:\Windows\SysWOW64\Egjebn32.exe
        
        C:\Windows\system32\Egjebn32.exe
        5⤵
        Drops file in System32 directory
        
        PID:1820
- - C:\Windows\SysWOW64\Eanqpdgi.exe
    C:\Windows\system32\Eanqpdgi.exe
    3⤵
    PID:9068

C:\Windows\SysWOW64\Enoddi32.exe
C:\Windows\system32\Enoddi32.exe
1⤵
PID:2140

C:\Windows\SysWOW64\Enaaiifb.exe
C:\Windows\system32\Enaaiifb.exe
1⤵
PID:9116

C:\Windows\SysWOW64\Fhalcm32.exe
C:\Windows\system32\Fhalcm32.exe
1⤵
PID:8696
- C:\Windows\SysWOW64\Fnkdpgnh.exe
  C:\Windows\system32\Fnkdpgnh.exe
  2⤵
  PID:8980
- - C:\Windows\SysWOW64\Feella32.exe
    C:\Windows\system32\Feella32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:2296
  - - C:\Windows\SysWOW64\Fhchhm32.exe
      C:\Windows\system32\Fhchhm32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Drops file in System32 directory
      PID:9196
    - - C:\Windows\SysWOW64\Fnmqegle.exe
        
        C:\Windows\system32\Fnmqegle.exe
        5⤵
        
        PID:3816
      - C:\Windows\SysWOW64\Fegiba32.exe
        
        C:\Windows\system32\Fegiba32.exe
        6⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\Flaaok32.exe
        
        C:\Windows\system32\Flaaok32.exe
        7⤵
        
        PID:524
        
        C:\Windows\SysWOW64\Fmbnfcam.exe
        
        C:\Windows\system32\Fmbnfcam.exe
        8⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\Fdmfcn32.exe
        
        C:\Windows\system32\Fdmfcn32.exe
        9⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Fjfnphpf.exe
        
        C:\Windows\system32\Fjfnphpf.exe
        10⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Faqflb32.exe
        
        C:\Windows\system32\Faqflb32.exe
        11⤵
        
        PID:4840
- - C:\Windows\SysWOW64\Kikafjoc.exe
    C:\Windows\system32\Kikafjoc.exe
    3⤵
    PID:4488
  - - C:\Windows\SysWOW64\Kfoapo32.exe
      C:\Windows\system32\Kfoapo32.exe
      4⤵
      PID:1780
    - - C:\Windows\SysWOW64\Klljhe32.exe
        
        C:\Windows\system32\Klljhe32.exe
        5⤵
        
        PID:9040
      - C:\Windows\SysWOW64\Kbebdpca.exe
        
        C:\Windows\system32\Kbebdpca.exe
        6⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Leihlj32.exe
        
        C:\Windows\system32\Leihlj32.exe
        7⤵
        
        PID:2072

C:\Windows\SysWOW64\Fhjoilop.exe
C:\Windows\system32\Fhjoilop.exe
1⤵
PID:1520
- C:\Windows\SysWOW64\Fndgfffm.exe
  C:\Windows\system32\Fndgfffm.exe
  2⤵
  PID:820
- - C:\Windows\SysWOW64\Genobp32.exe
    C:\Windows\system32\Genobp32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4964
  - - C:\Windows\SysWOW64\Glhgojef.exe
      C:\Windows\system32\Glhgojef.exe
      4⤵
      PID:3804
    - - C:\Windows\SysWOW64\Gmjcgb32.exe
        
        C:\Windows\system32\Gmjcgb32.exe
        5⤵
        
        PID:8912
      - C:\Windows\SysWOW64\Gjndpg32.exe
        
        C:\Windows\system32\Gjndpg32.exe
        6⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Gechnpid.exe
        
        C:\Windows\system32\Gechnpid.exe
        7⤵
        
        PID:3288

C:\Windows\SysWOW64\Gmnmbbgp.exe
C:\Windows\system32\Gmnmbbgp.exe
1⤵
PID:8532
- C:\Windows\SysWOW64\Gkbnkfei.exe
  C:\Windows\system32\Gkbnkfei.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1324
- - C:\Windows\SysWOW64\Galfhpmf.exe
    C:\Windows\system32\Galfhpmf.exe
    3⤵
    PID:8284
  - - C:\Windows\SysWOW64\Hejono32.exe
      C:\Windows\system32\Hejono32.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      PID:2288
    - - C:\Windows\SysWOW64\Hobcgdjm.exe
        
        C:\Windows\system32\Hobcgdjm.exe
        5⤵
        
        PID:2984
      - C:\Windows\SysWOW64\Hhkgpjqn.exe
        
        C:\Windows\system32\Hhkgpjqn.exe
        6⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Hoepmd32.exe
        
        C:\Windows\system32\Hoepmd32.exe
        7⤵
        
        PID:3928

C:\Windows\SysWOW64\Heohinog.exe
C:\Windows\system32\Heohinog.exe
1⤵
PID:3084
- C:\Windows\SysWOW64\Hlipfh32.exe
  C:\Windows\system32\Hlipfh32.exe
  2⤵
  PID:4376

C:\Windows\SysWOW64\Imofip32.exe
C:\Windows\system32\Imofip32.exe
1⤵
PID:1800
- C:\Windows\SysWOW64\Iefnjm32.exe
  C:\Windows\system32\Iefnjm32.exe
  2⤵
  PID:8088
- - C:\Windows\SysWOW64\Ionbcb32.exe
    C:\Windows\system32\Ionbcb32.exe
    3⤵
    PID:4084
  - - C:\Windows\SysWOW64\Idkkki32.exe
      C:\Windows\system32\Idkkki32.exe
      4⤵
      PID:5156
    - - C:\Windows\SysWOW64\Inhion32.exe
        
        C:\Windows\system32\Inhion32.exe
        5⤵
        
        PID:5168
      - C:\Windows\SysWOW64\Idbalhho.exe
        
        C:\Windows\system32\Idbalhho.exe
        6⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Jnjednnp.exe
        
        C:\Windows\system32\Jnjednnp.exe
        7⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Jddnah32.exe
        
        C:\Windows\system32\Jddnah32.exe
        8⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Jknfnbmi.exe
        
        C:\Windows\system32\Jknfnbmi.exe
        9⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Jdgjgh32.exe
        
        C:\Windows\system32\Jdgjgh32.exe
        10⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Jkqccbkf.exe
        
        C:\Windows\system32\Jkqccbkf.exe
        11⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Jakkplbc.exe
        
        C:\Windows\system32\Jakkplbc.exe
        12⤵
        
        PID:9468
- C:\Windows\SysWOW64\Pgefogop.exe
  C:\Windows\system32\Pgefogop.exe
  2⤵
  PID:9824
- - C:\Windows\SysWOW64\Pdifhkni.exe
    C:\Windows\system32\Pdifhkni.exe
    3⤵
    PID:2220
  - - C:\Windows\SysWOW64\Pjeoablq.exe
      C:\Windows\system32\Pjeoablq.exe
      4⤵
      PID:5588
    - - C:\Windows\SysWOW64\Pdmpck32.exe
        
        C:\Windows\system32\Pdmpck32.exe
        5⤵
        
        PID:10012
      - C:\Windows\SysWOW64\Qfolkcpb.exe
        
        C:\Windows\system32\Qfolkcpb.exe
        6⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3288 -s 412
        7⤵
        Program crash
        
        PID:10204

C:\Windows\SysWOW64\Hddejjdo.exe
C:\Windows\system32\Hddejjdo.exe
1⤵
PID:5124

C:\Windows\SysWOW64\Jlponebi.exe
C:\Windows\system32\Jlponebi.exe
1⤵
PID:9512
- C:\Windows\SysWOW64\Jdkdbgpd.exe
  C:\Windows\system32\Jdkdbgpd.exe
  2⤵
  PID:9568

C:\Windows\SysWOW64\Joahop32.exe
C:\Windows\system32\Joahop32.exe
1⤵
PID:9604
- C:\Windows\SysWOW64\Kleiid32.exe
  C:\Windows\system32\Kleiid32.exe
  2⤵
  PID:9648

C:\Windows\SysWOW64\Kaaaak32.exe
C:\Windows\system32\Kaaaak32.exe
1⤵
PID:9688
- C:\Windows\SysWOW64\Khlinedh.exe
  C:\Windows\system32\Khlinedh.exe
  2⤵
  PID:9736
- - C:\Windows\SysWOW64\Knhbflbp.exe
    C:\Windows\system32\Knhbflbp.exe
    3⤵
    PID:9780
  - - C:\Windows\SysWOW64\Khnfce32.exe
      C:\Windows\system32\Khnfce32.exe
      4⤵
      PID:9824

C:\Windows\SysWOW64\Kohnpoib.exe
C:\Windows\system32\Kohnpoib.exe
1⤵
PID:9864
- C:\Windows\SysWOW64\Kdeghfhj.exe
  C:\Windows\system32\Kdeghfhj.exe
  2⤵
  PID:9908
- - C:\Windows\SysWOW64\Kkooep32.exe
    C:\Windows\system32\Kkooep32.exe
    3⤵
    PID:9956
  - - C:\Windows\SysWOW64\Kdgcne32.exe
      C:\Windows\system32\Kdgcne32.exe
      4⤵
      PID:10012
    - - C:\Windows\SysWOW64\Kkaljpmd.exe
        
        C:\Windows\system32\Kkaljpmd.exe
        5⤵
        
        PID:10056
      - C:\Windows\SysWOW64\Knphfklg.exe
        
        C:\Windows\system32\Knphfklg.exe
        6⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Kdipce32.exe
        
        C:\Windows\system32\Kdipce32.exe
        7⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Loodqn32.exe
        
        C:\Windows\system32\Loodqn32.exe
        8⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Lfimmhkg.exe
        
        C:\Windows\system32\Lfimmhkg.exe
        9⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Lmcejbbd.exe
        
        C:\Windows\system32\Lmcejbbd.exe
        10⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Lndaaj32.exe
        
        C:\Windows\system32\Lndaaj32.exe
        11⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Ldnjndpo.exe
        
        C:\Windows\system32\Ldnjndpo.exe
        12⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Locnlmoe.exe
        
        C:\Windows\system32\Locnlmoe.exe
        13⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Lbbjhini.exe
        
        C:\Windows\system32\Lbbjhini.exe
        14⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Lmhnea32.exe
        
        C:\Windows\system32\Lmhnea32.exe
        15⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Lfpcngdo.exe
        
        C:\Windows\system32\Lfpcngdo.exe
        16⤵
        
        PID:9592

C:\Windows\SysWOW64\Meepoc32.exe
C:\Windows\system32\Meepoc32.exe
1⤵
PID:9748
- C:\Windows\SysWOW64\Mmlhpaji.exe
  C:\Windows\system32\Mmlhpaji.exe
  2⤵
  PID:9812
- - C:\Windows\SysWOW64\Mnndhi32.exe
    C:\Windows\system32\Mnndhi32.exe
    3⤵
    PID:7384
  - - C:\Windows\SysWOW64\Megldcgd.exe
      C:\Windows\system32\Megldcgd.exe
      4⤵
      PID:6728
    - - C:\Windows\SysWOW64\Mkadam32.exe
        
        C:\Windows\system32\Mkadam32.exe
        5⤵
        
        PID:9920
      - C:\Windows\SysWOW64\Mbkmngfn.exe
        
        C:\Windows\system32\Mbkmngfn.exe
        6⤵
        
        PID:9976

C:\Windows\SysWOW64\Mieeka32.exe
C:\Windows\system32\Mieeka32.exe
1⤵
PID:10024
- C:\Windows\SysWOW64\Mkdagm32.exe
  C:\Windows\system32\Mkdagm32.exe
  2⤵
  PID:10092

C:\Windows\SysWOW64\Mfiedfmd.exe
C:\Windows\system32\Mfiedfmd.exe
1⤵
PID:10132
- C:\Windows\SysWOW64\Mmcnap32.exe
  C:\Windows\system32\Mmcnap32.exe
  2⤵
  PID:10200

C:\Windows\SysWOW64\Moajmk32.exe
C:\Windows\system32\Moajmk32.exe
1⤵
PID:9224
- C:\Windows\SysWOW64\Mpdgbkab.exe
  C:\Windows\system32\Mpdgbkab.exe
  2⤵
  PID:4528

C:\Windows\SysWOW64\Nilkkq32.exe
C:\Windows\system32\Nilkkq32.exe
1⤵
PID:9452
- C:\Windows\SysWOW64\Npfchkop.exe
  C:\Windows\system32\Npfchkop.exe
  2⤵
  PID:9532

C:\Windows\SysWOW64\Neclpamg.exe
C:\Windows\system32\Neclpamg.exe
1⤵
PID:9632
- C:\Windows\SysWOW64\Nlmdml32.exe
  C:\Windows\system32\Nlmdml32.exe
  2⤵
  PID:9672
- - C:\Windows\SysWOW64\Nfchjddj.exe
    C:\Windows\system32\Nfchjddj.exe
    3⤵
    PID:9724
  - - C:\Windows\SysWOW64\Nmmqgo32.exe
      C:\Windows\system32\Nmmqgo32.exe
      4⤵
      PID:6816

C:\Windows\SysWOW64\Nicalpak.exe
C:\Windows\system32\Nicalpak.exe
1⤵
PID:5448
- C:\Windows\SysWOW64\Npmjij32.exe
  C:\Windows\system32\Npmjij32.exe
  2⤵
  PID:10020

C:\Windows\SysWOW64\Nfgbec32.exe
C:\Windows\system32\Nfgbec32.exe
1⤵
PID:5712
- C:\Windows\SysWOW64\Oemofpel.exe
  C:\Windows\system32\Oemofpel.exe
  2⤵
  PID:10172
- - C:\Windows\SysWOW64\Opbcdieb.exe
    C:\Windows\system32\Opbcdieb.exe
    3⤵
    PID:5460
  - - C:\Windows\SysWOW64\Oflkqc32.exe
      C:\Windows\system32\Oflkqc32.exe
      4⤵
      PID:9332
    - - C:\Windows\SysWOW64\Olidijjf.exe
        
        C:\Windows\system32\Olidijjf.exe
        5⤵
        
        PID:5232
      - C:\Windows\SysWOW64\Ofnhfbjl.exe
        
        C:\Windows\system32\Ofnhfbjl.exe
        6⤵
        Drops file in System32 directory
        
