68562c8d136a2f4f0d690a3099eb8459409dba3eba857bc2d6a8cc6ecd3820e4

Analysis

max time kernel
50s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fb7da825ba085164f2f2f2a00a192b5.exe
Size

80KB
MD5

0fb7da825ba085164f2f2f2a00a192b5
SHA1

c60d905c1d16550d286ffabf0bce35e15a193f89
SHA256

68562c8d136a2f4f0d690a3099eb8459409dba3eba857bc2d6a8cc6ecd3820e4
SHA512

86d53c5cafdbc0cbf8da18a06a51c142f92ba14d12d1d0058cabfb184531fa771e88cbc3744dbdf0c7c656ab12f53da6eb815419dfa1e55f5f1bbe2914e43f0a
SSDEEP

1536:slryrSkYMUNKS/omSxRQv3PJHoo2LeS5DUHRbPa9b6i+sIk:sobYMYKW6RQfxHAeS5DSCopsIk

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fohfbpgi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkofga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpnnle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibgdlg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fiodpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjiipk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imgicgca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfjola32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocohmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dqpfmlce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nglhld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckbemgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ganldgib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klljnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emhkdmlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfeeabda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nncccnol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koodbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oeoblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imkbnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlolpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibqnkh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbcke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ioolkncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hioflcbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgjgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oobfob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gacepg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnplfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnfmbmbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hemmac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Keifdpif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppnenlka.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jklinohd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Epmmqheb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfhnaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhmbqm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmmlla32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gemkelcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glipgf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jokkgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfiddm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaldccip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lifjnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgehfkop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eecphp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlgepanl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnpdegjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbpchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nndjndbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhahaiec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kofkbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdnhih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eecphp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdnbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnkldqkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obnehj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pllgnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkokcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Piphgq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnjqmpgg.exe

Executes dropped EXE 64 IoCs

pid	Process
4852	Kmdqgd32.exe
868	Klljnp32.exe
4712	Kdcbom32.exe
4272	Kfankifm.exe
4396	Kipkhdeq.exe
4820	Kdeoemeg.exe
1272	Miemjaci.exe
4320	Ngbpidjh.exe
2748	Igcoqocb.exe
728	Kfqgab32.exe
1892	Lhfmdj32.exe
2896	Lnqeqd32.exe
4916	Lfhnaa32.exe
2100	Lifjnm32.exe
1952	Onkidm32.exe
4636	Mpnnle32.exe
408	Pfoann32.exe
1944	Mekgdl32.exe
4404	Mpqkad32.exe
2860	Nbadcpbh.exe
4792	Niklpj32.exe
3592	Npedmdab.exe
4504	Ngomin32.exe
2060	Nlleaeff.exe
4092	Ngaionfl.exe
3972	Npjnhc32.exe
1568	Nookip32.exe
1428	Aobilkcl.exe
2944	Aflaie32.exe
1184	Aodfajaj.exe
3636	Afnnnd32.exe
1920	Bqfoamfj.exe
740	Bfchidda.exe
3092	Biadeoce.exe
440	Ibgdlg32.exe
220	Fibojhim.exe
1052	Hdkidohn.exe
2928	Ihdldn32.exe
4312	Jikoopij.exe
2176	Hpbiip32.exe
5044	Hkgnfhnh.exe
3220	Jhgiim32.exe
4456	Hgnoki32.exe
3812	Hjlkge32.exe
1592	Keifdpif.exe
1076	Ocihgnam.exe
3576	Jhndljll.exe
2976	Jklphekp.exe
3940	Jnkldqkc.exe
3728	Jnmijq32.exe
1520	Ppnenlka.exe
2648	Loacdc32.exe
4344	Kqnbkl32.exe
1436	Kiejmi32.exe
4900	Kkcfid32.exe
3600	Knbbep32.exe
1812	Mpclce32.exe
3128	Kgjgne32.exe
1596	Kjhcjq32.exe
4392	Kbpkkn32.exe
4932	Mnlnbl32.exe
368	Mbgjbkfg.exe
4308	Mhdckaeo.exe
3492	Mjbogmdb.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jiglnf32.exe	Jghpbk32.exe
File opened for modification	C:\Windows\SysWOW64\Pmlfqh32.exe	Pjmjdm32.exe
File created	C:\Windows\SysWOW64\Akpoaj32.exe	Adfgdpmi.exe
File created	C:\Windows\SysWOW64\Aggpfkjj.exe	Ahdpjn32.exe
File created	C:\Windows\SysWOW64\Kofkbk32.exe	Kfnfjehl.exe
File created	C:\Windows\SysWOW64\Qmfqknfm.dll	Lnangaoa.exe
File created	C:\Windows\SysWOW64\Pkoaeldi.dll	Bhpofl32.exe
File created	C:\Windows\SysWOW64\Cnnnfkal.dll	Ggfglb32.exe
File created	C:\Windows\SysWOW64\Kmfpdfnd.dll	Fdnhih32.exe
File opened for modification	C:\Windows\SysWOW64\Kjjiej32.exe	Kcpahpmd.exe
File created	C:\Windows\SysWOW64\Filclgic.dll	Geaepk32.exe
File created	C:\Windows\SysWOW64\Bdimkqnb.dll	Jleijb32.exe
File created	C:\Windows\SysWOW64\Idaiki32.dll	Pdjgha32.exe
File opened for modification	C:\Windows\SysWOW64\Egohdegl.exe	Ehlhih32.exe
File opened for modification	C:\Windows\SysWOW64\Hemmac32.exe	Hbnaeh32.exe
File created	C:\Windows\SysWOW64\Bqbijpeo.dll	Omqmop32.exe
File created	C:\Windows\SysWOW64\Nbjnhape.dll	Hifmmb32.exe
File created	C:\Windows\SysWOW64\Nbnpcj32.exe	Mldhfpib.exe
File created	C:\Windows\SysWOW64\Ahoemi32.dll	Fflohaij.exe
File opened for modification	C:\Windows\SysWOW64\Jniood32.exe	Jebfng32.exe
File opened for modification	C:\Windows\SysWOW64\Opnbae32.exe	Ompfej32.exe
File opened for modification	C:\Windows\SysWOW64\Bgpcliao.exe	Bhmbqm32.exe
File opened for modification	C:\Windows\SysWOW64\Dqpfmlce.exe	Doojec32.exe
File created	C:\Windows\SysWOW64\Nojjcj32.exe	Opbean32.exe
File created	C:\Windows\SysWOW64\Bdkohe32.dll	Mkhapk32.exe
File opened for modification	C:\Windows\SysWOW64\Ioolkncg.exe	Iplkpa32.exe
File created	C:\Windows\SysWOW64\Lfjfecno.exe	Lomqcjie.exe
File created	C:\Windows\SysWOW64\Ehlhih32.exe	Eqdpgk32.exe
File created	C:\Windows\SysWOW64\Dddjmo32.dll	Panhbfep.exe
File created	C:\Windows\SysWOW64\Ggfglb32.exe	Gicgpelg.exe
File opened for modification	C:\Windows\SysWOW64\Ihkjno32.exe	Hemmac32.exe
File created	C:\Windows\SysWOW64\Mjmoag32.exe	Mccfdmmo.exe
File opened for modification	C:\Windows\SysWOW64\Fmfgek32.exe	Fflohaij.exe
File created	C:\Windows\SysWOW64\Gcbpne32.dll	Mhdckaeo.exe
File created	C:\Windows\SysWOW64\Nfjola32.exe	Nclbpf32.exe
File opened for modification	C:\Windows\SysWOW64\Plndcl32.exe	Piphgq32.exe
File created	C:\Windows\SysWOW64\Nfmifiap.dll	Fngcmcfe.exe
File created	C:\Windows\SysWOW64\Ggpdhj32.dll	Gbchdp32.exe
File opened for modification	C:\Windows\SysWOW64\Kgnbdh32.exe	Kofkbk32.exe
File created	C:\Windows\SysWOW64\Dglkoeio.exe	Ddnobj32.exe
File created	C:\Windows\SysWOW64\Hmhkgijk.dll	Mkadfj32.exe
File created	C:\Windows\SysWOW64\Mgmodn32.dll	Bmeandma.exe
File created	C:\Windows\SysWOW64\Jngbjd32.exe	Jepjhg32.exe
File created	C:\Windows\SysWOW64\Chfegk32.exe	Cponen32.exe
File created	C:\Windows\SysWOW64\Jjgobjmp.dll	Nndjndbh.exe
File opened for modification	C:\Windows\SysWOW64\Jgpfbjlo.exe	Jpenfp32.exe
File opened for modification	C:\Windows\SysWOW64\Bkibgh32.exe	Bgnffj32.exe
File created	C:\Windows\SysWOW64\Kgjgne32.exe	Mpclce32.exe
File opened for modification	C:\Windows\SysWOW64\Pnkbkk32.exe	Phajna32.exe
File created	C:\Windows\SysWOW64\Afbgkl32.exe	Adcjop32.exe
File opened for modification	C:\Windows\SysWOW64\Dahmfpap.exe	Dojqjdbl.exe
File created	C:\Windows\SysWOW64\Nafjjf32.exe	Nklbmllg.exe
File opened for modification	C:\Windows\SysWOW64\Lqndhcdc.exe	Lnohlgep.exe
File created	C:\Windows\SysWOW64\Lkchelci.exe	Lggldm32.exe
File created	C:\Windows\SysWOW64\Hnphoj32.exe	Hpmhdmea.exe
File opened for modification	C:\Windows\SysWOW64\Apjkcadp.exe	Aagkhd32.exe
File created	C:\Windows\SysWOW64\Lfojfj32.dll	Halhfe32.exe
File created	C:\Windows\SysWOW64\Ngomin32.exe	Npedmdab.exe
File created	C:\Windows\SysWOW64\Jnhpoamf.exe	Hjlkge32.exe
File created	C:\Windows\SysWOW64\Gbfnhm32.dll	Nlkgmh32.exe
File created	C:\Windows\SysWOW64\Oeehkn32.exe	Nnkpnclp.exe
File created	C:\Windows\SysWOW64\Eecphp32.exe	Enigke32.exe
File opened for modification	C:\Windows\SysWOW64\Giecfejd.exe	Ganldgib.exe
File created	C:\Windows\SysWOW64\Hldiinke.exe	Hifmmb32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5668	5976	WerFault.exe	597