        PID:5564
        
        C:\Windows\SysWOW64\Olkqnjhd.exe
        
        C:\Windows\system32\Olkqnjhd.exe
        7⤵
        
        PID:5948

C:\Windows\SysWOW64\Ofadlbhj.exe
C:\Windows\system32\Ofadlbhj.exe
1⤵
PID:9792
- C:\Windows\SysWOW64\Onlipd32.exe
  C:\Windows\system32\Onlipd32.exe
  2⤵
  PID:9844
- - C:\Windows\SysWOW64\Oianmm32.exe
    C:\Windows\system32\Oianmm32.exe
    3⤵
    PID:9968

C:\Windows\SysWOW64\Pfenga32.exe
C:\Windows\system32\Pfenga32.exe
1⤵
PID:6044
- C:\Windows\SysWOW64\Pfhklabb.exe
  C:\Windows\system32\Pfhklabb.exe
  2⤵
  PID:10128

C:\Windows\SysWOW64\Poelfc32.exe
C:\Windows\system32\Poelfc32.exe
1⤵
PID:9308
- C:\Windows\SysWOW64\Pimmil32.exe
  C:\Windows\system32\Pimmil32.exe
  2⤵
  PID:9456
- - C:\Windows\SysWOW64\Ppgeff32.exe
    C:\Windows\system32\Ppgeff32.exe
    3⤵
    PID:9596
  - - C:\Windows\SysWOW64\Qfanbpjg.exe
      C:\Windows\system32\Qfanbpjg.exe
      4⤵
      PID:9896
    - - C:\Windows\SysWOW64\Aploae32.exe
        
        C:\Windows\system32\Aploae32.exe
        5⤵
        
        PID:10156

C:\Windows\SysWOW64\Blnoad32.exe
C:\Windows\system32\Blnoad32.exe
1⤵
PID:4296
- C:\Windows\SysWOW64\Bchgnoai.exe
  C:\Windows\system32\Bchgnoai.exe
  2⤵
  PID:5128
- - C:\Windows\SysWOW64\Bibpkiie.exe
    C:\Windows\system32\Bibpkiie.exe
    3⤵
    PID:5260
  - - C:\Windows\SysWOW64\Bplhhc32.exe
      C:\Windows\system32\Bplhhc32.exe
      4⤵
      PID:9328
    - - C:\Windows\SysWOW64\Bgfpdmho.exe
        
        C:\Windows\system32\Bgfpdmho.exe
        5⤵
        
        PID:9464

C:\Windows\SysWOW64\Boaeioej.exe
C:\Windows\system32\Boaeioej.exe
1⤵
PID:9644
- C:\Windows\SysWOW64\Bjgifhep.exe
  C:\Windows\system32\Bjgifhep.exe
  2⤵
  PID:9232
- - C:\Windows\SysWOW64\Bpaacblm.exe
    C:\Windows\system32\Bpaacblm.exe
    3⤵
    PID:9732

C:\Windows\SysWOW64\Bcomonkq.exe
C:\Windows\system32\Bcomonkq.exe
1⤵
PID:3204
- C:\Windows\SysWOW64\Cnealfkf.exe
  C:\Windows\system32\Cnealfkf.exe
  2⤵
  PID:10088
- - C:\Windows\SysWOW64\Cofndo32.exe
    C:\Windows\system32\Cofndo32.exe
    3⤵
    PID:5312
  - - C:\Windows\SysWOW64\Cfpfqiha.exe
      C:\Windows\system32\Cfpfqiha.exe
      4⤵
      PID:5648
    - - C:\Windows\SysWOW64\Cljomc32.exe
        
        C:\Windows\system32\Cljomc32.exe
        5⤵
        
        PID:6096
      - C:\Windows\SysWOW64\Cphgca32.exe
        
        C:\Windows\system32\Cphgca32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3672
        
        C:\Windows\SysWOW64\Cgbppknb.exe
        
        C:\Windows\system32\Cgbppknb.exe
        7⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Cnlhme32.exe
        
        C:\Windows\system32\Cnlhme32.exe
        8⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Comddn32.exe
        
        C:\Windows\system32\Comddn32.exe
        9⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Cgdlfk32.exe
        
        C:\Windows\system32\Cgdlfk32.exe
        10⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Cnndbecl.exe
        
        C:\Windows\system32\Cnndbecl.exe
        11⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\Copajm32.exe
        
        C:\Windows\system32\Copajm32.exe
        12⤵
        
        PID:4060

C:\Windows\SysWOW64\Dqomdppm.exe
C:\Windows\system32\Dqomdppm.exe
1⤵
PID:5612
- C:\Windows\SysWOW64\Dflflg32.exe
  C:\Windows\system32\Dflflg32.exe
  2⤵
  PID:5912
- - C:\Windows\SysWOW64\Dlfniafa.exe
    C:\Windows\system32\Dlfniafa.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:2816

C:\Windows\SysWOW64\Djlkhe32.exe
C:\Windows\system32\Djlkhe32.exe
1⤵
PID:9656
- C:\Windows\SysWOW64\Dcdpakii.exe
  C:\Windows\system32\Dcdpakii.exe
  2⤵
  PID:5280
- - C:\Windows\SysWOW64\Dfclmfhl.exe
    C:\Windows\system32\Dfclmfhl.exe
    3⤵
    PID:3848
  - - C:\Windows\SysWOW64\Dmmdjp32.exe
      C:\Windows\system32\Dmmdjp32.exe
      4⤵
      PID:4700
    - - C:\Windows\SysWOW64\Dcglfjgf.exe
        
        C:\Windows\system32\Dcglfjgf.exe
        5⤵
        
        PID:5812

C:\Windows\SysWOW64\Eciilj32.exe
C:\Windows\system32\Eciilj32.exe
1⤵
PID:5984
- C:\Windows\SysWOW64\Ejcaidlp.exe
  C:\Windows\system32\Ejcaidlp.exe
  2⤵
  PID:1096
- - C:\Windows\SysWOW64\Eqmjen32.exe
    C:\Windows\system32\Eqmjen32.exe
    3⤵
    PID:5336
  - - C:\Windows\SysWOW64\Eggbbhkj.exe
      C:\Windows\system32\Eggbbhkj.exe
      4⤵
      PID:5688
    - - C:\Windows\SysWOW64\Emdjjo32.exe
        
        C:\Windows\system32\Emdjjo32.exe
        5⤵
        
        PID:3720
      - C:\Windows\SysWOW64\Ecnbgian.exe
        
        C:\Windows\system32\Ecnbgian.exe
        6⤵
        
        PID:5700

C:\Windows\SysWOW64\Ejhkdc32.exe
C:\Windows\system32\Ejhkdc32.exe
1⤵
PID:4928
- C:\Windows\SysWOW64\Eodclj32.exe
  C:\Windows\system32\Eodclj32.exe
  2⤵
  PID:2564
- - C:\Windows\SysWOW64\Eqdpfm32.exe
    C:\Windows\system32\Eqdpfm32.exe
    3⤵
    PID:5196
  - - C:\Windows\SysWOW64\Egnhcgeb.exe
      C:\Windows\system32\Egnhcgeb.exe
      4⤵
      Modifies registry class
      PID:5384

C:\Windows\SysWOW64\Fnjmea32.exe
C:\Windows\system32\Fnjmea32.exe
1⤵
PID:4380
- C:\Windows\SysWOW64\Fcgemhic.exe
  C:\Windows\system32\Fcgemhic.exe
  2⤵
  PID:5456

C:\Windows\SysWOW64\Fjcjpb32.exe
C:\Windows\system32\Fjcjpb32.exe
1⤵
PID:9488
- C:\Windows\SysWOW64\Fggkifmg.exe
  C:\Windows\system32\Fggkifmg.exe
  2⤵
  PID:3176
- - C:\Windows\SysWOW64\Fnacfp32.exe
    C:\Windows\system32\Fnacfp32.exe
    3⤵
    PID:2800

C:\Windows\SysWOW64\Fapobl32.exe
C:\Windows\system32\Fapobl32.exe
1⤵
PID:5828
- C:\Windows\SysWOW64\Ggjgofkd.exe
  C:\Windows\system32\Ggjgofkd.exe
  2⤵
  - Modifies registry class
  PID:5704
- - C:\Windows\SysWOW64\Gmfpgmil.exe
    C:\Windows\system32\Gmfpgmil.exe
    3⤵
    - Modifies registry class
    PID:3876

C:\Windows\SysWOW64\Gjmmfq32.exe
C:\Windows\system32\Gjmmfq32.exe
1⤵
PID:5468
- C:\Windows\SysWOW64\Gnkflo32.exe
  C:\Windows\system32\Gnkflo32.exe
  2⤵
  PID:5992
- - C:\Windows\SysWOW64\Ghcjedcj.exe
    C:\Windows\system32\Ghcjedcj.exe
    3⤵
    PID:5692
  - - C:\Windows\SysWOW64\Gmpcmkaa.exe
      C:\Windows\system32\Gmpcmkaa.exe
      4⤵
      PID:5344

C:\Windows\SysWOW64\Hcjkje32.exe
C:\Windows\system32\Hcjkje32.exe
1⤵
PID:5972
- C:\Windows\SysWOW64\Hjdcfp32.exe
  C:\Windows\system32\Hjdcfp32.exe
  2⤵
  PID:5872
- - C:\Windows\SysWOW64\Hanlcjgh.exe
    C:\Windows\system32\Hanlcjgh.exe
    3⤵
    PID:5740
  - - C:\Windows\SysWOW64\Hhhdpd32.exe
      C:\Windows\system32\Hhhdpd32.exe
      4⤵
      PID:848
    - - C:\Windows\SysWOW64\Hnblmnfa.exe
        
        C:\Windows\system32\Hnblmnfa.exe
        5⤵
        
        PID:5392
      - C:\Windows\SysWOW64\Hpchdf32.exe
        
        C:\Windows\system32\Hpchdf32.exe
        6⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Hjimaole.exe
        
        C:\Windows\system32\Hjimaole.exe
        7⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Hpeejfjm.exe
        
        C:\Windows\system32\Hpeejfjm.exe
        8⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Hfonfp32.exe
        
        C:\Windows\system32\Hfonfp32.exe
        9⤵
        Modifies registry class
        
        PID:3076

C:\Windows\SysWOW64\Idhgkcln.exe
C:\Windows\system32\Idhgkcln.exe
1⤵
PID:10500
- C:\Windows\SysWOW64\Ikbphn32.exe
  C:\Windows\system32\Ikbphn32.exe
  2⤵
  PID:10552
- - C:\Windows\SysWOW64\Ialhdh32.exe
    C:\Windows\system32\Ialhdh32.exe
    3⤵
    PID:10600
  - - C:\Windows\SysWOW64\Ihfpabbd.exe
      C:\Windows\system32\Ihfpabbd.exe
      4⤵
      PID:10652
    - - C:\Windows\SysWOW64\Iophnl32.exe
        
        C:\Windows\system32\Iophnl32.exe
        5⤵
        
        PID:10704
      - C:\Windows\SysWOW64\Ipaeedpp.exe
        
        C:\Windows\system32\Ipaeedpp.exe
        6⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Igkmbn32.exe
        
        C:\Windows\system32\Igkmbn32.exe
        7⤵
        
        PID:10792

C:\Windows\SysWOW64\Jmjojh32.exe
C:\Windows\system32\Jmjojh32.exe
1⤵
PID:10940
- C:\Windows\SysWOW64\Jhocgqjj.exe
  C:\Windows\system32\Jhocgqjj.exe
  2⤵
  PID:10980

C:\Windows\SysWOW64\Jknocljn.exe
C:\Windows\system32\Jknocljn.exe
1⤵
PID:11020
- C:\Windows\SysWOW64\Jahgpf32.exe
  C:\Windows\system32\Jahgpf32.exe
  2⤵
  PID:11072

C:\Windows\SysWOW64\Jmnheggo.exe
C:\Windows\system32\Jmnheggo.exe
1⤵
PID:11120
- C:\Windows\SysWOW64\Jondojna.exe
  C:\Windows\system32\Jondojna.exe
  2⤵
  PID:11168
- - C:\Windows\SysWOW64\Jpoagb32.exe
    C:\Windows\system32\Jpoagb32.exe
    3⤵
    PID:11216
  - - C:\Windows\SysWOW64\Kaonaekb.exe
      C:\Windows\system32\Kaonaekb.exe
      4⤵
      PID:10540
    - - C:\Windows\SysWOW64\Ldiiio32.exe
        
        C:\Windows\system32\Ldiiio32.exe
        5⤵
        
        PID:10588

C:\Windows\SysWOW64\Iodaikfl.exe
C:\Windows\system32\Iodaikfl.exe
1⤵
PID:10888

C:\Windows\SysWOW64\Lppjnpem.exe
C:\Windows\system32\Lppjnpem.exe
1⤵
PID:10668
- C:\Windows\SysWOW64\Lkenkhec.exe
  C:\Windows\system32\Lkenkhec.exe
  2⤵
  PID:10720
- - C:\Windows\SysWOW64\Ldnbdnlc.exe
    C:\Windows\system32\Ldnbdnlc.exe
    3⤵
    PID:6540

C:\Windows\SysWOW64\Ldpoinjq.exe
C:\Windows\system32\Ldpoinjq.exe
1⤵
PID:6244
- C:\Windows\SysWOW64\Loecgfjf.exe
  C:\Windows\system32\Loecgfjf.exe
  2⤵
  PID:10860
- - C:\Windows\SysWOW64\Lqfpoope.exe
    C:\Windows\system32\Lqfpoope.exe
    3⤵
    PID:10964
  - - C:\Windows\SysWOW64\Lhnhplpg.exe
      C:\Windows\system32\Lhnhplpg.exe
      4⤵
      PID:11012
    - - C:\Windows\SysWOW64\Mohplf32.exe
        
        C:\Windows\system32\Mohplf32.exe
        5⤵
        
        PID:11056
      - C:\Windows\SysWOW64\Mhpeelnd.exe
        
        C:\Windows\system32\Mhpeelnd.exe
        6⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Mojmbf32.exe
        
        C:\Windows\system32\Mojmbf32.exe
        7⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Mqkijnkp.exe
        
        C:\Windows\system32\Mqkijnkp.exe
        8⤵
        
        PID:11208

C:\Windows\SysWOW64\Lnfgmc32.exe
C:\Windows\system32\Lnfgmc32.exe
1⤵
PID:10812

C:\Windows\SysWOW64\Mhbakk32.exe
C:\Windows\system32\Mhbakk32.exe
1⤵
PID:11244
- C:\Windows\SysWOW64\Moljgeco.exe
  C:\Windows\system32\Moljgeco.exe
  2⤵
  PID:10272

C:\Windows\SysWOW64\Mggolhaj.exe
C:\Windows\system32\Mggolhaj.exe
1⤵
PID:10348
- C:\Windows\SysWOW64\Mbmbiqqp.exe
  C:\Windows\system32\Mbmbiqqp.exe
  2⤵
  PID:6956
- - C:\Windows\SysWOW64\Mbpoop32.exe
    C:\Windows\system32\Mbpoop32.exe
    3⤵
    PID:6748
  - - C:\Windows\SysWOW64\Mdnlkl32.exe
      C:\Windows\system32\Mdnlkl32.exe
      4⤵
      PID:10452

C:\Windows\SysWOW64\Nkhdgfen.exe
C:\Windows\system32\Nkhdgfen.exe
1⤵
PID:6784
- C:\Windows\SysWOW64\Nbbldp32.exe
  C:\Windows\system32\Nbbldp32.exe
  2⤵
  PID:11252
- - C:\Windows\SysWOW64\Nildajdg.exe
    C:\Windows\system32\Nildajdg.exe
    3⤵
    PID:6988
  - - C:\Windows\SysWOW64\Nofmndkd.exe
      C:\Windows\system32\Nofmndkd.exe
      4⤵
      PID:6940
    - - C:\Windows\SysWOW64\Nbdijpjh.exe
        
        C:\Windows\system32\Nbdijpjh.exe
        5⤵
        
        PID:6488

C:\Windows\SysWOW64\Niqnli32.exe
C:\Windows\system32\Niqnli32.exe
1⤵
PID:6336
- C:\Windows\SysWOW64\Nnmfdpni.exe
  C:\Windows\system32\Nnmfdpni.exe
  2⤵
  PID:6268
- - C:\Windows\SysWOW64\Nicjaino.exe
    C:\Windows\system32\Nicjaino.exe
    3⤵
    PID:6492

C:\Windows\SysWOW64\Nbkojo32.exe
C:\Windows\system32\Nbkojo32.exe
1⤵
PID:11048
- C:\Windows\SysWOW64\Nieggill.exe
  C:\Windows\system32\Nieggill.exe
  2⤵
  PID:11092

C:\Windows\SysWOW64\Oooodcci.exe
C:\Windows\system32\Oooodcci.exe
1⤵
PID:6892
- C:\Windows\SysWOW64\Oelhljaq.exe
  C:\Windows\system32\Oelhljaq.exe
  2⤵
  PID:6564
- - C:\Windows\SysWOW64\Ooalibaf.exe
    C:\Windows\system32\Ooalibaf.exe
    3⤵
    PID:10264

C:\Windows\SysWOW64\Oaeegjeb.exe
C:\Windows\system32\Oaeegjeb.exe
1⤵
PID:6980
- C:\Windows\SysWOW64\Obdbqm32.exe
  C:\Windows\system32\Obdbqm32.exe
  2⤵
  PID:10480
- - C:\Windows\SysWOW64\Oiojmgcb.exe
    C:\Windows\system32\Oiojmgcb.exe
    3⤵
    PID:10492

C:\Windows\SysWOW64\Phfcdcfg.exe
C:\Windows\system32\Phfcdcfg.exe
1⤵
PID:10740
- C:\Windows\SysWOW64\Pnplqn32.exe
  C:\Windows\system32\Pnplqn32.exe
  2⤵
  PID:6544
- - C:\Windows\SysWOW64\Pejdmh32.exe
    C:\Windows\system32\Pejdmh32.exe
    3⤵
    PID:6260

C:\Windows\SysWOW64\Pldljbmn.exe
C:\Windows\system32\Pldljbmn.exe
1⤵
PID:6528
- C:\Windows\SysWOW64\Plfipakk.exe
  C:\Windows\system32\Plfipakk.exe
  2⤵
  PID:6884
- - C:\Windows\SysWOW64\Pacahhib.exe
    C:\Windows\system32\Pacahhib.exe
    3⤵
    PID:6472
  - - C:\Windows\SysWOW64\Ppdbfpaa.exe
      C:\Windows\system32\Ppdbfpaa.exe
      4⤵
      PID:11100
    - - C:\Windows\SysWOW64\Pbbnbkpe.exe
        
        C:\Windows\system32\Pbbnbkpe.exe
        5⤵
        
        PID:11156

C:\Windows\SysWOW64\Aefcif32.exe
C:\Windows\system32\Aefcif32.exe
1⤵
PID:6308
- C:\Windows\SysWOW64\Aiclodaj.exe
  C:\Windows\system32\Aiclodaj.exe
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  PID:6368

C:\Windows\SysWOW64\Aocamk32.exe
C:\Windows\system32\Aocamk32.exe
1⤵
PID:7104
- C:\Windows\SysWOW64\Algbfo32.exe
  C:\Windows\system32\Algbfo32.exe
  2⤵
  - Modifies registry class
  PID:6688

C:\Windows\SysWOW64\Bbecnipp.exe
C:\Windows\system32\Bbecnipp.exe
1⤵
PID:6592
- C:\Windows\SysWOW64\Biolkc32.exe
  C:\Windows\system32\Biolkc32.exe
  2⤵
  PID:6712
- - C:\Windows\SysWOW64\Bpidhmoi.exe
    C:\Windows\system32\Bpidhmoi.exe
    3⤵
    PID:2876

C:\Windows\SysWOW64\Bbjmih32.exe
C:\Windows\system32\Bbjmih32.exe
1⤵
PID:6960
- C:\Windows\SysWOW64\Bbljoh32.exe
  C:\Windows\system32\Bbljoh32.exe
  2⤵
  PID:6232
- - C:\Windows\SysWOW64\Bifblbad.exe
    C:\Windows\system32\Bifblbad.exe
    3⤵
    PID:7152

C:\Windows\SysWOW64\Cemcqcgi.exe
C:\Windows\system32\Cemcqcgi.exe
1⤵
PID:6392
- C:\Windows\SysWOW64\Chlomnfl.exe
  C:\Windows\system32\Chlomnfl.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:6460
- - C:\Windows\SysWOW64\Coegih32.exe
    C:\Windows\system32\Coegih32.exe
    3⤵
    PID:6772
  - - C:\Windows\SysWOW64\Cikkga32.exe
      C:\Windows\system32\Cikkga32.exe
      4⤵
      PID:7488
    - - C:\Windows\SysWOW64\Cpedckdl.exe
        
        C:\Windows\system32\Cpedckdl.exe
        5⤵
        
        PID:11256
      - C:\Windows\SysWOW64\Cafpkc32.exe
        
        C:\Windows\system32\Cafpkc32.exe
        6⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Clldhljp.exe
        
        C:\Windows\system32\Clldhljp.exe
        7⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\Cojqdhid.exe
        
        C:\Windows\system32\Cojqdhid.exe
        8⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\Cediab32.exe
        
        C:\Windows\system32\Cediab32.exe
        9⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\Clnanlhn.exe
        
        C:\Windows\system32\Clnanlhn.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7328
        
        C:\Windows\SysWOW64\Cchikf32.exe
        
        C:\Windows\system32\Cchikf32.exe
        11⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Cpljdjnd.exe
        
        C:\Windows\system32\Cpljdjnd.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7392

C:\Windows\SysWOW64\Befmpdmq.exe
C:\Windows\system32\Befmpdmq.exe
1⤵
PID:6880

C:\Windows\SysWOW64\Dljqjjnp.exe
C:\Windows\system32\Dljqjjnp.exe
1⤵
PID:4932
- C:\Windows\SysWOW64\Dcdifdem.exe
  C:\Windows\system32\Dcdifdem.exe
  2⤵
  PID:10612
- - C:\Windows\SysWOW64\Dphipidf.exe
    C:\Windows\system32\Dphipidf.exe
    3⤵
    PID:4776
  - - C:\Windows\SysWOW64\Ebifha32.exe
      C:\Windows\system32\Ebifha32.exe
      4⤵
      PID:6248

C:\Windows\SysWOW64\Ehcndkaa.exe
C:\Windows\system32\Ehcndkaa.exe
1⤵
- Drops file in System32 directory
PID:7040
- C:\Windows\SysWOW64\Echbad32.exe
  C:\Windows\system32\Echbad32.exe
  2⤵
  PID:7024
- - C:\Windows\SysWOW64\Eodlad32.exe
    C:\Windows\system32\Eodlad32.exe
    3⤵
    PID:7016
  - - C:\Windows\SysWOW64\Efnennjc.exe
      C:\Windows\system32\Efnennjc.exe
      4⤵
      PID:10440
    - - C:\Windows\SysWOW64\Emhmkh32.exe
        
        C:\Windows\system32\Emhmkh32.exe
        5⤵
        
        PID:10624
      - C:\Windows\SysWOW64\Fbgbione.exe
        
        C:\Windows\system32\Fbgbione.exe
        6⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Fqhbgf32.exe
        
        C:\Windows\system32\Fqhbgf32.exe
        7⤵
        
        PID:7632

C:\Windows\SysWOW64\Fcikhace.exe
C:\Windows\system32\Fcikhace.exe
1⤵
PID:11112
- C:\Windows\SysWOW64\Fjccel32.exe
  C:\Windows\system32\Fjccel32.exe
  2⤵
  PID:7416
- - C:\Windows\SysWOW64\Fqmlbfbo.exe
    C:\Windows\system32\Fqmlbfbo.exe
    3⤵
    PID:7868

C:\Windows\SysWOW64\Fihqfh32.exe
C:\Windows\system32\Fihqfh32.exe
1⤵
PID:7252
- C:\Windows\SysWOW64\Gbqeonfj.exe
  C:\Windows\system32\Gbqeonfj.exe
  2⤵
  PID:3124
- - C:\Windows\SysWOW64\Godehbed.exe
    C:\Windows\system32\Godehbed.exe
    3⤵
    PID:7108
  - - C:\Windows\SysWOW64\Gjjjfkdj.exe
      C:\Windows\system32\Gjjjfkdj.exe
      4⤵
      PID:7148
    - - C:\Windows\SysWOW64\Gpgbna32.exe
        
        C:\Windows\system32\Gpgbna32.exe
        5⤵
        
        PID:6876
      - C:\Windows\SysWOW64\Gbenjm32.exe
        
        C:\Windows\system32\Gbenjm32.exe
        6⤵
        
        PID:2064

C:\Windows\SysWOW64\Ffekom32.exe
C:\Windows\system32\Ffekom32.exe
1⤵
PID:408

C:\Windows\SysWOW64\Gpioca32.exe
C:\Windows\system32\Gpioca32.exe
1⤵
PID:6172
- C:\Windows\SysWOW64\Gfcgpkhk.exe
  C:\Windows\system32\Gfcgpkhk.exe
  2⤵
  PID:6808
- - C:\Windows\SysWOW64\Giacmggo.exe
    C:\Windows\system32\Giacmggo.exe
    3⤵
    PID:7772

C:\Windows\SysWOW64\Gpkliaol.exe
C:\Windows\system32\Gpkliaol.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7824
- C:\Windows\SysWOW64\Gfedfk32.exe
  C:\Windows\system32\Gfedfk32.exe
  2⤵
  - Modifies registry class
  PID:7548
- - C:\Windows\SysWOW64\Hmolbene.exe
    C:\Windows\system32\Hmolbene.exe
    3⤵
    PID:6948
  - - C:\Windows\SysWOW64\Hcidoo32.exe
      C:\Windows\system32\Hcidoo32.exe
      4⤵
      PID:7920
    - - C:\Windows\SysWOW64\Hfhqkk32.exe
        
        C:\Windows\system32\Hfhqkk32.exe
        5⤵
        
        PID:8108

C:\Windows\SysWOW64\Hmaihekc.exe
C:\Windows\system32\Hmaihekc.exe
1⤵
PID:7836
- C:\Windows\SysWOW64\Hppedpkf.exe
  C:\Windows\system32\Hppedpkf.exe
  2⤵
  PID:7360
- - C:\Windows\SysWOW64\Hfjmajbc.exe
    C:\Windows\system32\Hfjmajbc.exe
    3⤵
    PID:1036
  - - C:\Windows\SysWOW64\Hpbajp32.exe
      C:\Windows\system32\Hpbajp32.exe
      4⤵
      PID:8016
    - - C:\Windows\SysWOW64\Habndbpf.exe
        
        C:\Windows\system32\Habndbpf.exe
        5⤵
        
        PID:7716
      - C:\Windows\SysWOW64\Hbcklkee.exe
        
        C:\Windows\system32\Hbcklkee.exe
        6⤵
        
        PID:7436

C:\Windows\SysWOW64\Ijcecgnl.exe
C:\Windows\system32\Ijcecgnl.exe
1⤵
PID:8024
- C:\Windows\SysWOW64\Idljll32.exe
  C:\Windows\system32\Idljll32.exe
  2⤵
  PID:7300

C:\Windows\SysWOW64\Jabgkpad.exe
C:\Windows\system32\Jabgkpad.exe
1⤵
PID:1216
- C:\Windows\SysWOW64\Jinloboo.exe
  C:\Windows\system32\Jinloboo.exe
  2⤵
  - Modifies registry class
  PID:7248

C:\Windows\SysWOW64\Jdhigk32.exe
C:\Windows\system32\Jdhigk32.exe
1⤵
PID:4712
- C:\Windows\SysWOW64\Jkaadebl.exe
  C:\Windows\system32\Jkaadebl.exe
  2⤵
  PID:2536
- - C:\Windows\SysWOW64\Jbmfig32.exe
    C:\Windows\system32\Jbmfig32.exe
    3⤵
    PID:7828

C:\Windows\SysWOW64\Kiikkada.exe
C:\Windows\system32\Kiikkada.exe
1⤵
- Modifies registry class
PID:8068

C:\Windows\SysWOW64\Kdalni32.exe
C:\Windows\system32\Kdalni32.exe
1⤵
PID:2632
- C:\Windows\SysWOW64\Kmiqfoie.exe
  C:\Windows\system32\Kmiqfoie.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Windows\SysWOW64\Kcfiof32.exe
    C:\Windows\system32\Kcfiof32.exe
    3⤵
    PID:7312
  - - C:\Windows\SysWOW64\Kipalpoj.exe
      C:\Windows\system32\Kipalpoj.exe
      4⤵
      PID:7424