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idkkpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpelhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbadcpbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfkegm32.dll"	Mgclpkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnfmbmbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbgcih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chnpamkc.dll"	Aggpfkjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdeodj32.dll"	Ljhefhha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngqagcag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eklajcmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Glfmgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfchidda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jiglnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adfgdpmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdcbom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gilmfhhk.dll"	Afnnnd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Doaneiop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjeiodek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkokcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eegcnaoo.dll"	Egcaod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pidlqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqpamb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hlpfhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igdgglfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aoioli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fndpmndl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiaafn32.dll"	Gmdcfidg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Polppg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncdmbe32.dll"	Mgehfkop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hoobdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgeakekd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npiiffqe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Panhbfep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Biafno32.dll"	Chnlgjlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehbnigjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fgmdec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnlnbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oiccje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnbddbhk.dll"	Aajhndkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehojko32.dll"	Boihcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbpedjnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihkjno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mhdckaeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Biadeoce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkcfid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oboijgbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgclpkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggiabl32.dll"	Mjkblhfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gikdkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Begfqa32.dll"	Eiekog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	0fb7da825ba085164f2f2f2a00a192b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcbnnpka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egilaj32.dll"	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Doojec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkqkhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgccinoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjdhbppo.dll"	Jlgepanl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eiekog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iplkpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcppfn32.dll"	Nbadcpbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gldglf32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 4852	2920	0fb7da825ba085164f2f2f2a00a192b5.exe	33
PID 2920 wrote to memory of 4852	2920	0fb7da825ba085164f2f2f2a00a192b5.exe	33
PID 2920 wrote to memory of 4852	2920	0fb7da825ba085164f2f2f2a00a192b5.exe	33
PID 4852 wrote to memory of 868	4852	Kmdqgd32.exe	32
PID 4852 wrote to memory of 868	4852	Kmdqgd32.exe	32
PID 4852 wrote to memory of 868	4852	Kmdqgd32.exe	32
PID 868 wrote to memory of 4712	868	Klljnp32.exe	28
PID 868 wrote to memory of 4712	868	Klljnp32.exe	28
PID 868 wrote to memory of 4712	868	Klljnp32.exe	28
PID 4712 wrote to memory of 4272	4712	Kdcbom32.exe	30
PID 4712 wrote to memory of 4272	4712	Kdcbom32.exe	30
PID 4712 wrote to memory of 4272	4712	Kdcbom32.exe	30
PID 4272 wrote to memory of 4396	4272	Kfankifm.exe	29
PID 4272 wrote to memory of 4396	4272	Kfankifm.exe	29
PID 4272 wrote to memory of 4396	4272	Kfankifm.exe	29
PID 4396 wrote to memory of 4820	4396	Kipkhdeq.exe	40
PID 4396 wrote to memory of 4820	4396	Kipkhdeq.exe	40
PID 4396 wrote to memory of 4820	4396	Kipkhdeq.exe	40
PID 4820 wrote to memory of 1272	4820	Kdeoemeg.exe	49
PID 4820 wrote to memory of 1272	4820	Kdeoemeg.exe	49
PID 4820 wrote to memory of 1272	4820	Kdeoemeg.exe	49
PID 1272 wrote to memory of 4320	1272	Miemjaci.exe	96
PID 1272 wrote to memory of 4320	1272	Miemjaci.exe	96
PID 1272 wrote to memory of 4320	1272	Miemjaci.exe	96
PID 4320 wrote to memory of 2748	4320	Ngbpidjh.exe	97
PID 4320 wrote to memory of 2748	4320	Ngbpidjh.exe	97
PID 4320 wrote to memory of 2748	4320	Ngbpidjh.exe	97
PID 2748 wrote to memory of 728	2748	Igcoqocb.exe	116
PID 2748 wrote to memory of 728	2748	Igcoqocb.exe	116
PID 2748 wrote to memory of 728	2748	Igcoqocb.exe	116
PID 728 wrote to memory of 1892	728	Kfqgab32.exe	101
PID 728 wrote to memory of 1892	728	Kfqgab32.exe	101
PID 728 wrote to memory of 1892	728	Kfqgab32.exe	101
PID 1892 wrote to memory of 2896	1892	Lhfmdj32.exe	100
PID 1892 wrote to memory of 2896	1892	Lhfmdj32.exe	100
PID 1892 wrote to memory of 2896	1892	Lhfmdj32.exe	100
PID 2896 wrote to memory of 4916	2896	Lnqeqd32.exe	99
PID 2896 wrote to memory of 4916	2896	Lnqeqd32.exe	99
PID 2896 wrote to memory of 4916	2896	Lnqeqd32.exe	99
PID 4916 wrote to memory of 2100	4916	Lfhnaa32.exe	98
PID 4916 wrote to memory of 2100	4916	Lfhnaa32.exe	98
PID 4916 wrote to memory of 2100	4916	Lfhnaa32.exe	98
PID 2100 wrote to memory of 1952	2100	Lifjnm32.exe	397
PID 2100 wrote to memory of 1952	2100	Lifjnm32.exe	397
PID 2100 wrote to memory of 1952	2100	Lifjnm32.exe	397
PID 1952 wrote to memory of 4636	1952	Onkidm32.exe	113
PID 1952 wrote to memory of 4636	1952	Onkidm32.exe	113
PID 1952 wrote to memory of 4636	1952	Onkidm32.exe	113
PID 4636 wrote to memory of 408	4636	Mpnnle32.exe	406
PID 4636 wrote to memory of 408	4636	Mpnnle32.exe	406
PID 4636 wrote to memory of 408	4636	Mpnnle32.exe	406
PID 408 wrote to memory of 1944	408	Pfoann32.exe	112
PID 408 wrote to memory of 1944	408	Pfoann32.exe	112
PID 408 wrote to memory of 1944	408	Pfoann32.exe	112
PID 1944 wrote to memory of 4404	1944	Mekgdl32.exe	111
PID 1944 wrote to memory of 4404	1944	Mekgdl32.exe	111
PID 1944 wrote to memory of 4404	1944	Mekgdl32.exe	111
PID 4404 wrote to memory of 2860	4404	Mpqkad32.exe	110
PID 4404 wrote to memory of 2860	4404	Mpqkad32.exe	110
PID 4404 wrote to memory of 2860	4404	Mpqkad32.exe	110
PID 2860 wrote to memory of 4792	2860	Nbadcpbh.exe	109
PID 2860 wrote to memory of 4792	2860	Nbadcpbh.exe	109
PID 2860 wrote to memory of 4792	2860	Nbadcpbh.exe	109
PID 4792 wrote to memory of 3592	4792	Niklpj32.exe	104