C:\Windows\SysWOW64\Lkbkkbdj.exe
C:\Windows\system32\Lkbkkbdj.exe
1⤵
PID:7804
- C:\Windows\SysWOW64\Lkdgqbag.exe
  C:\Windows\system32\Lkdgqbag.exe
  2⤵
  PID:7520
- - C:\Windows\SysWOW64\Laqlclga.exe
    C:\Windows\system32\Laqlclga.exe
    3⤵
    PID:4216

C:\Windows\SysWOW64\Lcbikd32.exe
C:\Windows\system32\Lcbikd32.exe
1⤵
PID:7552
- C:\Windows\SysWOW64\Lngmhm32.exe
  C:\Windows\system32\Lngmhm32.exe
  2⤵
  PID:1876

C:\Windows\SysWOW64\Mncmck32.exe
C:\Windows\system32\Mncmck32.exe
1⤵
PID:3080
- C:\Windows\SysWOW64\Ncbaabom.exe
  C:\Windows\system32\Ncbaabom.exe
  2⤵
  PID:7808
- - C:\Windows\SysWOW64\Ndbnkefp.exe
    C:\Windows\system32\Ndbnkefp.exe
    3⤵
    PID:7608

C:\Windows\SysWOW64\Nklfho32.exe
C:\Windows\system32\Nklfho32.exe
1⤵
PID:4956
- C:\Windows\SysWOW64\Nddkaddm.exe
  C:\Windows\system32\Nddkaddm.exe
  2⤵
  PID:3916
- - C:\Windows\SysWOW64\Ndfgfd32.exe
    C:\Windows\system32\Ndfgfd32.exe
    3⤵
    PID:6340
  - - C:\Windows\SysWOW64\Nkqpcnig.exe
      C:\Windows\system32\Nkqpcnig.exe
      4⤵
      Drops file in System32 directory
      PID:4428
    - - C:\Windows\SysWOW64\Odidld32.exe
        
        C:\Windows\system32\Odidld32.exe
        5⤵
        
        PID:4484
      - C:\Windows\SysWOW64\Okcmingd.exe
        
        C:\Windows\system32\Okcmingd.exe
        6⤵
        
        PID:1064

C:\Windows\SysWOW64\Obmeeh32.exe
C:\Windows\system32\Obmeeh32.exe
1⤵
PID:7504
- C:\Windows\SysWOW64\Ogjmnomi.exe
  C:\Windows\system32\Ogjmnomi.exe
  2⤵
  PID:7952
- - C:\Windows\SysWOW64\Odnngclb.exe
    C:\Windows\system32\Odnngclb.exe
    3⤵
    PID:7304
  - - C:\Windows\SysWOW64\Okgfdm32.exe
      C:\Windows\system32\Okgfdm32.exe
      4⤵
      PID:2888

C:\Windows\SysWOW64\Obanqgkl.exe
C:\Windows\system32\Obanqgkl.exe
1⤵
PID:4920
- C:\Windows\SysWOW64\Occkhp32.exe
  C:\Windows\system32\Occkhp32.exe
  2⤵
  PID:8336
- - C:\Windows\SysWOW64\Onhoehpp.exe
    C:\Windows\system32\Onhoehpp.exe
    3⤵
    PID:8788

C:\Windows\SysWOW64\Pjkofh32.exe
C:\Windows\system32\Pjkofh32.exe
1⤵
PID:8344
- C:\Windows\SysWOW64\Qaegcb32.exe
  C:\Windows\system32\Qaegcb32.exe
  2⤵
  PID:2980
- - C:\Windows\SysWOW64\Qagdia32.exe
    C:\Windows\system32\Qagdia32.exe
    3⤵
    PID:1904
  - - C:\Windows\SysWOW64\Aloekjod.exe
      C:\Windows\system32\Aloekjod.exe
      4⤵
      PID:8748

C:\Windows\SysWOW64\Aalndaml.exe
C:\Windows\system32\Aalndaml.exe
1⤵
PID:8908
- C:\Windows\SysWOW64\Ajdbmf32.exe
  C:\Windows\system32\Ajdbmf32.exe
  2⤵
  PID:9112

C:\Windows\SysWOW64\Ahhbfkbf.exe
C:\Windows\system32\Ahhbfkbf.exe
1⤵
PID:8440
- C:\Windows\SysWOW64\Aaqgop32.exe
  C:\Windows\system32\Aaqgop32.exe
  2⤵
  PID:1768
- - C:\Windows\SysWOW64\Ahjoljqc.exe
    C:\Windows\system32\Ahjoljqc.exe
    3⤵
    PID:8824
  - - C:\Windows\SysWOW64\Adapqk32.exe
      C:\Windows\system32\Adapqk32.exe
      4⤵
      PID:8268
    - - C:\Windows\SysWOW64\Bngdndfn.exe
        
        C:\Windows\system32\Bngdndfn.exe
        5⤵
        
        PID:2456
      - C:\Windows\SysWOW64\Bhohfj32.exe
        
        C:\Windows\system32\Bhohfj32.exe
        6⤵
        
        PID:2408

C:\Windows\SysWOW64\Bniacddk.exe
C:\Windows\system32\Bniacddk.exe
1⤵
PID:6692
- C:\Windows\SysWOW64\Blmamh32.exe
  C:\Windows\system32\Blmamh32.exe
  2⤵
  PID:8580

C:\Windows\SysWOW64\Bajjeo32.exe
C:\Windows\system32\Bajjeo32.exe
1⤵
PID:8648
- C:\Windows\SysWOW64\Bhdbaihi.exe
  C:\Windows\system32\Bhdbaihi.exe
  2⤵
  PID:8252
- - C:\Windows\SysWOW64\Bbifobho.exe
    C:\Windows\system32\Bbifobho.exe
    3⤵
    PID:8932
  - - C:\Windows\SysWOW64\Blakhgoo.exe
      C:\Windows\system32\Blakhgoo.exe
      4⤵
      Drops file in System32 directory
      PID:8760
    - - C:\Windows\SysWOW64\Baocpnmf.exe
        
        C:\Windows\system32\Baocpnmf.exe
        5⤵
        
        PID:9064
      - C:\Windows\SysWOW64\Chhkmh32.exe
        
        C:\Windows\system32\Chhkmh32.exe
        6⤵
        
        PID:8756

C:\Windows\SysWOW64\Cobciblp.exe
C:\Windows\system32\Cobciblp.exe
1⤵
PID:2256
- C:\Windows\SysWOW64\Caapfnkd.exe
  C:\Windows\system32\Caapfnkd.exe
  2⤵
  PID:8868
- - C:\Windows\SysWOW64\Chkhbh32.exe
    C:\Windows\system32\Chkhbh32.exe
    3⤵
    PID:7292

C:\Windows\SysWOW64\Ckidoc32.exe
C:\Windows\system32\Ckidoc32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:8436
- C:\Windows\SysWOW64\Cacmkn32.exe
  C:\Windows\system32\Cacmkn32.exe
  2⤵
  PID:8592
- C:\Windows\SysWOW64\Mfhpilbc.exe
  C:\Windows\system32\Mfhpilbc.exe
  2⤵
  PID:8476

C:\Windows\SysWOW64\Cdaigi32.exe
C:\Windows\system32\Cdaigi32.exe
1⤵
PID:1576
- C:\Windows\SysWOW64\Cogmdb32.exe
  C:\Windows\system32\Cogmdb32.exe
  2⤵
  PID:840
- - C:\Windows\SysWOW64\Caeiam32.exe
    C:\Windows\system32\Caeiam32.exe
    3⤵
    PID:1076
  - - C:\Windows\SysWOW64\Chpangnk.exe
      C:\Windows\system32\Chpangnk.exe
      4⤵
      Modifies registry class
      PID:8416
    - - C:\Windows\SysWOW64\Coijja32.exe
        
        C:\Windows\system32\Coijja32.exe
        5⤵
        
        PID:8840
      - C:\Windows\SysWOW64\Cecbgl32.exe
        
        C:\Windows\system32\Cecbgl32.exe
        6⤵
        
        PID:9164

C:\Windows\SysWOW64\Ckpjob32.exe
C:\Windows\system32\Ckpjob32.exe
1⤵
PID:3536
- C:\Windows\SysWOW64\Cajblmci.exe
  C:\Windows\system32\Cajblmci.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\SysWOW64\Cdiohhbm.exe
    C:\Windows\system32\Cdiohhbm.exe
    3⤵
    PID:4736

C:\Windows\SysWOW64\Dlijodjd.exe
C:\Windows\system32\Dlijodjd.exe
1⤵
PID:9204
- C:\Windows\SysWOW64\Elkfed32.exe
  C:\Windows\system32\Elkfed32.exe
  2⤵
  PID:8984
- - C:\Windows\SysWOW64\Eedkniob.exe
    C:\Windows\system32\Eedkniob.exe
    3⤵
    PID:8212

C:\Windows\SysWOW64\Elpppcdl.exe
C:\Windows\system32\Elpppcdl.exe
1⤵
PID:8572
- C:\Windows\SysWOW64\Eoollocp.exe
  C:\Windows\system32\Eoollocp.exe
  2⤵
  PID:9208
- - C:\Windows\SysWOW64\Edkddeag.exe
    C:\Windows\system32\Edkddeag.exe
    3⤵
    PID:8468

C:\Windows\SysWOW64\Eaoenjqa.exe
C:\Windows\system32\Eaoenjqa.exe
1⤵
PID:8364
- C:\Windows\SysWOW64\Fhljpcfk.exe
  C:\Windows\system32\Fhljpcfk.exe
  2⤵
  PID:8492
- - C:\Windows\SysWOW64\Fcanmlea.exe
    C:\Windows\system32\Fcanmlea.exe
    3⤵
    PID:8800

C:\Windows\SysWOW64\Fhngfcdi.exe
C:\Windows\system32\Fhngfcdi.exe
1⤵
PID:8784
- C:\Windows\SysWOW64\Fohobmke.exe
  C:\Windows\system32\Fohobmke.exe
  2⤵
  PID:8744
- - C:\Windows\SysWOW64\Fllplajo.exe
    C:\Windows\system32\Fllplajo.exe
    3⤵
    PID:5000
  - - C:\Windows\SysWOW64\Fchdnkpi.exe
      C:\Windows\system32\Fchdnkpi.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:400

C:\Windows\SysWOW64\Hkfookmo.exe
C:\Windows\system32\Hkfookmo.exe
1⤵
PID:4280
- C:\Windows\SysWOW64\Hflclcle.exe
  C:\Windows\system32\Hflclcle.exe
  2⤵
  PID:4224
- - C:\Windows\SysWOW64\Hodgei32.exe
    C:\Windows\system32\Hodgei32.exe
    3⤵
    PID:4400

C:\Windows\SysWOW64\Hmhhnmao.exe
C:\Windows\system32\Hmhhnmao.exe
1⤵
PID:4984
- C:\Windows\SysWOW64\Hpfdkiac.exe
  C:\Windows\system32\Hpfdkiac.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:8640

C:\Windows\SysWOW64\Iehfno32.exe
C:\Windows\system32\Iehfno32.exe
1⤵
PID:6148
- C:\Windows\SysWOW64\Ilbnkiba.exe
  C:\Windows\system32\Ilbnkiba.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  PID:1264

C:\Windows\SysWOW64\Ilfhfh32.exe
C:\Windows\system32\Ilfhfh32.exe
1⤵
PID:9056
- C:\Windows\SysWOW64\Jijhom32.exe
  C:\Windows\system32\Jijhom32.exe
  2⤵
  PID:9108
- - C:\Windows\SysWOW64\Jpdqlgdc.exe
    C:\Windows\system32\Jpdqlgdc.exe
    3⤵
    - Executes dropped EXE
    PID:2016
  - - C:\Windows\SysWOW64\Jfoihalp.exe
      C:\Windows\system32\Jfoihalp.exe
      4⤵
      PID:8356
    - - C:\Windows\SysWOW64\Jmhaek32.exe
        
        C:\Windows\system32\Jmhaek32.exe
        5⤵
        
        PID:4020
      - C:\Windows\SysWOW64\Jcbibeki.exe
        
        C:\Windows\system32\Jcbibeki.exe
        6⤵
        Executes dropped EXE
        
        PID:3808
        
        C:\Windows\SysWOW64\Jecejm32.exe
        
        C:\Windows\system32\Jecejm32.exe
        7⤵
        
        PID:1664

C:\Windows\SysWOW64\Jbjciano.exe
C:\Windows\system32\Jbjciano.exe
1⤵
PID:5028
- C:\Windows\SysWOW64\Kpncbemh.exe
  C:\Windows\system32\Kpncbemh.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- - C:\Windows\SysWOW64\Kmbdkj32.exe
    C:\Windows\system32\Kmbdkj32.exe
    3⤵
    - Executes dropped EXE
    PID:1360

C:\Windows\SysWOW64\Ldjhib32.exe
C:\Windows\system32\Ldjhib32.exe
1⤵
PID:4288
- C:\Windows\SysWOW64\Lifqbi32.exe
  C:\Windows\system32\Lifqbi32.exe
  2⤵
  PID:2208

C:\Windows\SysWOW64\Meiabh32.exe
C:\Windows\system32\Meiabh32.exe
1⤵
PID:5216
- C:\Windows\SysWOW64\Nlefebfg.exe
  C:\Windows\system32\Nlefebfg.exe
  2⤵
  PID:9124
- - C:\Windows\SysWOW64\Ndokko32.exe
    C:\Windows\system32\Ndokko32.exe
    3⤵
    PID:8568
  - - C:\Windows\SysWOW64\Ncfdbk32.exe
      C:\Windows\system32\Ncfdbk32.exe
      4⤵
      PID:9928

C:\Windows\SysWOW64\Nloikqnl.exe
C:\Windows\system32\Nloikqnl.exe
1⤵
PID:9988
- C:\Windows\SysWOW64\Opmaaodc.exe
  C:\Windows\system32\Opmaaodc.exe
  2⤵
  PID:10048

C:\Windows\SysWOW64\Oqfdgn32.exe
C:\Windows\system32\Oqfdgn32.exe
1⤵
PID:9228
- C:\Windows\SysWOW64\Pfcmpdjp.exe
  C:\Windows\system32\Pfcmpdjp.exe
  2⤵
  PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3288 -ip 3288
1⤵
- Executes dropped EXE
PID:464