C:\Users\Admin\AppData\Local\Temp\0fb7da825ba085164f2f2f2a00a192b5.exe
"C:\Users\Admin\AppData\Local\Temp\0fb7da825ba085164f2f2f2a00a192b5.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\Kmdqgd32.exe
  C:\Windows\system32\Kmdqgd32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4852

C:\Windows\SysWOW64\Kdcbom32.exe
C:\Windows\system32\Kdcbom32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\Kfankifm.exe
  C:\Windows\system32\Kfankifm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4272

C:\Windows\SysWOW64\Kipkhdeq.exe
C:\Windows\system32\Kipkhdeq.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\Kdeoemeg.exe
  C:\Windows\system32\Kdeoemeg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\Miemjaci.exe
    C:\Windows\system32\Miemjaci.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Windows\SysWOW64\Ngbpidjh.exe
      C:\Windows\system32\Ngbpidjh.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4320
    - - C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2748
      - C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:728

C:\Windows\SysWOW64\Klljnp32.exe
C:\Windows\system32\Klljnp32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\SysWOW64\Lifjnm32.exe
C:\Windows\system32\Lifjnm32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\Lldfjh32.exe
  C:\Windows\system32\Lldfjh32.exe
  2⤵
  PID:1952

C:\Windows\SysWOW64\Lfhnaa32.exe
C:\Windows\system32\Lfhnaa32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916

C:\Windows\SysWOW64\Lnqeqd32.exe
C:\Windows\system32\Lnqeqd32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896

C:\Windows\SysWOW64\Lhfmdj32.exe
C:\Windows\system32\Lhfmdj32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\Mblkhq32.exe
C:\Windows\system32\Mblkhq32.exe
1⤵
PID:408
- C:\Windows\SysWOW64\Mekgdl32.exe
  C:\Windows\system32\Mekgdl32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1944

C:\Windows\SysWOW64\Npedmdab.exe
C:\Windows\system32\Npedmdab.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3592
- C:\Windows\SysWOW64\Ngomin32.exe
  C:\Windows\system32\Ngomin32.exe
  2⤵
  - Executes dropped EXE
  PID:4504

C:\Windows\SysWOW64\Nlleaeff.exe
C:\Windows\system32\Nlleaeff.exe
1⤵
- Executes dropped EXE
PID:2060
- C:\Windows\SysWOW64\Ngaionfl.exe
  C:\Windows\system32\Ngaionfl.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- - C:\Windows\SysWOW64\Npjnhc32.exe
    C:\Windows\system32\Npjnhc32.exe
    3⤵
    - Executes dropped EXE
    PID:3972
  - - C:\Windows\SysWOW64\Nookip32.exe
      C:\Windows\system32\Nookip32.exe
      4⤵
      Executes dropped EXE
      PID:1568

C:\Windows\SysWOW64\Niklpj32.exe
C:\Windows\system32\Niklpj32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792

C:\Windows\SysWOW64\Nbadcpbh.exe
C:\Windows\system32\Nbadcpbh.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\SysWOW64\Mpqkad32.exe
C:\Windows\system32\Mpqkad32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404

C:\Windows\SysWOW64\Mpnnle32.exe
C:\Windows\system32\Mpnnle32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636

C:\Windows\SysWOW64\Aobilkcl.exe
C:\Windows\system32\Aobilkcl.exe
1⤵
- Executes dropped EXE
PID:1428
- C:\Windows\SysWOW64\Aflaie32.exe
  C:\Windows\system32\Aflaie32.exe
  2⤵
  - Executes dropped EXE
  PID:2944

C:\Windows\SysWOW64\Bfchidda.exe
C:\Windows\system32\Bfchidda.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:740
- C:\Windows\SysWOW64\Biadeoce.exe
  C:\Windows\system32\Biadeoce.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:3092
- - C:\Windows\SysWOW64\Fdffbake.exe
    C:\Windows\system32\Fdffbake.exe
    3⤵
    PID:440
  - - C:\Windows\SysWOW64\Fibojhim.exe
      C:\Windows\system32\Fibojhim.exe
      4⤵
      Executes dropped EXE
      PID:220
    - - C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        5⤵
        Executes dropped EXE
        
        PID:1052

C:\Windows\SysWOW64\Bqfoamfj.exe
C:\Windows\system32\Bqfoamfj.exe
1⤵
- Executes dropped EXE
PID:1920

C:\Windows\SysWOW64\Afnnnd32.exe
C:\Windows\system32\Afnnnd32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:3636

C:\Windows\SysWOW64\Aodfajaj.exe
C:\Windows\system32\Aodfajaj.exe
1⤵
- Executes dropped EXE
PID:1184

C:\Windows\SysWOW64\Hpbiip32.exe
C:\Windows\system32\Hpbiip32.exe
1⤵
- Executes dropped EXE
PID:2176
- C:\Windows\SysWOW64\Hkgnfhnh.exe
  C:\Windows\system32\Hkgnfhnh.exe
  2⤵
  - Executes dropped EXE
  PID:5044

C:\Windows\SysWOW64\Hpdfnolo.exe
C:\Windows\system32\Hpdfnolo.exe
1⤵
PID:3220
- C:\Windows\SysWOW64\Hgnoki32.exe
  C:\Windows\system32\Hgnoki32.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- - C:\Windows\SysWOW64\Hjlkge32.exe
    C:\Windows\system32\Hjlkge32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3812

C:\Windows\SysWOW64\Hjhalefe.exe
C:\Windows\system32\Hjhalefe.exe
1⤵
PID:4312

C:\Windows\SysWOW64\Hkeaqi32.exe
C:\Windows\system32\Hkeaqi32.exe
1⤵
PID:2928

C:\Windows\SysWOW64\Jqglkmlj.exe
C:\Windows\system32\Jqglkmlj.exe
1⤵
PID:1076
- C:\Windows\SysWOW64\Jhndljll.exe
  C:\Windows\system32\Jhndljll.exe
  2⤵
  - Executes dropped EXE
  PID:3576

C:\Windows\SysWOW64\Jklphekp.exe
C:\Windows\system32\Jklphekp.exe
1⤵
- Executes dropped EXE
PID:2976
- C:\Windows\SysWOW64\Jnkldqkc.exe
  C:\Windows\system32\Jnkldqkc.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  PID:3940
- - C:\Windows\SysWOW64\Jnmijq32.exe
    C:\Windows\system32\Jnmijq32.exe
    3⤵
    - Executes dropped EXE
    PID:3728

C:\Windows\SysWOW64\Kiejmi32.exe
C:\Windows\system32\Kiejmi32.exe
1⤵
- Executes dropped EXE
PID:1436
- C:\Windows\SysWOW64\Kkcfid32.exe
  C:\Windows\system32\Kkcfid32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:4900
- - C:\Windows\SysWOW64\Knbbep32.exe
    C:\Windows\system32\Knbbep32.exe
    3⤵
    - Executes dropped EXE
    PID:3600

C:\Windows\SysWOW64\Kjhcjq32.exe
C:\Windows\system32\Kjhcjq32.exe
1⤵
- Executes dropped EXE
PID:1596
- C:\Windows\SysWOW64\Kbpkkn32.exe
  C:\Windows\system32\Kbpkkn32.exe
  2⤵
  - Executes dropped EXE
  PID:4392

C:\Windows\SysWOW64\Kgjgne32.exe
C:\Windows\system32\Kgjgne32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3128

C:\Windows\SysWOW64\Kqpoakco.exe
C:\Windows\system32\Kqpoakco.exe
1⤵
PID:1812
- C:\Windows\SysWOW64\Mcaipa32.exe
  C:\Windows\system32\Mcaipa32.exe
  2⤵
  PID:12788
- - C:\Windows\SysWOW64\Mfpell32.exe
    C:\Windows\system32\Mfpell32.exe
    3⤵
    PID:12836
  - - C:\Windows\SysWOW64\Mqjbddpl.exe
      C:\Windows\system32\Mqjbddpl.exe
      4⤵
      PID:12920

C:\Windows\SysWOW64\Kqnbkl32.exe
C:\Windows\system32\Kqnbkl32.exe
1⤵
- Executes dropped EXE
PID:4344

C:\Windows\SysWOW64\Jibmgi32.exe
C:\Windows\system32\Jibmgi32.exe
1⤵
PID:2648

C:\Windows\SysWOW64\Jqlefl32.exe
C:\Windows\system32\Jqlefl32.exe
1⤵
PID:1520
- C:\Windows\SysWOW64\Pciqnk32.exe
  C:\Windows\system32\Pciqnk32.exe
  2⤵
  PID:4068
- - C:\Windows\SysWOW64\Pjcikejg.exe
    C:\Windows\system32\Pjcikejg.exe
    3⤵
    PID:5264
  - - C:\Windows\SysWOW64\Pififb32.exe
      C:\Windows\system32\Pififb32.exe
      4⤵
      PID:5976
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5976 -s 400
        5⤵
        Program crash
        
        PID:5668

C:\Windows\SysWOW64\Jnhpoamf.exe
C:\Windows\system32\Jnhpoamf.exe
1⤵
PID:1592
- C:\Windows\SysWOW64\Khgbqkhj.exe
  C:\Windows\system32\Khgbqkhj.exe
  2⤵
  PID:3400
- - C:\Windows\SysWOW64\Klbnajqc.exe
    C:\Windows\system32\Klbnajqc.exe
    3⤵
    PID:4064

C:\Windows\SysWOW64\Mnlnbl32.exe
C:\Windows\system32\Mnlnbl32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:4932
- C:\Windows\SysWOW64\Mbgjbkfg.exe
  C:\Windows\system32\Mbgjbkfg.exe
  2⤵
  - Executes dropped EXE
  PID:368

C:\Windows\SysWOW64\Mjbogmdb.exe
C:\Windows\system32\Mjbogmdb.exe
1⤵
- Executes dropped EXE
PID:3492
- C:\Windows\SysWOW64\Mbighjdd.exe
  C:\Windows\system32\Mbighjdd.exe
  2⤵
  PID:4068
- - C:\Windows\SysWOW64\Micoed32.exe
    C:\Windows\system32\Micoed32.exe
    3⤵
    PID:2740
  - - C:\Windows\SysWOW64\Mjellmbp.exe
      C:\Windows\system32\Mjellmbp.exe
      4⤵
      PID:2024
    - - C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        5⤵
        
        PID:8

C:\Windows\SysWOW64\Maodigil.exe
C:\Windows\system32\Maodigil.exe
1⤵
PID:1540
- C:\Windows\SysWOW64\Mldhfpib.exe
  C:\Windows\system32\Mldhfpib.exe
  2⤵
  - Drops file in System32 directory
  PID:732
- - C:\Windows\SysWOW64\Nbnpcj32.exe
    C:\Windows\system32\Nbnpcj32.exe
    3⤵
    PID:1860
  - - C:\Windows\SysWOW64\Nacmdf32.exe
      C:\Windows\system32\Nacmdf32.exe
      4⤵
      PID:5136

C:\Windows\SysWOW64\Nklbmllg.exe
C:\Windows\system32\Nklbmllg.exe
1⤵
- Drops file in System32 directory
PID:5216
- C:\Windows\SysWOW64\Nafjjf32.exe
  C:\Windows\system32\Nafjjf32.exe
  2⤵
  PID:5256
- - C:\Windows\SysWOW64\Nhpbfpka.exe
    C:\Windows\system32\Nhpbfpka.exe
    3⤵
    PID:5296
  - - C:\Windows\SysWOW64\Obqanjdb.exe
      C:\Windows\system32\Obqanjdb.exe
      4⤵
      PID:12784

C:\Windows\SysWOW64\Nijeec32.exe
C:\Windows\system32\Nijeec32.exe
1⤵
PID:5176
- C:\Windows\SysWOW64\Oihmedma.exe
  C:\Windows\system32\Oihmedma.exe
  2⤵
  PID:1264
- - C:\Windows\SysWOW64\Oqoefand.exe
    C:\Windows\system32\Oqoefand.exe
    3⤵
    PID:12348

C:\Windows\SysWOW64\Nojjcj32.exe
C:\Windows\system32\Nojjcj32.exe
1⤵
PID:5336
- C:\Windows\SysWOW64\Nahgoe32.exe
  C:\Windows\system32\Nahgoe32.exe
  2⤵
  PID:5376
- - C:\Windows\SysWOW64\Neccpd32.exe
    C:\Windows\system32\Neccpd32.exe
    3⤵
    PID:5416
  - - C:\Windows\SysWOW64\Nkqkhk32.exe
      C:\Windows\system32\Nkqkhk32.exe
      4⤵
      Modifies registry class
      PID:5460
    - - C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        5⤵
        Modifies registry class
        
        PID:5500
      - C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        6⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        7⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        8⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        9⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        10⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        11⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        9⤵
        
        PID:540
- C:\Windows\SysWOW64\Pplhhm32.exe
  C:\Windows\system32\Pplhhm32.exe
  2⤵
  PID:5632

C:\Windows\SysWOW64\Okgaijaj.exe
C:\Windows\system32\Okgaijaj.exe
1⤵
PID:5836
- C:\Windows\SysWOW64\Oboijgbl.exe
  C:\Windows\system32\Oboijgbl.exe
  2⤵
  - Modifies registry class
  PID:5888
- - C:\Windows\SysWOW64\Ohkbbn32.exe
    C:\Windows\system32\Ohkbbn32.exe
    3⤵
    PID:5960
  - - C:\Windows\SysWOW64\Ooejohhq.exe
      C:\Windows\system32\Ooejohhq.exe
      4⤵
      PID:6004
    - - C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064

C:\Windows\SysWOW64\Ohnohn32.exe
C:\Windows\system32\Ohnohn32.exe
1⤵
PID:6112
- C:\Windows\SysWOW64\Oklkdi32.exe
  C:\Windows\system32\Oklkdi32.exe
  2⤵
  PID:5164

C:\Windows\SysWOW64\Obcceg32.exe
C:\Windows\system32\Obcceg32.exe
1⤵
PID:5240
- C:\Windows\SysWOW64\Ohpkmn32.exe
  C:\Windows\system32\Ohpkmn32.exe
  2⤵
  PID:5364
- - C:\Windows\SysWOW64\Pllgnl32.exe
    C:\Windows\system32\Pllgnl32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:5468
  - - C:\Windows\SysWOW64\Pahpfc32.exe
      C:\Windows\system32\Pahpfc32.exe
      4⤵
      PID:5524

C:\Windows\SysWOW64\Piphgq32.exe
C:\Windows\system32\Piphgq32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5640
- C:\Windows\SysWOW64\Plndcl32.exe
  C:\Windows\system32\Plndcl32.exe
  2⤵
  PID:5712
- - C:\Windows\SysWOW64\Polppg32.exe
    C:\Windows\system32\Polppg32.exe
    3⤵
    - Modifies registry class
    PID:5812

C:\Windows\SysWOW64\Pakllc32.exe
C:\Windows\system32\Pakllc32.exe
1⤵
PID:5904
- C:\Windows\SysWOW64\Phedhmhi.exe
  C:\Windows\system32\Phedhmhi.exe
  2⤵
  PID:5984
- - C:\Windows\SysWOW64\Pkcadhgm.exe
    C:\Windows\system32\Pkcadhgm.exe
    3⤵
    PID:5132
  - - C:\Windows\SysWOW64\Idkkpf32.exe
      C:\Windows\system32\Idkkpf32.exe
      4⤵
      Modifies registry class
      PID:5444
    - - C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5596
      - C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        6⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        7⤵
        
        PID:5988

C:\Windows\SysWOW64\Mhdckaeo.exe
C:\Windows\system32\Mhdckaeo.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4308

C:\Windows\SysWOW64\Kcpahpmd.exe
C:\Windows\system32\Kcpahpmd.exe
1⤵
- Drops file in System32 directory
PID:4720
- C:\Windows\SysWOW64\Kjjiej32.exe
  C:\Windows\system32\Kjjiej32.exe
  2⤵
  PID:2128
- - C:\Windows\SysWOW64\Kqdaadln.exe
    C:\Windows\system32\Kqdaadln.exe
    3⤵
    PID:4292
  - - C:\Windows\SysWOW64\Kcbnnpka.exe
      C:\Windows\system32\Kcbnnpka.exe
      4⤵
      Modifies registry class
      PID:6084

C:\Windows\SysWOW64\Kkjeomld.exe
C:\Windows\system32\Kkjeomld.exe
1⤵
PID:4656
- C:\Windows\SysWOW64\Kmkbfeab.exe
  C:\Windows\system32\Kmkbfeab.exe
  2⤵
  PID:4044
- - C:\Windows\SysWOW64\Lnjnqh32.exe
    C:\Windows\system32\Lnjnqh32.exe
    3⤵
    PID:5652
  - - C:\Windows\SysWOW64\Lgccinoe.exe
      C:\Windows\system32\Lgccinoe.exe
      4⤵
      Modifies registry class
      PID:5020
    - - C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        5⤵
        