C:\Windows\SysWOW64\Pnlafaio.exe
C:\Windows\system32\Pnlafaio.exe
1⤵
- Executes dropped EXE
PID:1800

C:\Windows\SysWOW64\Mgagll32.exe
C:\Windows\system32\Mgagll32.exe
1⤵
PID:9180

C:\Windows\SysWOW64\Mpebjb32.exe
C:\Windows\system32\Mpebjb32.exe
1⤵
PID:8644

C:\Windows\SysWOW64\Jlnnfghd.exe
C:\Windows\system32\Jlnnfghd.exe
1⤵
PID:8328

C:\Windows\SysWOW64\Ieeihomg.exe
C:\Windows\system32\Ieeihomg.exe
1⤵
PID:9156

C:\Windows\SysWOW64\Gkmlilej.exe
C:\Windows\system32\Gkmlilej.exe
1⤵
PID:2168
- C:\Windows\SysWOW64\Eegpkcbd.exe
  C:\Windows\system32\Eegpkcbd.exe
  2⤵
  PID:2400

C:\Windows\SysWOW64\Gfpcpefb.exe
C:\Windows\system32\Gfpcpefb.exe
1⤵
PID:8428

C:\Windows\SysWOW64\Onklkhnn.exe
C:\Windows\system32\Onklkhnn.exe
1⤵
PID:8368

C:\Windows\SysWOW64\Ocegnoog.exe
C:\Windows\system32\Ocegnoog.exe
1⤵
PID:8332

C:\Windows\SysWOW64\Mnjjmmkc.exe
C:\Windows\system32\Mnjjmmkc.exe
1⤵
PID:3088

C:\Windows\SysWOW64\Idnfal32.exe
C:\Windows\system32\Idnfal32.exe
1⤵
PID:7560

C:\Windows\SysWOW64\Idjmfmgp.exe
C:\Windows\system32\Idjmfmgp.exe
1⤵
PID:7680

C:\Windows\SysWOW64\Qahkch32.exe
C:\Windows\system32\Qahkch32.exe
1⤵
PID:7124

C:\Windows\SysWOW64\Palkgi32.exe
C:\Windows\system32\Palkgi32.exe
1⤵
PID:10712

C:\Windows\SysWOW64\Onkbenbi.exe
C:\Windows\system32\Onkbenbi.exe
1⤵
PID:10584

C:\Windows\SysWOW64\Opdiobod.exe
C:\Windows\system32\Opdiobod.exe
1⤵
PID:10312

C:\Windows\SysWOW64\Nohicdia.exe
C:\Windows\system32\Nohicdia.exe
1⤵
PID:6580

C:\Windows\SysWOW64\Idonlbff.exe
C:\Windows\system32\Idonlbff.exe
1⤵
PID:10840

C:\Windows\SysWOW64\Nbiioe32.exe
C:\Windows\system32\Nbiioe32.exe
1⤵
PID:9888

C:\Windows\SysWOW64\Lkmkfncf.exe
C:\Windows\system32\Lkmkfncf.exe
1⤵
PID:9676

C:\Windows\SysWOW64\Eabjkdcc.exe
C:\Windows\system32\Eabjkdcc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acdioc32.exe

Filesize
186KB

MD5
47040ef4b4cd5d13badcd468b46d1709

SHA1
95a9e1e53e0e33b7fc0808a0bb547ab3faa3e299

SHA256
533c798ba4a6ea299d76b9e56c038e7bb51affa1b76eaf2a757b588d8eba0ae6

SHA512
41eb5efe4e69c46171cca7cdad065802d412ec3ab47fbe7b3d26a4d7a486ed85e191da126632965e9e530d007890c23cda4c3a5b9f0b3c49271eb1a04301573a

Download Submit
C:\Windows\SysWOW64\Afcmfe32.exe

Filesize
186KB

MD5
813c31e8efb0a1df7dcb0d0c64b2bebb

SHA1
e539b54c69f5bb2302ee0f4ed82133414ea58b59

SHA256
ce47b1c84325a955374208722cc53dd1cdd9a19efad8e276b309f801bdc0e067

SHA512
ac585dbc0b7f0f5e32769bef5ba0d00ebd5049f25ea701f7f4d9fc85183567737e9c5dbf20dc943a63a0376c5fd5ac037ce26da98814fce0fd56bbb94634ff50

Download Submit
C:\Windows\SysWOW64\Afcmfe32.exe

Filesize
186KB

MD5
813c31e8efb0a1df7dcb0d0c64b2bebb

SHA1
e539b54c69f5bb2302ee0f4ed82133414ea58b59

SHA256
ce47b1c84325a955374208722cc53dd1cdd9a19efad8e276b309f801bdc0e067

SHA512
ac585dbc0b7f0f5e32769bef5ba0d00ebd5049f25ea701f7f4d9fc85183567737e9c5dbf20dc943a63a0376c5fd5ac037ce26da98814fce0fd56bbb94634ff50

Download Submit
C:\Windows\SysWOW64\Ailabddb.exe

Filesize
186KB

MD5
7e9d1d9fdb87e81c59eca08d8490d356

SHA1
b6cc11c8d56bcf87551dce52f29a25f0721a3cc5

SHA256
24eb157ed5c1a37b39479146b2a760790614599046932c0c0ec6912b6cbb4d99

SHA512
7ddf276fd3691b8567bbc78d2b913ca29f652f47a539226a962cbbb4985162148f1a62f0abec3491bb58efa1d6f02ac84d00792bbb1ca5305994451213478b18

Download Submit
C:\Windows\SysWOW64\Bbcignbo.exe

Filesize
186KB

MD5
e895d1bce4e0f09475fc36ce211abf1d

SHA1
639f86eeb3d6e5fadf0a7173d16fe8778941d0ea

SHA256
7e67b87447f5f7aab6e0c1e6817619d17e769c8c6594ea79be7036acde599081

SHA512
7c7760c4794f4877a0c49b850a2c54798637e0532e895874d91a2a5befea2dfd29f76e88c9f42e018305fe60eae727e92d1ed285c504c4e888ea3a1438b1a4d2

Download Submit
C:\Windows\SysWOW64\Bboplo32.exe

Filesize
186KB

MD5
3822f954da0862642bc42f6abc4f10b4

SHA1
be00602f9f94ab7637282fee1d848c1de08fa095

SHA256
4d63fb1a64191204458622ebc7b688bd94fbd4da93ae60343c4f278b57870643

SHA512
66561864df1eeb3021d5b05aae842caf3ab3eb8b0c2b5e425e53b7cce087ee5b4523731e0fc5d56a89239b8383a57ac7953c74f9b41ac99fde213b0b54142248

Download Submit
C:\Windows\SysWOW64\Caqpkjcl.exe

Filesize
186KB

MD5
f3caf5237e73497f86768e8302bfd945

SHA1
c1d64c3fb51bb7a9179a3ce56d6ec55e6b0e9035

SHA256
8e1d2fc10875f7d9e36266b352fa9f473c6913a7395cb0f62257531ba6b34315

SHA512
c6c66588cb2f38ea0eed13bbd757f55032b87d925d6e338241161e2246f53d5701ae79bcbe1076fe8b73e30ba692a9675c65d06ea94d451ca95d02ef219100e5

Download Submit
C:\Windows\SysWOW64\Caqpkjcl.exe

Filesize
186KB

MD5
f3caf5237e73497f86768e8302bfd945

SHA1
c1d64c3fb51bb7a9179a3ce56d6ec55e6b0e9035

SHA256
8e1d2fc10875f7d9e36266b352fa9f473c6913a7395cb0f62257531ba6b34315

SHA512
c6c66588cb2f38ea0eed13bbd757f55032b87d925d6e338241161e2246f53d5701ae79bcbe1076fe8b73e30ba692a9675c65d06ea94d451ca95d02ef219100e5

Download Submit
C:\Windows\SysWOW64\Cgcmeh32.exe

Filesize
186KB

MD5
4a5cc5f90fbca97e04b0d0abb1c4e3dd

SHA1
678ad3b369038137deb80ce02208d344fe48e4bf

SHA256
550c11cf62d547f90597635d32dc113a2fd30e3b3b129e21d28ed3a71f855411

SHA512
58b0e5b64b6b7cbf9d900516cc61704b4b4e3e29b409348bb6e902acb21492a4807dbbf69753bbd0b59c7406252c496377b558d15d49415ac4709040121f5515

Download Submit
C:\Windows\SysWOW64\Cpklql32.exe

Filesize
186KB

MD5
ba2bfcee5c4a62b55a7428f3474c19fd

SHA1
10cf8c183c1d5e4fe17c7b440797cbce3a05d445

SHA256
9230618e7580c777f080eb7c7b771d5573b3e0a87b5aff1d3726936001846513

SHA512
083c25cf4b6194815d4da17f804428465434c5f8f9c8f71b7c10c0a6f011ca605eae4fede4b279c6f906a4ac98df1d96ae571634772ce90a8c0af348f710938d

Download Submit
C:\Windows\SysWOW64\Dcphdqmj.exe

Filesize
186KB

MD5
95b109f95dc80564a59557824d8a7b8a

SHA1
c0b77b5aaa193650540b14b370407f7107d59e6f

SHA256
e47ed14a7731431911a57449ef336ea1577a035e4b5444f66f6a2c3293f1f41f

SHA512
092a2922136fad6a5350fcd47a597af24e259f84d19344aa3cfd65f206507c0043027f54d508bf838624623ce86fbf6c7e2b5b21f417a01414329bb00b57f93d

Download Submit
C:\Windows\SysWOW64\Dcphdqmj.exe

Filesize
186KB

MD5
95b109f95dc80564a59557824d8a7b8a

SHA1
c0b77b5aaa193650540b14b370407f7107d59e6f

SHA256
e47ed14a7731431911a57449ef336ea1577a035e4b5444f66f6a2c3293f1f41f

SHA512
092a2922136fad6a5350fcd47a597af24e259f84d19344aa3cfd65f206507c0043027f54d508bf838624623ce86fbf6c7e2b5b21f417a01414329bb00b57f93d

Download Submit
C:\Windows\SysWOW64\Ddhhbngi.exe

Filesize
186KB

MD5
77059681ec1696c2c9ebb6b9842a84f7

SHA1
417ceb0c88066a51b08d11839b598549831137e3

SHA256
89b71524132524f69c7281b2b5d47bac87f9a7671c610e52e7cbe33c7ed15947

SHA512
e7a684788677170526bbcea84abdc3e6ad2c97ac01688ddfc8088bab1dee70b631350949428b3e8b1a4c75b47ece66be6721467015eb99f615181cdd0b988f6a

Download Submit
C:\Windows\SysWOW64\Dimcppgm.exe

Filesize
186KB

MD5
61a5ea55908b3e5448d128043ed29b7b

SHA1
14b1885f226635daaed20461b5e7cb009df1a0a6

SHA256
1e783e90f403a58b17cd6899de2312618affd6acdf2122edfe880645bc732b40

SHA512
20cc873c8997748ed580e3e130ec5af7db0ebbe65c9497d1317f65974881235515875ea5edac35e03e437b4ae519e5389c7e87412b26408965dc4c5c1322bc80

Download Submit
C:\Windows\SysWOW64\Dmifkecb.exe

Filesize
186KB

MD5
5d8e4fda89c01adb394a638aba59bebc

SHA1
e9b91f8cfc9b56941ea0355c409614f0398feea7

SHA256
41a0a1978442ed263495cb4707e101fd7f0561ec425e37f35c8fc20441deb254

SHA512
d13172bc7a16098ff4179f97e41ae3c418301a405c0a44c474815de5b1201690c7851ab7df1f37b32335b6340753dfbd75386ab53090bbe34f251485a31a9d65

Download Submit
C:\Windows\SysWOW64\Dpjfgf32.exe

Filesize
186KB

MD5
05aa71426b1e8661eec57394c5a0f3f8

SHA1
7cc7cffbc0fa4140e9e62214ffa2e37280697fcd

SHA256
ec1ada48e6c1edb7e721713d93691706988d4873c118b52b04ce051c39ee7fef

SHA512
71352723b57188f9ebffc7ce57b12846c7892ffb08edd9840cab36a690945bf14ce3f39145fada856c9d4a9ecd6bbaec4b6b860b3b5e7eeffdddcd67b6073fc0

Download Submit
C:\Windows\SysWOW64\Dpjfgf32.exe

Filesize
186KB

MD5
05aa71426b1e8661eec57394c5a0f3f8

SHA1
7cc7cffbc0fa4140e9e62214ffa2e37280697fcd

SHA256
ec1ada48e6c1edb7e721713d93691706988d4873c118b52b04ce051c39ee7fef

SHA512
71352723b57188f9ebffc7ce57b12846c7892ffb08edd9840cab36a690945bf14ce3f39145fada856c9d4a9ecd6bbaec4b6b860b3b5e7eeffdddcd67b6073fc0

Download Submit
C:\Windows\SysWOW64\Dpjfgf32.exe

Filesize
186KB

MD5
05aa71426b1e8661eec57394c5a0f3f8

SHA1
7cc7cffbc0fa4140e9e62214ffa2e37280697fcd

SHA256
ec1ada48e6c1edb7e721713d93691706988d4873c118b52b04ce051c39ee7fef

SHA512
71352723b57188f9ebffc7ce57b12846c7892ffb08edd9840cab36a690945bf14ce3f39145fada856c9d4a9ecd6bbaec4b6b860b3b5e7eeffdddcd67b6073fc0

Download Submit
C:\Windows\SysWOW64\Ecoaijio.exe

Filesize
186KB

MD5
9c17fb87951260cad29a9eeafb81e41f

SHA1
c8ce6ea24414b814eabe768f2b7dec787d0955ff

SHA256
4026ed67bb81503e06f2b0c8941458d553e96644dfe8713da88ad3010ecfb418

SHA512
481811ba0f2706821bd29c4e901e2608c8ebd44bf472da93bdb47ce1986a2e4fe9999e1c713e7c8796d19e0b86a95a81aa6e87f8d917ef866f1f50bcd55fe8c4