        PID:5972

C:\Windows\SysWOW64\Lkalplel.exe
C:\Windows\system32\Lkalplel.exe
1⤵
PID:3132
- C:\Windows\SysWOW64\Lnohlgep.exe
  C:\Windows\system32\Lnohlgep.exe
  2⤵
  - Drops file in System32 directory
  PID:5368

C:\Windows\SysWOW64\Lqndhcdc.exe
C:\Windows\system32\Lqndhcdc.exe
1⤵
PID:2140
- C:\Windows\SysWOW64\Ldipha32.exe
  C:\Windows\system32\Ldipha32.exe
  2⤵
  PID:5696

C:\Windows\SysWOW64\Lggldm32.exe
C:\Windows\system32\Lggldm32.exe
1⤵
- Drops file in System32 directory
PID:4284
- C:\Windows\SysWOW64\Lkchelci.exe
  C:\Windows\system32\Lkchelci.exe
  2⤵
  PID:6060

C:\Windows\SysWOW64\Lnadagbm.exe
C:\Windows\system32\Lnadagbm.exe
1⤵
PID:4788
- C:\Windows\SysWOW64\Lqpamb32.exe
  C:\Windows\system32\Lqpamb32.exe
  2⤵
  - Modifies registry class
  PID:4756

C:\Windows\SysWOW64\Lcnmin32.exe
C:\Windows\system32\Lcnmin32.exe
1⤵
PID:5952
- C:\Windows\SysWOW64\Ljhefhha.exe
  C:\Windows\system32\Ljhefhha.exe
  2⤵
  - Modifies registry class
  PID:4424
- - C:\Windows\SysWOW64\Lmgabcge.exe
    C:\Windows\system32\Lmgabcge.exe
    3⤵
    PID:5440

C:\Windows\SysWOW64\Lqbncb32.exe
C:\Windows\system32\Lqbncb32.exe
1⤵
PID:2964
- C:\Windows\SysWOW64\Mcqjon32.exe
  C:\Windows\system32\Mcqjon32.exe
  2⤵
  PID:6020

C:\Windows\SysWOW64\Mkhapk32.exe
C:\Windows\system32\Mkhapk32.exe
1⤵
- Drops file in System32 directory
PID:2548
- C:\Windows\SysWOW64\Mjkblhfo.exe
  C:\Windows\system32\Mjkblhfo.exe
  2⤵
  - Modifies registry class
  PID:4888

C:\Windows\SysWOW64\Mminhceb.exe
C:\Windows\system32\Mminhceb.exe
1⤵
PID:6164
- C:\Windows\SysWOW64\Madjhb32.exe
  C:\Windows\system32\Madjhb32.exe
  2⤵
  PID:6212
- - C:\Windows\SysWOW64\Mccfdmmo.exe
    C:\Windows\system32\Mccfdmmo.exe
    3⤵
    - Drops file in System32 directory
    PID:6260

C:\Windows\SysWOW64\Mjmoag32.exe
C:\Windows\system32\Mjmoag32.exe
1⤵
PID:6304
- C:\Windows\SysWOW64\Maggnali.exe
  C:\Windows\system32\Maggnali.exe
  2⤵
  PID:6344
- - C:\Windows\SysWOW64\Mgaokl32.exe
    C:\Windows\system32\Mgaokl32.exe
    3⤵
    PID:6388
  - - C:\Windows\SysWOW64\Mjokgg32.exe
      C:\Windows\system32\Mjokgg32.exe
      4⤵
      PID:6428
    - - C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        5⤵
        
        PID:6468
      - C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        6⤵
        
        PID:6508

C:\Windows\SysWOW64\Mgclpkac.exe
C:\Windows\system32\Mgclpkac.exe
1⤵
- Modifies registry class
PID:6552
- C:\Windows\SysWOW64\Mnmdme32.exe
  C:\Windows\system32\Mnmdme32.exe
  2⤵
  PID:6592
- - C:\Windows\SysWOW64\Megljppl.exe
    C:\Windows\system32\Megljppl.exe
    3⤵
    PID:6640

C:\Windows\SysWOW64\Mgehfkop.exe
C:\Windows\system32\Mgehfkop.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6680
- C:\Windows\SysWOW64\Mkadfj32.exe
  C:\Windows\system32\Mkadfj32.exe
  2⤵
  - Drops file in System32 directory
  PID:6728
- - C:\Windows\SysWOW64\Mmbanbmg.exe
    C:\Windows\system32\Mmbanbmg.exe
    3⤵
    PID:6776
  - - C:\Windows\SysWOW64\Nclikl32.exe
      C:\Windows\system32\Nclikl32.exe
      4⤵
      PID:6820
    - - C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        5⤵
        
        PID:6864

C:\Windows\SysWOW64\Ngjbaj32.exe
C:\Windows\system32\Ngjbaj32.exe
1⤵
PID:6988
- C:\Windows\SysWOW64\Nndjndbh.exe
  C:\Windows\system32\Nndjndbh.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  PID:7036
- - C:\Windows\SysWOW64\Nabfjpak.exe
    C:\Windows\system32\Nabfjpak.exe
    3⤵
    PID:7084

C:\Windows\SysWOW64\Ncofplba.exe
C:\Windows\system32\Ncofplba.exe
1⤵
PID:6944

C:\Windows\SysWOW64\Ncabfkqo.exe
C:\Windows\system32\Ncabfkqo.exe
1⤵
PID:7128
- C:\Windows\SysWOW64\Njkkbehl.exe
  C:\Windows\system32\Njkkbehl.exe
  2⤵
  PID:3796
- - C:\Windows\SysWOW64\Nmigoagp.exe
    C:\Windows\system32\Nmigoagp.exe
    3⤵
    PID:6200
  - - C:\Windows\SysWOW64\Neqopnhb.exe
      C:\Windows\system32\Neqopnhb.exe
      4⤵
      PID:6292

C:\Windows\SysWOW64\Nhokljge.exe
C:\Windows\system32\Nhokljge.exe
1⤵
PID:3852
- C:\Windows\SysWOW64\Nlkgmh32.exe
  C:\Windows\system32\Nlkgmh32.exe
  2⤵
  - Drops file in System32 directory
  PID:6372
- - C:\Windows\SysWOW64\Nmlddqem.exe
    C:\Windows\system32\Nmlddqem.exe
    3⤵
    PID:6436
  - - C:\Windows\SysWOW64\Ndflak32.exe
      C:\Windows\system32\Ndflak32.exe
      4⤵
      PID:6492
    - - C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6584
      - C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        6⤵
        Drops file in System32 directory
        
        PID:6648
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        7⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        8⤵
        
        PID:6760

C:\Windows\SysWOW64\Oeheqm32.exe
C:\Windows\system32\Oeheqm32.exe
1⤵
PID:6904
- C:\Windows\SysWOW64\Ohfami32.exe
  C:\Windows\system32\Ohfami32.exe
  2⤵
  PID:6968
- - C:\Windows\SysWOW64\Oanfen32.exe
    C:\Windows\system32\Oanfen32.exe
    3⤵
    PID:7032
  - - C:\Windows\SysWOW64\Ohhnbhok.exe
      C:\Windows\system32\Ohhnbhok.exe
      4⤵
      PID:7076

C:\Windows\SysWOW64\Oobfob32.exe
C:\Windows\system32\Oobfob32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7156
- C:\Windows\SysWOW64\Oelolmnd.exe
  C:\Windows\system32\Oelolmnd.exe
  2⤵
  PID:736

C:\Windows\SysWOW64\Omqmop32.exe
C:\Windows\system32\Omqmop32.exe
1⤵
- Drops file in System32 directory
PID:6860

C:\Windows\SysWOW64\Napjdpcn.exe
C:\Windows\system32\Napjdpcn.exe
1⤵
PID:6908

C:\Windows\SysWOW64\Lqkgbcff.exe
C:\Windows\system32\Lqkgbcff.exe
1⤵
PID:4568

C:\Windows\SysWOW64\Cfbcke32.exe
C:\Windows\system32\Cfbcke32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6404
- C:\Windows\SysWOW64\Dkokcl32.exe
  C:\Windows\system32\Dkokcl32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Modifies registry class
  PID:6560

C:\Windows\SysWOW64\Ddgplado.exe
C:\Windows\system32\Ddgplado.exe
1⤵
PID:6916
- C:\Windows\SysWOW64\Dkahilkl.exe
  C:\Windows\system32\Dkahilkl.exe
  2⤵
  PID:3772
- - C:\Windows\SysWOW64\Dnpdegjp.exe
    C:\Windows\system32\Dnpdegjp.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:1620