Download Submit
C:\Windows\SysWOW64\Eddnic32.exe

Filesize
186KB

MD5
8b102ac65c93ff0ebe53a083cbca89f5

SHA1
00876e2f21cf493627163720ae7b7742b0349318

SHA256
81836e163e64e19951fd8d759d88540f09b201da10fd307c182955653e4af163

SHA512
5f75e44483194059fdfd9ae55a4172850bc9739e7f5ac130ffadb8fda2d9bd71f15959265aff2a3f0d971cbf0b4811d830ea8fe7c6c9c84a2a28df13bb39df1a

Download Submit
C:\Windows\SysWOW64\Eddnic32.exe

Filesize
186KB

MD5
8b102ac65c93ff0ebe53a083cbca89f5

SHA1
00876e2f21cf493627163720ae7b7742b0349318

SHA256
81836e163e64e19951fd8d759d88540f09b201da10fd307c182955653e4af163

SHA512
5f75e44483194059fdfd9ae55a4172850bc9739e7f5ac130ffadb8fda2d9bd71f15959265aff2a3f0d971cbf0b4811d830ea8fe7c6c9c84a2a28df13bb39df1a

Download Submit
C:\Windows\SysWOW64\Ejojljqa.exe

Filesize
186KB

MD5
b4b09e8a0ba28557ce070392fd43659d

SHA1
631e252f2451ba8abc1e0d08391e1e112cbf2218

SHA256
04dddaf1b1f01fca970da61fd5d0035502af325babb95591cf49d5cb4e2d6682

SHA512
43a62f0903ba30634fd1f12813ccdec7af06e4ad61d68f45fe05304ec3718be025242929771de6f476cb383d272feb8606b0268eae88229650bedd716bd34555

Download Submit
C:\Windows\SysWOW64\Ejojljqa.exe

Filesize
186KB

MD5
b4b09e8a0ba28557ce070392fd43659d

SHA1
631e252f2451ba8abc1e0d08391e1e112cbf2218

SHA256
04dddaf1b1f01fca970da61fd5d0035502af325babb95591cf49d5cb4e2d6682

SHA512
43a62f0903ba30634fd1f12813ccdec7af06e4ad61d68f45fe05304ec3718be025242929771de6f476cb383d272feb8606b0268eae88229650bedd716bd34555

Download Submit
C:\Windows\SysWOW64\Eqkondfl.exe

Filesize
186KB

MD5
16419b848456566f50655be9c15c8a52

SHA1
3e75f6df15bdad8d6dd35e548da9527d0222253b

SHA256
2c3246340551f91beaa1ae17296b94d0b89a21112513db1b5aa6ab9953481f8b

SHA512
53334a23b6a1e0bffeadbea3cabc20a5a0de696bf3b8f0b450887b4fc64bc3b54ba3b8b1414c4e416dd0c7b1abbdc5699613e15d9ab17da17c04128f6f9e136e

Download Submit
C:\Windows\SysWOW64\Eqkondfl.exe

Filesize
186KB

MD5
16419b848456566f50655be9c15c8a52

SHA1
3e75f6df15bdad8d6dd35e548da9527d0222253b

SHA256
2c3246340551f91beaa1ae17296b94d0b89a21112513db1b5aa6ab9953481f8b

SHA512
53334a23b6a1e0bffeadbea3cabc20a5a0de696bf3b8f0b450887b4fc64bc3b54ba3b8b1414c4e416dd0c7b1abbdc5699613e15d9ab17da17c04128f6f9e136e

Download Submit
C:\Windows\SysWOW64\Fncibg32.exe

Filesize
186KB

MD5
16419b848456566f50655be9c15c8a52

SHA1
3e75f6df15bdad8d6dd35e548da9527d0222253b

SHA256
2c3246340551f91beaa1ae17296b94d0b89a21112513db1b5aa6ab9953481f8b

SHA512
53334a23b6a1e0bffeadbea3cabc20a5a0de696bf3b8f0b450887b4fc64bc3b54ba3b8b1414c4e416dd0c7b1abbdc5699613e15d9ab17da17c04128f6f9e136e

Download Submit
C:\Windows\SysWOW64\Fncibg32.exe

Filesize
186KB

MD5
1bc7a24e23473ceabd441e0ccc72488e

SHA1
320114155791650e097bc6309242dda24e371bbe

SHA256
f3b256ff86fd988919701c36365047f1da6ccbfdaa058edb70cc9c208bfe719d

SHA512
e5c95d4dcccfdd69484a5af01a86e9c6a5fbe6b1a0e0a78f16a4c54cb2b7689b91e2fd4482fb607eec1c2fe001ba2b1622d3585c60f5d1b32858166852eca71b

Download Submit
C:\Windows\SysWOW64\Fncibg32.exe

Filesize
186KB

MD5
1bc7a24e23473ceabd441e0ccc72488e

SHA1
320114155791650e097bc6309242dda24e371bbe

SHA256
f3b256ff86fd988919701c36365047f1da6ccbfdaa058edb70cc9c208bfe719d

SHA512
e5c95d4dcccfdd69484a5af01a86e9c6a5fbe6b1a0e0a78f16a4c54cb2b7689b91e2fd4482fb607eec1c2fe001ba2b1622d3585c60f5d1b32858166852eca71b

Download Submit
C:\Windows\SysWOW64\Fpcdof32.exe

Filesize
186KB

MD5
132aaa33500236b5bd1d7b352a103d64

SHA1
dc99c12fc9e9e31870749bc1dfad4bdcd6406f0e

SHA256
48aa88015a584c8c08280fa40638f2d3bbabeaef28f1229b4187f1c65433e261

SHA512
b162c2aa10c9b191da68f2a7079fee220842ee0a3b583b185d2ae7f4108d51c0ee2bf362499bf573b0a98156efaf684aeacb1df279fe0f3f9614c88b17b7f4f9

Download Submit
C:\Windows\SysWOW64\Ggccllai.exe

Filesize
186KB

MD5
8c411a5441192a5d810129cc583929ca

SHA1
abb20501904f7732fc88670f7447e127947ca171

SHA256
d95cab3c5d1ddf38977d4b4ae20765252c296cddd47ebab0a85d4ba806c7c544

SHA512
c0c985650d946e76155f210b3d652254f1350c15e3dccd31d8002806ce28fbcaf669b7bf897433315b85f61becf9ec68093d718b261303a01eca75056d15ef73

Download Submit
C:\Windows\SysWOW64\Ggccllai.exe

Filesize
186KB

MD5
8c411a5441192a5d810129cc583929ca

SHA1
abb20501904f7732fc88670f7447e127947ca171

SHA256
d95cab3c5d1ddf38977d4b4ae20765252c296cddd47ebab0a85d4ba806c7c544

SHA512
c0c985650d946e76155f210b3d652254f1350c15e3dccd31d8002806ce28fbcaf669b7bf897433315b85f61becf9ec68093d718b261303a01eca75056d15ef73

Download Submit
C:\Windows\SysWOW64\Gjcmngnj.exe

Filesize
186KB

MD5
4d98fba05bc9223530a676ee1a884996

SHA1
da4d2594030dc8f91c02d43c00d1066ea8ed103a

SHA256
4d112b69967753526daee3e66d1d525651112b3244e6b9941ae7d243cbd271ac

SHA512
795567652ab6f9859a4750f7cd63df1af30e2a60474eea4214b1a288a809cbb1edca44f625038658d32fe4d5d0d4a70d36969b5970eb8c6a36c97d548edf42dd

Download Submit
C:\Windows\SysWOW64\Gjcmngnj.exe

Filesize
186KB

MD5
4d98fba05bc9223530a676ee1a884996

SHA1
da4d2594030dc8f91c02d43c00d1066ea8ed103a

SHA256
4d112b69967753526daee3e66d1d525651112b3244e6b9941ae7d243cbd271ac

SHA512
795567652ab6f9859a4750f7cd63df1af30e2a60474eea4214b1a288a809cbb1edca44f625038658d32fe4d5d0d4a70d36969b5970eb8c6a36c97d548edf42dd

Download Submit
C:\Windows\SysWOW64\Gkcigjel.exe

Filesize
186KB

MD5
5b0154aa6aa70308f831cd9e1362f4ed

SHA1
8b85bb8fa86193ba94c9fa57caa65f686b2238aa

SHA256
c5c09fb1c9589c837cc1dffbdfe25f8725b52540deb81ce30b18b2a7711ac39f

SHA512
d23794740d5cc67469922939781feafaed65dafb5d607cba7b3b8ec39420d81a2ee961716633a56433d7e28391c46d4791d3f93883f696fd492a0aff7f47ace7

Download Submit
C:\Windows\SysWOW64\Gkcigjel.exe

Filesize
186KB

MD5
5b0154aa6aa70308f831cd9e1362f4ed

SHA1
8b85bb8fa86193ba94c9fa57caa65f686b2238aa

SHA256
c5c09fb1c9589c837cc1dffbdfe25f8725b52540deb81ce30b18b2a7711ac39f

SHA512
d23794740d5cc67469922939781feafaed65dafb5d607cba7b3b8ec39420d81a2ee961716633a56433d7e28391c46d4791d3f93883f696fd492a0aff7f47ace7

Download Submit
C:\Windows\SysWOW64\Hcjmhk32.exe

Filesize
186KB

MD5
6922218c2c801c38e0e772447a6551dd

SHA1
65b1161770078fa79134c2a484d378127c3f68fa

SHA256
cedb456a9d33fcb6025cfe5787af2c2ebc1db680e091e041ba337d40fde4151a

SHA512
366aeb3b7d9b6028329726628d16f9dc9c897f5d5d3e01d0a9dd2230858d0d017bf16dc89b93aaed5fe39c8a4b3e262d2124469c15b383da1f0c19607be52006

Download Submit
C:\Windows\SysWOW64\Hcjmhk32.exe

Filesize
186KB

MD5
6922218c2c801c38e0e772447a6551dd

SHA1
65b1161770078fa79134c2a484d378127c3f68fa

SHA256
cedb456a9d33fcb6025cfe5787af2c2ebc1db680e091e041ba337d40fde4151a

SHA512
366aeb3b7d9b6028329726628d16f9dc9c897f5d5d3e01d0a9dd2230858d0d017bf16dc89b93aaed5fe39c8a4b3e262d2124469c15b383da1f0c19607be52006

Download Submit
C:\Windows\SysWOW64\Hepgkohh.exe

Filesize
186KB

MD5
2681ae421c995fd9a68b9e8d2b2df746

SHA1
65e1cdd4eb4ee9ce9de0777cc9e231755cc15681

SHA256
1a6470c64f88d3e2f5450fe0f87fbe08a0ca46f97a7921741518c7a4dfd846b7

SHA512
283cb8f394497f3d1dbfd96736c46ca138339b45c3383e98733c868ab86322102304fecff8395f79741d6549aec0260530b9baa2af5c5a341dd05f2a229ac630

Download Submit
C:\Windows\SysWOW64\Hepgkohh.exe

Filesize
186KB

MD5
2681ae421c995fd9a68b9e8d2b2df746

SHA1
65e1cdd4eb4ee9ce9de0777cc9e231755cc15681

SHA256
1a6470c64f88d3e2f5450fe0f87fbe08a0ca46f97a7921741518c7a4dfd846b7

SHA512
283cb8f394497f3d1dbfd96736c46ca138339b45c3383e98733c868ab86322102304fecff8395f79741d6549aec0260530b9baa2af5c5a341dd05f2a229ac630

Download Submit
C:\Windows\SysWOW64\Hjdedepg.exe

Filesize
186KB

MD5
6922218c2c801c38e0e772447a6551dd

SHA1
65b1161770078fa79134c2a484d378127c3f68fa

SHA256
cedb456a9d33fcb6025cfe5787af2c2ebc1db680e091e041ba337d40fde4151a

SHA512
366aeb3b7d9b6028329726628d16f9dc9c897f5d5d3e01d0a9dd2230858d0d017bf16dc89b93aaed5fe39c8a4b3e262d2124469c15b383da1f0c19607be52006

Download Submit
C:\Windows\SysWOW64\Hjdedepg.exe

Filesize
186KB

MD5
b517e2efacd135bfb91f8da3eb9070f8

SHA1
2171ef4498886149fa077b506ae0d8c3e4858dd0

SHA256
45f8a6492b4848659e4cdcef5bb93a67890a860dd5181664ccc8f52776ccd2df

SHA512
62cbe0a6933d8c262a3c3fae4e27dd8db4a4e3f1a0877cbb4c5f260a366af7dc92eff9764d90c575bb64d352347a04a18c42da46d51295795b0b33c8062bd6c4

Download Submit
C:\Windows\SysWOW64\Hjdedepg.exe

Filesize
186KB

MD5
b517e2efacd135bfb91f8da3eb9070f8

SHA1
2171ef4498886149fa077b506ae0d8c3e4858dd0

SHA256
45f8a6492b4848659e4cdcef5bb93a67890a860dd5181664ccc8f52776ccd2df

SHA512
62cbe0a6933d8c262a3c3fae4e27dd8db4a4e3f1a0877cbb4c5f260a366af7dc92eff9764d90c575bb64d352347a04a18c42da46d51295795b0b33c8062bd6c4

Download Submit
C:\Windows\SysWOW64\Hjlhipbc.exe

Filesize
186KB

MD5
43a1cc7352aa33a4245936372256333a

SHA1
6be469eb3b416d172117ad33b8b0f617bc369726

SHA256
b83c5733da95210c997bb246a65083f68079535eff5de90e4c447b6b3ae14d83

SHA512
97de10375ad1dbd85c8c43042a5e377632f4cfe5003137498caf1d0cc9fb6cf40d80f2f26b91eba0a7fdd1c43c2ddaf2805c2691f29261c4d7fcc217b152b656

Download Submit
C:\Windows\SysWOW64\Igjbci32.exe

Filesize
186KB

MD5
f61cf9e2690486d410289f2c71ab4b96

SHA1
666896158fc919629be9c3c56b9287355db55eb4

SHA256
5f22c9c6585169482b2ff459269994bd753c3bc9a79b94d035f7d872a45c46c6

SHA512
08d4a01f00ad338606c5fe6818105ea1a88e0192cf352f68ee97f2f4516d1895c503d913c1a5dcd67a5ffd5c6c3303304f457c6da43db2c3708e55a033285b49

Download Submit
C:\Windows\SysWOW64\Igjbci32.exe

Filesize
186KB

MD5
f61cf9e2690486d410289f2c71ab4b96

SHA1
666896158fc919629be9c3c56b9287355db55eb4

SHA256
5f22c9c6585169482b2ff459269994bd753c3bc9a79b94d035f7d872a45c46c6

SHA512
08d4a01f00ad338606c5fe6818105ea1a88e0192cf352f68ee97f2f4516d1895c503d913c1a5dcd67a5ffd5c6c3303304f457c6da43db2c3708e55a033285b49