C:\Windows\SysWOW64\Dfdpad32.exe
C:\Windows\system32\Dfdpad32.exe
1⤵
PID:6848

C:\Windows\SysWOW64\Ddjmba32.exe
C:\Windows\system32\Ddjmba32.exe
1⤵
PID:6240
- C:\Windows\SysWOW64\Dmadco32.exe
  C:\Windows\system32\Dmadco32.exe
  2⤵
  PID:6188

C:\Windows\SysWOW64\Dbnmke32.exe
C:\Windows\system32\Dbnmke32.exe
1⤵
PID:6496
- C:\Windows\SysWOW64\Ddligq32.exe
  C:\Windows\system32\Ddligq32.exe
  2⤵
  PID:4232

C:\Windows\SysWOW64\Dbpjaeoc.exe
C:\Windows\system32\Dbpjaeoc.exe
1⤵
PID:4532
- C:\Windows\SysWOW64\Ddnfmqng.exe
  C:\Windows\system32\Ddnfmqng.exe
  2⤵
  PID:6244
- - C:\Windows\SysWOW64\Dkhnjk32.exe
    C:\Windows\system32\Dkhnjk32.exe
    3⤵
    PID:6548
  - - C:\Windows\SysWOW64\Deqcbpld.exe
      C:\Windows\system32\Deqcbpld.exe
      4⤵
      PID:7080
    - - C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1496
      - C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        6⤵
        
        PID:6952

C:\Windows\SysWOW64\Enigke32.exe
C:\Windows\system32\Enigke32.exe
1⤵
- Drops file in System32 directory
PID:388
- C:\Windows\SysWOW64\Eecphp32.exe
  C:\Windows\system32\Eecphp32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:468

C:\Windows\SysWOW64\Eiokinbk.exe
C:\Windows\system32\Eiokinbk.exe
1⤵
PID:7172
- C:\Windows\SysWOW64\Ebgpad32.exe
  C:\Windows\system32\Ebgpad32.exe
  2⤵
  PID:7224
- - C:\Windows\SysWOW64\Emmdom32.exe
    C:\Windows\system32\Emmdom32.exe
    3⤵
    PID:7272

C:\Windows\SysWOW64\Doaneiop.exe
C:\Windows\system32\Doaneiop.exe
1⤵
- Modifies registry class
PID:7000

C:\Windows\SysWOW64\Epmmqheb.exe
C:\Windows\system32\Epmmqheb.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7316
- C:\Windows\SysWOW64\Eejeiocj.exe
  C:\Windows\system32\Eejeiocj.exe
  2⤵
  PID:7360
- - C:\Windows\SysWOW64\Eppjfgcp.exe
    C:\Windows\system32\Eppjfgcp.exe
    3⤵
    PID:7408
  - - C:\Windows\SysWOW64\Fihnomjp.exe
      C:\Windows\system32\Fihnomjp.exe
      4⤵
      PID:7448
    - - C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        5⤵
        
        PID:7520

C:\Windows\SysWOW64\Fbpchb32.exe
C:\Windows\system32\Fbpchb32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7564
- C:\Windows\SysWOW64\Fflohaij.exe
  C:\Windows\system32\Fflohaij.exe
  2⤵
  - Drops file in System32 directory
  PID:7608
- - C:\Windows\SysWOW64\Fmfgek32.exe
    C:\Windows\system32\Fmfgek32.exe
    3⤵
    PID:7648

C:\Windows\SysWOW64\Fngcmcfe.exe
C:\Windows\system32\Fngcmcfe.exe
1⤵
- Drops file in System32 directory
PID:7684
- C:\Windows\SysWOW64\Fbbpmb32.exe
  C:\Windows\system32\Fbbpmb32.exe
  2⤵
  PID:7728

C:\Windows\SysWOW64\Fealin32.exe
C:\Windows\system32\Fealin32.exe
1⤵
PID:7772
- C:\Windows\SysWOW64\Fmhdkknd.exe
  C:\Windows\system32\Fmhdkknd.exe
  2⤵
  PID:7812
- - C:\Windows\SysWOW64\Fnipbc32.exe
    C:\Windows\system32\Fnipbc32.exe
    3⤵
    PID:7856
  - - C:\Windows\SysWOW64\Ffqhcq32.exe
      C:\Windows\system32\Ffqhcq32.exe
      4⤵
      PID:7896

C:\Windows\SysWOW64\Fiodpl32.exe
C:\Windows\system32\Fiodpl32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7940
- C:\Windows\SysWOW64\Fmkqpkla.exe
  C:\Windows\system32\Fmkqpkla.exe
  2⤵
  PID:7984
- - C:\Windows\SysWOW64\Fnlmhc32.exe
    C:\Windows\system32\Fnlmhc32.exe
    3⤵
    PID:8024
  - - C:\Windows\SysWOW64\Fefedmil.exe
      C:\Windows\system32\Fefedmil.exe
      4⤵
      PID:8064
    - - C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        5⤵
        
        PID:8104

C:\Windows\SysWOW64\Fnnjmbpm.exe
C:\Windows\system32\Fnnjmbpm.exe
1⤵
PID:8148
- C:\Windows\SysWOW64\Gfeaopqo.exe
  C:\Windows\system32\Gfeaopqo.exe
  2⤵
  PID:8188

C:\Windows\SysWOW64\Gmojkj32.exe
C:\Windows\system32\Gmojkj32.exe
1⤵
PID:7260
- C:\Windows\SysWOW64\Gnqfcbnj.exe
  C:\Windows\system32\Gnqfcbnj.exe
  2⤵
  PID:7336
- - C:\Windows\SysWOW64\Gejopl32.exe
    C:\Windows\system32\Gejopl32.exe
    3⤵
    PID:5616
  - - C:\Windows\SysWOW64\Gmafajfi.exe
      C:\Windows\system32\Gmafajfi.exe
      4⤵
      PID:7400

C:\Windows\SysWOW64\Gldglf32.exe
C:\Windows\system32\Gldglf32.exe
1⤵
- Modifies registry class
PID:7504
- C:\Windows\SysWOW64\Gbnoiqdq.exe
  C:\Windows\system32\Gbnoiqdq.exe
  2⤵
  PID:7576
- - C:\Windows\SysWOW64\Gemkelcd.exe
    C:\Windows\system32\Gemkelcd.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:7632
  - - C:\Windows\SysWOW64\Gmdcfidg.exe
      C:\Windows\system32\Gmdcfidg.exe
      4⤵
      Modifies registry class
      PID:7716

C:\Windows\SysWOW64\Glgcbf32.exe
C:\Windows\system32\Glgcbf32.exe
1⤵
PID:7780
- C:\Windows\SysWOW64\Gnepna32.exe
  C:\Windows\system32\Gnepna32.exe
  2⤵
  PID:7844

C:\Windows\SysWOW64\Gbalopbn.exe
C:\Windows\system32\Gbalopbn.exe
1⤵
PID:7908
- C:\Windows\SysWOW64\Geohklaa.exe
  C:\Windows\system32\Geohklaa.exe
  2⤵
  PID:7964

C:\Windows\SysWOW64\Gikdkj32.exe
C:\Windows\system32\Gikdkj32.exe
1⤵
- Modifies registry class
PID:8052
- C:\Windows\SysWOW64\Glipgf32.exe
  C:\Windows\system32\Glipgf32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:8124

C:\Windows\SysWOW64\Gpelhd32.exe
C:\Windows\system32\Gpelhd32.exe
1⤵
- Modifies registry class
PID:6876
- C:\Windows\SysWOW64\Gbchdp32.exe
  C:\Windows\system32\Gbchdp32.exe
  2⤵
  - Drops file in System32 directory
  PID:7264

C:\Windows\SysWOW64\Geaepk32.exe
C:\Windows\system32\Geaepk32.exe
1⤵
- Drops file in System32 directory
PID:7368
- C:\Windows\SysWOW64\Gmimai32.exe
  C:\Windows\system32\Gmimai32.exe
  2⤵
  PID:7428

C:\Windows\SysWOW64\Glkmmefl.exe
C:\Windows\system32\Glkmmefl.exe
1⤵
PID:7548
- C:\Windows\SysWOW64\Gojiiafp.exe
  C:\Windows\system32\Gojiiafp.exe
  2⤵
  PID:7680
- - C:\Windows\SysWOW64\Gbeejp32.exe
    C:\Windows\system32\Gbeejp32.exe
    3⤵
    PID:7808
  - - C:\Windows\SysWOW64\Hmkigh32.exe
      C:\Windows\system32\Hmkigh32.exe
      4⤵
      PID:7864

C:\Windows\SysWOW64\Hlnjbedi.exe
C:\Windows\system32\Hlnjbedi.exe
1⤵
PID:8004
- C:\Windows\SysWOW64\Hpiecd32.exe
  C:\Windows\system32\Hpiecd32.exe
  2⤵
  PID:8088

C:\Windows\SysWOW64\Hfcnpn32.exe
C:\Windows\system32\Hfcnpn32.exe
1⤵
PID:7180
- C:\Windows\SysWOW64\Hibjli32.exe
  C:\Windows\system32\Hibjli32.exe
  2⤵
  PID:7348
- - C:\Windows\SysWOW64\Hlpfhe32.exe
    C:\Windows\system32\Hlpfhe32.exe
    3⤵
    - Modifies registry class
    PID:7444
  - - C:\Windows\SysWOW64\Hoobdp32.exe
      C:\Windows\system32\Hoobdp32.exe
      4⤵
      Modifies registry class
      PID:7636

C:\Windows\SysWOW64\Hffken32.exe
C:\Windows\system32\Hffken32.exe
1⤵
PID:7888
- C:\Windows\SysWOW64\Hmpcbhji.exe
  C:\Windows\system32\Hmpcbhji.exe
  2⤵
  PID:8096
- - C:\Windows\SysWOW64\Hpnoncim.exe
    C:\Windows\system32\Hpnoncim.exe
    3⤵
    PID:7212
  - - C:\Windows\SysWOW64\Hblkjo32.exe
      C:\Windows\system32\Hblkjo32.exe
      4⤵
      PID:7188
    - - C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        5⤵
        
        PID:7760
      - C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        6⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        7⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        8⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        9⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        10⤵
        
        PID:7880

C:\Windows\SysWOW64\Ibaeen32.exe
C:\Windows\system32\Ibaeen32.exe
1⤵
PID:7720
- C:\Windows\SysWOW64\Imgicgca.exe
  C:\Windows\system32\Imgicgca.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:8072

C:\Windows\SysWOW64\Iedjmioj.exe
C:\Windows\system32\Iedjmioj.exe
1⤵
PID:8208
- C:\Windows\SysWOW64\Imkbnf32.exe
  C:\Windows\system32\Imkbnf32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:8248

C:\Windows\SysWOW64\Ipjoja32.exe
C:\Windows\system32\Ipjoja32.exe
1⤵
PID:8292
- C:\Windows\SysWOW64\Iomoenej.exe
  C:\Windows\system32\Iomoenej.exe
  2⤵
  PID:8336

C:\Windows\SysWOW64\Igdgglfl.exe
C:\Windows\system32\Igdgglfl.exe
1⤵
- Modifies registry class
PID:8376
- C:\Windows\SysWOW64\Iefgbh32.exe
  C:\Windows\system32\Iefgbh32.exe
  2⤵
  PID:8416
- - C:\Windows\SysWOW64\Imnocf32.exe
    C:\Windows\system32\Imnocf32.exe
    3⤵
    PID:8460

C:\Windows\SysWOW64\Ioolkncg.exe
C:\Windows\system32\Ioolkncg.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8548
- C:\Windows\SysWOW64\Ieidhh32.exe
  C:\Windows\system32\Ieidhh32.exe
  2⤵
  PID:8588

C:\Windows\SysWOW64\Iplkpa32.exe
C:\Windows\system32\Iplkpa32.exe
1⤵
- Drops file in System32 directory
- Modifies registry class
PID:8504

C:\Windows\SysWOW64\Joahqn32.exe
C:\Windows\system32\Joahqn32.exe
1⤵
PID:8628
- C:\Windows\SysWOW64\Jghpbk32.exe
  C:\Windows\system32\Jghpbk32.exe
  2⤵
  - Drops file in System32 directory
  PID:8672
- - C:\Windows\SysWOW64\Jiglnf32.exe
    C:\Windows\system32\Jiglnf32.exe
    3⤵
    - Modifies registry class
    PID:8716
  - - C:\Windows\SysWOW64\Jleijb32.exe
      C:\Windows\system32\Jleijb32.exe
      4⤵
      Drops file in System32 directory
      PID:8756
    - - C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        5⤵
        
        PID:8796

C:\Windows\SysWOW64\Jenmcggo.exe
C:\Windows\system32\Jenmcggo.exe
1⤵
PID:8836
- C:\Windows\SysWOW64\Jmeede32.exe
  C:\Windows\system32\Jmeede32.exe
  2⤵
  PID:8876
- - C:\Windows\SysWOW64\Jlgepanl.exe
    C:\Windows\system32\Jlgepanl.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Modifies registry class
    PID:8924

C:\Windows\SysWOW64\Jgmjmjnb.exe
C:\Windows\system32\Jgmjmjnb.exe
1⤵
PID:8964
- C:\Windows\SysWOW64\Jepjhg32.exe
  C:\Windows\system32\Jepjhg32.exe
  2⤵
  - Drops file in System32 directory
  PID:9004

C:\Windows\SysWOW64\Jngbjd32.exe
C:\Windows\system32\Jngbjd32.exe
1⤵
PID:9044
- C:\Windows\SysWOW64\Jpenfp32.exe
  C:\Windows\system32\Jpenfp32.exe
  2⤵
  - Drops file in System32 directory
  PID:9092
- - C:\Windows\SysWOW64\Jgpfbjlo.exe
    C:\Windows\system32\Jgpfbjlo.exe
    3⤵
    PID:9132
  - - C:\Windows\SysWOW64\Jebfng32.exe
      C:\Windows\system32\Jebfng32.exe
      4⤵
      Drops file in System32 directory
      PID:9172

C:\Windows\SysWOW64\Jniood32.exe
C:\Windows\system32\Jniood32.exe
1⤵
PID:9212
- C:\Windows\SysWOW64\Jphkkpbp.exe
  C:\Windows\system32\Jphkkpbp.exe
  2⤵
  PID:8244

C:\Windows\SysWOW64\Jokkgl32.exe
C:\Windows\system32\Jokkgl32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8300
- C:\Windows\SysWOW64\Jgbchj32.exe
  C:\Windows\system32\Jgbchj32.exe
  2⤵
  PID:8384

C:\Windows\SysWOW64\Jjpode32.exe
C:\Windows\system32\Jjpode32.exe
1⤵
PID:8448
- C:\Windows\SysWOW64\Jlolpq32.exe
  C:\Windows\system32\Jlolpq32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:8512
- - C:\Windows\SysWOW64\Komhll32.exe
    C:\Windows\system32\Komhll32.exe
    3⤵
    PID:8572
  - - C:\Windows\SysWOW64\Kgdpni32.exe
      C:\Windows\system32\Kgdpni32.exe
      4⤵
      PID:8640

C:\Windows\SysWOW64\Knnhjcog.exe
C:\Windows\system32\Knnhjcog.exe
1⤵
PID:8704
- C:\Windows\SysWOW64\Klahfp32.exe
  C:\Windows\system32\Klahfp32.exe
  2⤵
  PID:5724

C:\Windows\SysWOW64\Koodbl32.exe
C:\Windows\system32\Koodbl32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8740
- C:\Windows\SysWOW64\Kgflcifg.exe
  C:\Windows\system32\Kgflcifg.exe
  2⤵
  PID:8832
- - C:\Windows\SysWOW64\Kjeiodek.exe
    C:\Windows\system32\Kjeiodek.exe
    3⤵
    - Modifies registry class
    PID:8860
  - - C:\Windows\SysWOW64\Klcekpdo.exe
      C:\Windows\system32\Klcekpdo.exe
      4⤵
      PID:8960
    - - C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        5⤵
        
        PID:9036
      - C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        6⤵
        Drops file in System32 directory
        
        PID:9112
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9164

C:\Windows\SysWOW64\Kngkqbgl.exe
C:\Windows\system32\Kngkqbgl.exe
1⤵
PID:8368
- C:\Windows\SysWOW64\Lljklo32.exe
  C:\Windows\system32\Lljklo32.exe
  2⤵
  PID:8440
- - C:\Windows\SysWOW64\Lcdciiec.exe
    C:\Windows\system32\Lcdciiec.exe
    3⤵
    PID:8536

C:\Windows\SysWOW64\Kgnbdh32.exe
C:\Windows\system32\Kgnbdh32.exe
1⤵
PID:8216

C:\Windows\SysWOW64\Ljqhkckn.exe
C:\Windows\system32\Ljqhkckn.exe
1⤵
PID:8616
- C:\Windows\SysWOW64\Lomqcjie.exe
  C:\Windows\system32\Lomqcjie.exe
  2⤵
  - Drops file in System32 directory
  PID:9140
- - C:\Windows\SysWOW64\Lfjfecno.exe
    C:\Windows\system32\Lfjfecno.exe
    3⤵
    PID:8232
  - - C:\Windows\SysWOW64\Lnangaoa.exe
      C:\Windows\system32\Lnangaoa.exe
      4⤵
      Drops file in System32 directory
      PID:8404
    - - C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4400

C:\Windows\SysWOW64\Mcpcdg32.exe
C:\Windows\system32\Mcpcdg32.exe
1⤵
PID:4844
- C:\Windows\SysWOW64\Mogcihaj.exe
  C:\Windows\system32\Mogcihaj.exe
  2⤵
  PID:8708
- - C:\Windows\SysWOW64\Mcelpggq.exe
    C:\Windows\system32\Mcelpggq.exe
    3⤵
    PID:1100
  - - C:\Windows\SysWOW64\Mnjqmpgg.exe
      C:\Windows\system32\Mnjqmpgg.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:8792

C:\Windows\SysWOW64\Mmmqhl32.exe
C:\Windows\system32\Mmmqhl32.exe
1⤵
PID:8908
- C:\Windows\SysWOW64\Mcgiefen.exe
  C:\Windows\system32\Mcgiefen.exe
  2⤵
  PID:9000
- - C:\Windows\SysWOW64\Mfeeabda.exe
    C:\Windows\system32\Mfeeabda.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:9072
  - - C:\Windows\SysWOW64\Monjjgkb.exe
      C:\Windows\system32\Monjjgkb.exe
      4⤵
      PID:8428
    - - C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        5⤵
        Modifies registry class
        
        PID:8484
      - C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        6⤵
        
        PID:7616

C:\Windows\SysWOW64\Nclbpf32.exe
C:\Windows\system32\Nclbpf32.exe
1⤵
- Drops file in System32 directory
PID:8568
- C:\Windows\SysWOW64\Nfjola32.exe
  C:\Windows\system32\Nfjola32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:8700
- - C:\Windows\SysWOW64\Njfkmphe.exe
    C:\Windows\system32\Njfkmphe.exe
    3⤵
    PID:8820
  - - C:\Windows\SysWOW64\Nqpcjj32.exe
      C:\Windows\system32\Nqpcjj32.exe
      4⤵
      PID:4584
    - - C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9116
      - C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8320
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        7⤵
        
        PID:1684

C:\Windows\SysWOW64\Ngndaccj.exe
C:\Windows\system32\Ngndaccj.exe
1⤵
PID:9100
- C:\Windows\SysWOW64\Npiiffqe.exe
  C:\Windows\system32\Npiiffqe.exe
  2⤵
  - Modifies registry class
  PID:8724

C:\Windows\SysWOW64\Ngqagcag.exe
C:\Windows\system32\Ngqagcag.exe
1⤵
- Modifies registry class
PID:8952
- C:\Windows\SysWOW64\Onkidm32.exe
  C:\Windows\system32\Onkidm32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\Ocgbld32.exe
    C:\Windows\system32\Ocgbld32.exe
    3⤵
    PID:2668

C:\Windows\SysWOW64\Ompfej32.exe
C:\Windows\system32\Ompfej32.exe
1⤵
- Drops file in System32 directory
PID:3524
- C:\Windows\SysWOW64\Opnbae32.exe
  C:\Windows\system32\Opnbae32.exe
  2⤵
  PID:1216
- - C:\Windows\SysWOW64\Ofhknodl.exe
    C:\Windows\system32\Ofhknodl.exe
    3⤵
    PID:2044
  - - C:\Windows\SysWOW64\Oghghb32.exe
      C:\Windows\system32\Oghghb32.exe
      4⤵
      PID:8776
    - - C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        5⤵
        
        PID:5012

C:\Windows\SysWOW64\Oaplqh32.exe
C:\Windows\system32\Oaplqh32.exe
1⤵
PID:8948
- C:\Windows\SysWOW64\Ocohmc32.exe
  C:\Windows\system32\Ocohmc32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:4944
- - C:\Windows\SysWOW64\Ondljl32.exe
    C:\Windows\system32\Ondljl32.exe
    3⤵
    PID:4980
  - - C:\Windows\SysWOW64\Oabhfg32.exe
      C:\Windows\system32\Oabhfg32.exe
      4⤵
      PID:8804
    - - C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        5⤵
        
        PID:9060

C:\Windows\SysWOW64\Pfoann32.exe
C:\Windows\system32\Pfoann32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\SysWOW64\Pnfiplog.exe
  C:\Windows\system32\Pnfiplog.exe
  2⤵
  PID:3624
- - C:\Windows\SysWOW64\Pccahbmn.exe
    C:\Windows\system32\Pccahbmn.exe
    3⤵
    PID:3176
  - - C:\Windows\SysWOW64\Pfandnla.exe
      C:\Windows\system32\Pfandnla.exe
      4⤵
      PID:4716

C:\Windows\SysWOW64\Pjmjdm32.exe
C:\Windows\system32\Pjmjdm32.exe
1⤵
- Drops file in System32 directory
PID:5100
- C:\Windows\SysWOW64\Pmlfqh32.exe
  C:\Windows\system32\Pmlfqh32.exe
  2⤵
  PID:3348

C:\Windows\SysWOW64\Ppjbmc32.exe
C:\Windows\system32\Ppjbmc32.exe
1⤵
PID:464
- C:\Windows\SysWOW64\Phajna32.exe
  C:\Windows\system32\Phajna32.exe
  2⤵
  - Drops file in System32 directory
  PID:9228
- - C:\Windows\SysWOW64\Pnkbkk32.exe
    C:\Windows\system32\Pnkbkk32.exe
    3⤵
    PID:9268
  - - C:\Windows\SysWOW64\Pplobcpp.exe
      C:\Windows\system32\Pplobcpp.exe
      4⤵
      PID:9316
    - - C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        5⤵
        
        PID:9356
      - C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        6⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        7⤵
        
        PID:9436

C:\Windows\SysWOW64\Pdjgha32.exe
C:\Windows\system32\Pdjgha32.exe
1⤵
- Drops file in System32 directory
PID:9476
- C:\Windows\SysWOW64\Pfiddm32.exe
  C:\Windows\system32\Pfiddm32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:9516

C:\Windows\SysWOW64\Panhbfep.exe
C:\Windows\system32\Panhbfep.exe
1⤵
- Drops file in System32 directory
- Modifies registry class
PID:9596
- C:\Windows\SysWOW64\Pdmdnadc.exe
  C:\Windows\system32\Pdmdnadc.exe
  2⤵
  PID:9644
- - C:\Windows\SysWOW64\Qjfmkk32.exe
    C:\Windows\system32\Qjfmkk32.exe
    3⤵
    PID:9684

C:\Windows\SysWOW64\Qobhkjdi.exe
C:\Windows\system32\Qobhkjdi.exe
1⤵
PID:9728
- C:\Windows\SysWOW64\Qdoacabq.exe
  C:\Windows\system32\Qdoacabq.exe
  2⤵
  PID:9772
- - C:\Windows\SysWOW64\Qjiipk32.exe
    C:\Windows\system32\Qjiipk32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:9816
  - - C:\Windows\SysWOW64\Qmgelf32.exe
      C:\Windows\system32\Qmgelf32.exe
      4⤵
      PID:9856

C:\Windows\SysWOW64\Qdaniq32.exe
C:\Windows\system32\Qdaniq32.exe
1⤵
- Modifies registry class
PID:9896
- C:\Windows\SysWOW64\Afpjel32.exe
  C:\Windows\system32\Afpjel32.exe
  2⤵
  PID:9936
- - C:\Windows\SysWOW64\Aogbfi32.exe
    C:\Windows\system32\Aogbfi32.exe
    3⤵
    PID:9976

C:\Windows\SysWOW64\Amjbbfgo.exe
C:\Windows\system32\Amjbbfgo.exe
1⤵
PID:10012
- C:\Windows\SysWOW64\Aphnnafb.exe
  C:\Windows\system32\Aphnnafb.exe
  2⤵
  PID:10060

C:\Windows\SysWOW64\Adcjop32.exe
C:\Windows\system32\Adcjop32.exe
1⤵
- Drops file in System32 directory
PID:10100
- C:\Windows\SysWOW64\Afbgkl