Download Submit
C:\Windows\SysWOW64\Indkpcdk.exe

Filesize
186KB

MD5
b78e66b398ad18f447ca975fc3e16aed

SHA1
915c8adda15b3c7e1e5d5c0da48c2046c030a36b

SHA256
af69397a1a802dea3cd453d9244d14c7da1ff5b69fa8ed7e5897c15c2932dabc

SHA512
ee9435552414ba468b78737fb65e12d6d803de4e185d096e0498a6c07206a6686ac224a2c8bc6bbac176b336bf441b3e1f4371618bf587224be7ae3d5b8cb6a0

Download Submit
C:\Windows\SysWOW64\Indkpcdk.exe

Filesize
186KB

MD5
b78e66b398ad18f447ca975fc3e16aed

SHA1
915c8adda15b3c7e1e5d5c0da48c2046c030a36b

SHA256
af69397a1a802dea3cd453d9244d14c7da1ff5b69fa8ed7e5897c15c2932dabc

SHA512
ee9435552414ba468b78737fb65e12d6d803de4e185d096e0498a6c07206a6686ac224a2c8bc6bbac176b336bf441b3e1f4371618bf587224be7ae3d5b8cb6a0

Download Submit
C:\Windows\SysWOW64\Ioicnn32.exe

Filesize
186KB

MD5
ae1be5fa7a618f43216219649fa5156e

SHA1
aa797d258c35b524c7a557ef7b9b03cf83bae675

SHA256
92b39c7bf3458c8c8a99708bff7cd4dfeb64c99190052691e36aa2cccdd8c0fe

SHA512
ba05e9674d3eeb19e0aeb32c13fabe180ed7598ac4d753547f17ec92241f580530c9882f55f6de53c509bb88862bd709b27aa86431ef9847ca08167639320ebf

Download Submit
C:\Windows\SysWOW64\Jdmcdhhe.exe

Filesize
186KB

MD5
9e9a486aee46f761321516130b033799

SHA1
699a67725680c8b0d067ce9a2b464073a6a1758e

SHA256
02ef1ad2939cc9724197781276836955940d4914e805347787f4222b4da1eba5

SHA512
a6e7a684d4338dc681d1ce7d4ca06217f0cae7abe5dc50d812faf7561cb846e5aebb84b36706410d10c4e9297f7188a58bc98019b0acbece3e2a43502d9eed64

Download Submit
C:\Windows\SysWOW64\Jdmcdhhe.exe

Filesize
186KB

MD5
9e9a486aee46f761321516130b033799

SHA1
699a67725680c8b0d067ce9a2b464073a6a1758e

SHA256
02ef1ad2939cc9724197781276836955940d4914e805347787f4222b4da1eba5

SHA512
a6e7a684d4338dc681d1ce7d4ca06217f0cae7abe5dc50d812faf7561cb846e5aebb84b36706410d10c4e9297f7188a58bc98019b0acbece3e2a43502d9eed64

Download Submit
C:\Windows\SysWOW64\Jeolckne.exe

Filesize
186KB

MD5
612bc93508c2553fe17d88215d83ae47

SHA1
16ab6c7ba8aea4e26f1f547aca32586ec9a32703

SHA256
0de4e1169f874fbbb41475f37ec4c15a7e1f589cdc0d1416cd6ac8f6e801d36d

SHA512
b43d405bbb4ee1812f87ded23d43636ec2a2fc335c33ca4a93675b99aaab3bc2002a456eb8189c54bb469db2ad934c49680d6a49a6f41fc0128f5e17b526b21f

Download Submit
C:\Windows\SysWOW64\Jeolckne.exe

Filesize
186KB

MD5
612bc93508c2553fe17d88215d83ae47

SHA1
16ab6c7ba8aea4e26f1f547aca32586ec9a32703

SHA256
0de4e1169f874fbbb41475f37ec4c15a7e1f589cdc0d1416cd6ac8f6e801d36d

SHA512
b43d405bbb4ee1812f87ded23d43636ec2a2fc335c33ca4a93675b99aaab3bc2002a456eb8189c54bb469db2ad934c49680d6a49a6f41fc0128f5e17b526b21f

Download Submit
C:\Windows\SysWOW64\Jhjcbljf.exe

Filesize
186KB

MD5
8adbc1d90cece026cf9cc541453f3d8d

SHA1
c4b3231f9ecab845ceef78bb5842f2e0f0e6d391

SHA256
e4c5280ff7e5773619ad5cf189dc27663ebbec4d934cd78e8c7649dc05836dd8

SHA512
f5a683bb0a1e72d6cccbb5d67737d088be559a89366797fad63cc8554d252a6ef7dc0a758c240ed56bc3bc87d84ee4f295525375cfc2c5caeb57f4f65b7e3562

Download Submit
C:\Windows\SysWOW64\Kajfdk32.exe

Filesize
186KB

MD5
9f6d5e5165acaee580068337a424a15c

SHA1
f2c46f030e6569770b1965ae7bd04fbd25bc62e0

SHA256
74b152f03cfa7e09e451c86a4bb9bfb83097b3391062979f7c5b0b9c8ca55787

SHA512
2d6ebdd49557102c0b7e036ac2ba5bb582acbb216339c487adf5f446bff3d6b936876e0cd35ad0c20a53ad0897e14f059152c3b876e016b8a31383d78eccdfaa

Download Submit
C:\Windows\SysWOW64\Kajfdk32.exe

Filesize
186KB

MD5
9f6d5e5165acaee580068337a424a15c

SHA1
f2c46f030e6569770b1965ae7bd04fbd25bc62e0

SHA256
74b152f03cfa7e09e451c86a4bb9bfb83097b3391062979f7c5b0b9c8ca55787

SHA512
2d6ebdd49557102c0b7e036ac2ba5bb582acbb216339c487adf5f446bff3d6b936876e0cd35ad0c20a53ad0897e14f059152c3b876e016b8a31383d78eccdfaa

Download Submit
C:\Windows\SysWOW64\Kbgafqla.exe

Filesize
186KB

MD5
ccd69482d851da778e402425787905cd

SHA1
e51a1dd4c18e7f1b497c384870ef069c3af2bf91

SHA256
6c77e6d45f7a420c78a368eaaa3479e342360fa93acc765c35025c095fc95e58

SHA512
33f777bd3a04087690a768975a408ecf84c383e6bda82d16cd9a79a2f4003d0bd2a571b1478243b1b245e7240293e829dca146474d0bf0cae6ae59e8dd49d095

Download Submit
C:\Windows\SysWOW64\Khabke32.exe

Filesize
186KB

MD5
ecd52031381439e278e43eaea4c5c4e9

SHA1
14cba2b668c402174fddc32877a493b1ccd116db

SHA256
ad4539624a4515dbb494756c14b363d0e2f8dd4c5f5d13d2d8e4ef61523cd8e1

SHA512
c8bd403ba0782f503050476d778440435c748056cdf8f3c7b8750b3905738de777df4a681ee219263a6f0f6fa30948b1a916e765ef5a3a5271e013ac968cbee5

Download Submit
C:\Windows\SysWOW64\Khabke32.exe

Filesize
186KB

MD5
ecd52031381439e278e43eaea4c5c4e9

SHA1
14cba2b668c402174fddc32877a493b1ccd116db

SHA256
ad4539624a4515dbb494756c14b363d0e2f8dd4c5f5d13d2d8e4ef61523cd8e1

SHA512
c8bd403ba0782f503050476d778440435c748056cdf8f3c7b8750b3905738de777df4a681ee219263a6f0f6fa30948b1a916e765ef5a3a5271e013ac968cbee5

Download Submit
C:\Windows\SysWOW64\Kopcbo32.exe

Filesize
186KB

MD5
59ecb9f7f0479c718fd89e94be75760e

SHA1
d7940e37e8ad671ca6987c7563a1669c774957da

SHA256
22c935d993f93509764f9948a6a18b6a9152239bfd2a12c5144c2ed56da62b81

SHA512
939516eacd91014d3eb760c184f1718e7dd257421fedc6cbdcb8997d7bdc3cd360ae82f5b52b70c8cccfb7f1280a2a48f251877f1a3bc11294dc95db6f5858b9

Download Submit
C:\Windows\SysWOW64\Kopcbo32.exe

Filesize
186KB

MD5
59ecb9f7f0479c718fd89e94be75760e

SHA1
d7940e37e8ad671ca6987c7563a1669c774957da

SHA256
22c935d993f93509764f9948a6a18b6a9152239bfd2a12c5144c2ed56da62b81

SHA512
939516eacd91014d3eb760c184f1718e7dd257421fedc6cbdcb8997d7bdc3cd360ae82f5b52b70c8cccfb7f1280a2a48f251877f1a3bc11294dc95db6f5858b9

Download Submit
C:\Windows\SysWOW64\Lbcedmnl.exe

Filesize
186KB

MD5
9b228335cb852b5d1b4f575df7dc4928

SHA1
e3401333df6ad18c7a18ca48f04757c56133b1ff

SHA256
c879a2fee84e78069b683a7741cd58c84b3fb2e30d0e383229700110ca612f0d

SHA512
88b778a19f63194409407290e5d886d1245a26747f42770dd9344dfb2f6029673063def5a4632c9e94097bb45b4f181e54c7f9717fecaddc9126e1f3f6e79147

Download Submit
C:\Windows\SysWOW64\Lbcedmnl.exe

Filesize
186KB

MD5
9b228335cb852b5d1b4f575df7dc4928

SHA1
e3401333df6ad18c7a18ca48f04757c56133b1ff

SHA256
c879a2fee84e78069b683a7741cd58c84b3fb2e30d0e383229700110ca612f0d

SHA512
88b778a19f63194409407290e5d886d1245a26747f42770dd9344dfb2f6029673063def5a4632c9e94097bb45b4f181e54c7f9717fecaddc9126e1f3f6e79147

Download Submit
C:\Windows\SysWOW64\Lddble32.exe

Filesize
186KB

MD5
de91cfc99aa6aa49c60fd8d8e69513f8

SHA1
5701c8d61d9ecaaed56683d1992d9e122684a665

SHA256
c0754e3643a4847e9f1d9f16c55ab3410adefdb43b7dcb75a8f5db2a94efa274

SHA512
62a3e4aab47205dd0b391c9798523994713b3570647b05ebcd803b7c10731e2d89ee1afbc683d21d2cb437b7bbded12445c9e19f7121d08e195428fec1226092

Download Submit
C:\Windows\SysWOW64\Lddble32.exe

Filesize
186KB

MD5
de91cfc99aa6aa49c60fd8d8e69513f8

SHA1
5701c8d61d9ecaaed56683d1992d9e122684a665

SHA256
c0754e3643a4847e9f1d9f16c55ab3410adefdb43b7dcb75a8f5db2a94efa274

SHA512
62a3e4aab47205dd0b391c9798523994713b3570647b05ebcd803b7c10731e2d89ee1afbc683d21d2cb437b7bbded12445c9e19f7121d08e195428fec1226092

Download Submit
C:\Windows\SysWOW64\Lehhqg32.exe

Filesize
186KB

MD5
4a374cb2171c76985c629a8b4f9f227c

SHA1
82058db8ddf0efa0c66b01a6bd5842a58f7b3f7d

SHA256
ce3450209ae76f6ed099c20f221e38586852ed1ea0b7fd4f84011b79fa773971

SHA512
a177e77bc4dcf47b23c70cae98db4d3d546510fdad0c9e1177acdcaf8f25f848f9a265ab836b1adc02c45ed1b9d0d5f2c117760e2229e0d5bce5b736aae2f027

Download Submit
C:\Windows\SysWOW64\Lehhqg32.exe

Filesize
186KB

MD5
4a374cb2171c76985c629a8b4f9f227c

SHA1
82058db8ddf0efa0c66b01a6bd5842a58f7b3f7d

SHA256
ce3450209ae76f6ed099c20f221e38586852ed1ea0b7fd4f84011b79fa773971

SHA512
a177e77bc4dcf47b23c70cae98db4d3d546510fdad0c9e1177acdcaf8f25f848f9a265ab836b1adc02c45ed1b9d0d5f2c117760e2229e0d5bce5b736aae2f027

Download Submit
C:\Windows\SysWOW64\Lennpb32.exe

Filesize
186KB

MD5
47a1aa12b3bba2c362e017dbdd37219b

SHA1
5bb833682050cb3663ce49efdb26fbd9a8036aab

SHA256
2f66eeee5860d54fa606617428f9950fba87a34cddee54e5f2e1eb2dee39bf94

SHA512
5b5c3eb3353fed8610063d7ac2964a464364636d7b642905e1a91035e9c8c210bb8e0ad908c36de7de550d5239574f707a5eaca19f07b182c0081105190fddfb

Download Submit
C:\Windows\SysWOW64\Lojfin32.exe

Filesize
186KB

MD5
20505bf0626dbfac32fe13ff8b720e59

SHA1
75e69810386607c9f5030305fcb2280606a3a43e

SHA256
0f881c73332ffd3aa60c99b15b697954f151af94014ac02b4a515ba2dffbce21

SHA512
b29ec3c863af586fd033de1de0034bf9c83b3bd04e0c700e98ae525965a0c90b4102ea167763e0e04080b5a6e56931dcc79b7369a4ecbb459b03f9aa60a62e65

Download Submit
C:\Windows\SysWOW64\Lojfin32.exe

Filesize
186KB

MD5
20505bf0626dbfac32fe13ff8b720e59

SHA1
75e69810386607c9f5030305fcb2280606a3a43e

SHA256
0f881c73332ffd3aa60c99b15b697954f151af94014ac02b4a515ba2dffbce21

SHA512
b29ec3c863af586fd033de1de0034bf9c83b3bd04e0c700e98ae525965a0c90b4102ea167763e0e04080b5a6e56931dcc79b7369a4ecbb459b03f9aa60a62e65

Download Submit
C:\Windows\SysWOW64\Loopdmpk.exe

Filesize
186KB

MD5
841854da18667b7e8ff9acefa7a4e26e

SHA1
57b33ac87baba6c3206a59a3982454d9bfc5cae6

SHA256
f7462f46ccbca546f109422d0083b4f0a75144cfeaf3a1b01a66824e8db78818

SHA512
3a1dd5632854862779d36ae7a0b875653a46b8f32ae8c293da57c58445532809d94e609c608cbb0f374ba0b4d1a25858cb0caf041f6d12a559f8ab07fbb1d31d

Download Submit
C:\Windows\SysWOW64\Loopdmpk.exe

Filesize
186KB

MD5
841854da18667b7e8ff9acefa7a4e26e

SHA1
57b33ac87baba6c3206a59a3982454d9bfc5cae6

SHA256
f7462f46ccbca546f109422d0083b4f0a75144cfeaf3a1b01a66824e8db78818

SHA512
3a1dd5632854862779d36ae7a0b875653a46b8f32ae8c293da57c58445532809d94e609c608cbb0f374ba0b4d1a25858cb0caf041f6d12a559f8ab07fbb1d31d

Download Submit
C:\Windows\SysWOW64\Mackfa32.exe

Filesize
186KB

MD5
11eb2fd3d539ae5914fe2deac9753a1c

SHA1
1b6e0fc4b875390c77d4c560459cfccb2f246224

SHA256
915989122fb22489e45020a57918db08d7a068877f49f0e0cd7b2a435b55e1c1

SHA512
69e7ba5d11939580365100df3f4e7473700999557f63f363628e915bd6d457d940418bea37a911e9edba596456d06f38b9df20849b919a21e9da9818de4ebf40

Download Submit
C:\Windows\SysWOW64\Madbagif.exe

Filesize
186KB

MD5
456f26d7512e0d61505715461384b913

SHA1
81d985ef67fb91c41e18800bd8e4bf8bac9cf7c6

SHA256
8dc911ac13cec7b4ea5694ad7044cc4f1c3bfae5e23b48609ba6ce6c9739bc24

SHA512
b33a71b81e4d00d02f67565b1438d2696d874004a1362ab5774ab2aefd150f0388168c04c2444ff128eb607a2f92b4fb587f090ba2b3d23f24e4c0cf987c5482

Download Submit
C:\Windows\SysWOW64\Madbagif.exe

Filesize
186KB

MD5
456f26d7512e0d61505715461384b913

SHA1
81d985ef67fb91c41e18800bd8e4bf8bac9cf7c6

SHA256
8dc911ac13cec7b4ea5694ad7044cc4f1c3bfae5e23b48609ba6ce6c9739bc24

SHA512
b33a71b81e4d00d02f67565b1438d2696d874004a1362ab5774ab2aefd150f0388168c04c2444ff128eb607a2f92b4fb587f090ba2b3d23f24e4c0cf987c5482

Download Submit
C:\Windows\SysWOW64\Mdghhb32.exe

Filesize
186KB

MD5
ca5cdf6352f73a7bd39519ecc84fcd63

SHA1
0bc2a6016ad5b09a97118dca02e990bd3d92f294

SHA256
fb76ea6e62c708be8a92d17b4a67de8687ee5e9e80e7b51ae55397424bee4f7b

SHA512
7b573d4d3135708fd52bd98900152eeec1dc02df1580c0be539b0876062cd7a9283e4662aeeec9d5233f413328656bc1684f77d9bfeb88f0cac10eedf4e41d9a

Download Submit
C:\Windows\SysWOW64\Mdghhb32.exe

Filesize
186KB

MD5
ca5cdf6352f73a7bd39519ecc84fcd63

SHA1
0bc2a6016ad5b09a97118dca02e990bd3d92f294

SHA256
fb76ea6e62c708be8a92d17b4a67de8687ee5e9e80e7b51ae55397424bee4f7b

SHA512
7b573d4d3135708fd52bd98900152eeec1dc02df1580c0be539b0876062cd7a9283e4662aeeec9d5233f413328656bc1684f77d9bfeb88f0cac10eedf4e41d9a

Download Submit
C:\Windows\SysWOW64\Mekdffee.exe

Filesize
186KB

MD5
5c77a21d9cf107b4ccfe9ff2856e6828

SHA1
1e55de9a6978a9b1db85fde469ae53ad5a683160

SHA256
0ede5853af91d7c5c473688ec347ba41b1af51ca1bf51e629d852519ebef77c0

SHA512
3d25699f1dfd33a0ad02fcba5f7dcdfe5ac79d30f27c29708e6c74b77bae14fec87281ea59bce8269beafd7abe8c4d0d9ce12e2d4841d7814262a93fb39d0ecc

Download Submit
C:\Windows\SysWOW64\Mekdffee.exe

Filesize
186KB

MD5
5c77a21d9cf107b4ccfe9ff2856e6828

SHA1
1e55de9a6978a9b1db85fde469ae53ad5a683160

SHA256
0ede5853af91d7c5c473688ec347ba41b1af51ca1bf51e629d852519ebef77c0

SHA512
3d25699f1dfd33a0ad02fcba5f7dcdfe5ac79d30f27c29708e6c74b77bae14fec87281ea59bce8269beafd7abe8c4d0d9ce12e2d4841d7814262a93fb39d0ecc

Download Submit
C:\Windows\SysWOW64\Mginniij.exe

Filesize
186KB

MD5
e1e6d22914e2b2924b656e929b487878

SHA1
e28743989cb16c3d2696d9726ff7b84a446b0314

SHA256
b6f261cbdaed0dd6b34045ba5090a2234024b56499eb157aae0e1df35c53aa49

SHA512
9acffa36d4e0e228d00cd5b484d7a17907a339ad6ddc6030613f68f22ab81a673aa45d55b152b64f3c764a503ec44b7a85fe7648db8a9b2ba62fa7a9ad96fc97

Download Submit
C:\Windows\SysWOW64\Mhnjna32.exe

Filesize
186KB

MD5
e8d063a31d0d2f974541891943336f49

SHA1
df1011f0f9cc115b440ac3d279d5fb1037fa1a84

SHA256
db008ce0821b312087d68e02235055f603df6701c0ef79cc240e8927ea06a256

SHA512
0ba9cbf864b77ad770c4f20dbe590ff139b72eb1466d1ccff01dbc19caa6b23ce47e5b6ca21a8494e36b02c831f65f9a86dc57a84b7cf1404e2aa7d12285abba

Download Submit
C:\Windows\SysWOW64\Mhnjna32.exe

Filesize
186KB

MD5
e8d063a31d0d2f974541891943336f49

SHA1
df1011f0f9cc115b440ac3d279d5fb1037fa1a84

SHA256
db008ce0821b312087d68e02235055f603df6701c0ef79cc240e8927ea06a256

SHA512
0ba9cbf864b77ad770c4f20dbe590ff139b72eb1466d1ccff01dbc19caa6b23ce47e5b6ca21a8494e36b02c831f65f9a86dc57a84b7cf1404e2aa7d12285abba

Download Submit
C:\Windows\SysWOW64\Mhnjna32.exe

Filesize
186KB

MD5
e8d063a31d0d2f974541891943336f49

SHA1
df1011f0f9cc115b440ac3d279d5fb1037fa1a84

SHA256
db008ce0821b312087d68e02235055f603df6701c0ef79cc240e8927ea06a256

SHA512
0ba9cbf864b77ad770c4f20dbe590ff139b72eb1466d1ccff01dbc19caa6b23ce47e5b6ca21a8494e36b02c831f65f9a86dc57a84b7cf1404e2aa7d12285abba

Download Submit
C:\Windows\SysWOW64\Ndinck32.exe

Filesize
186KB

MD5
3e7bea1d3a26c3be5067b14f0c879fd9

SHA1
38de707b0721afe289d3080f7154c56ffe2de02b

SHA256
afba77a238cfae8491f015f1c0ce91d325399bbf327226875335fa64887db662

SHA512
5e52ea3436b42d4e04ca2d4e2413debe738dd5bde4aba652ccb026f8d1248d5bda70346e03dd526f36e8a1f11d00c65939285253384c88d802db552c187ba4a2

Download Submit
C:\Windows\SysWOW64\Nefdbekh.exe

Filesize
186KB

MD5
2b87a4dcf2178e10e106015f08e1d746

SHA1
df63d11c0d616985812d20d600de1763e366ad36

SHA256
f662fece1e941ba9b38f17e4f8c8c286d70d38c03bd873c366abfe125699fe62

SHA512
77b6e3f07383b96366dd909f1afdee3685cc95d7d3258cd7be3de73e0462e1ad5a6f819782be38d6966769bfa58417dd1ab9f655edda1f5e2d2ad8e009ea3a22

Download Submit
C:\Windows\SysWOW64\Nefdbekh.exe

Filesize
186KB

MD5
2b87a4dcf2178e10e106015f08e1d746

SHA1
df63d11c0d616985812d20d600de1763e366ad36

SHA256
f662fece1e941ba9b38f17e4f8c8c286d70d38c03bd873c366abfe125699fe62

SHA512
77b6e3f07383b96366dd909f1afdee3685cc95d7d3258cd7be3de73e0462e1ad5a6f819782be38d6966769bfa58417dd1ab9f655edda1f5e2d2ad8e009ea3a22

Download Submit
C:\Windows\SysWOW64\Nkcmjlio.exe

Filesize
186KB

MD5
685fa5595864aba1fe3567000fd7175a

SHA1
1c61491e27ef0a63e28f7e974b2e2e9d06aaae42

SHA256
98878ca76a173fc4a5da5680fc01ed67c16eb230836acba0b14f3491de8fc71a

SHA512
14d51dd95cbf00ea359a6869ba88a34f07e0e71bf071da3de730a2859dbe45b43560ecd5a152916f5299e2287b20bf85748755b2561992bdbf601b44ed87248e

Download Submit
C:\Windows\SysWOW64\Nkcmjlio.exe

Filesize
186KB

MD5
685fa5595864aba1fe3567000fd7175a

SHA1
1c61491e27ef0a63e28f7e974b2e2e9d06aaae42

SHA256
98878ca76a173fc4a5da5680fc01ed67c16eb230836acba0b14f3491de8fc71a

SHA512
14d51dd95cbf00ea359a6869ba88a34f07e0e71bf071da3de730a2859dbe45b43560ecd5a152916f5299e2287b20bf85748755b2561992bdbf601b44ed87248e

Download Submit
C:\Windows\SysWOW64\Ohbfeh32.exe

Filesize
186KB

MD5
808d3c8bb8cbadc8eb9046a8ef81f4a0

SHA1
09cce6051fe0336eb26a90af4d0fcbe55ee176ee

SHA256
d45c08c161e0f1e4f9fef79836832f1789c4d777282e5af78dfa121a486c7810

SHA512
ed0e6451a8f1a78207fde76396a8767b8bd32ab7ee2d39bef3fd3e04df1017cd540b3347b33a660102800533f70d3f73c9e7ffd34933d1f110edf9b7f3112bf1

Download Submit
C:\Windows\SysWOW64\Okneldkf.exe

Filesize
186KB

MD5
dc45ee3b3e7d05a438e6c7f67ffa30dc

SHA1
f8c4255456625fbbf61d3d91d56c5c2e35c661aa

SHA256
8f7bc03a2d400135c30d95e9d89b18c02723c27eac737868e26be20dc2d1e286

SHA512
23d59e414f11293623f4c2c4da19c89a4d4afc0458ceb2783e82c372c4cf32a42e09a86e61c90978551770953e999cd53d3d493dc705f7b5dfa2e8f265015058

Download Submit
C:\Windows\SysWOW64\Pbddobla.exe

Filesize
186KB

MD5
efcd09495c50773102d12229015419e0

SHA1
d9cd0faca9cb37936d19e1694d3a854da8d97d44

SHA256
a531427c2732f39e9b65ded33eb4d4ef1b5ee46337adf759fd38254f75a43613

SHA512
04dc391cadfd54454b7e286722476d82a76c2ac7ef8670adb4e040abaf708b98d5b9cc58be382082670d7d0b324476c2b074fc759ec97bcb5fd177e0a7e9a1a6

Download Submit
C:\Windows\SysWOW64\Pcijce32.exe

Filesize
186KB

MD5
cc26671e3daa0d55a5a43a18146f0dd1

SHA1
eb417a785b984f8d0a2d7b98cef89a4f90b2a231

SHA256
fd79089e1b15ed5b97c48ee44ed9d86ff879738f813e8c14e5ceb5472f22c3ed

SHA512
d8655344b04ccfaccff03a7b0c76fef713ec4a0f7a7085b946bf5e892bc29d5c34cddc865e74022445026125f10e47640c508130e605b2af58302418838ecd5e

Download Submit
C:\Windows\SysWOW64\Pkonbamc.exe

Filesize
186KB

MD5
cbf51ef28e248383083b503d6d5c388d

SHA1
0e0f37a00bdafdd73d9332277843c1e4043d121b

SHA256
39ca910f07962deba6150f5b8823e535a4a2c421d7389bed129eafd77179448d

SHA512
75ce853034bdaac06513bd9b25d544cb7cdfc4aca268310c9fc4777667c96bed9abeb9d5d547faecf78005d58b6ce3b152128438c62c399a585fcd9bdc92849b

Download Submit
memory/228-502-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/228-123-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/448-99-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/448-493-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/464-259-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/760-450-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/760-42-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/880-155-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/880-531-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/972-296-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/980-340-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1264-244-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1264-602-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1352-308-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1360-424-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1400-393-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1452-326-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1668-332-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1920-220-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1920-581-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2016-236-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2016-595-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2096-522-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2096-132-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2140-302-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2160-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2160-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2160-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2160-82-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2176-356-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-405-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2268-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2268-464-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2288-387-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2296-410-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2308-314-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2356-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2356-459-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2384-266-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2796-350-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2808-58-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2808-456-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2960-344-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3132-50-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3132-455-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3136-290-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3140-203-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3140-560-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3172-34-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3172-449-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3188-436-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3188-26-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3336-430-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3424-567-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3424-212-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3512-107-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3512-494-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3524-552-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3524-180-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3664-172-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3664-545-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3708-399-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3776-84-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3776-465-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3808-374-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3984-375-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4136-148-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4136-524-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4212-559-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4212-195-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4316-501-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4316-115-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4328-441-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4344-536-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4344-163-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4440-320-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4512-278-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4520-272-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4564-91-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4564-474-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4596-227-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4596-582-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4620-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4624-362-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4640-284-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4900-140-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4900-523-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4964-609-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4964-251-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4992-187-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4992-553-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4996-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5024-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5060-368-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5060-10-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads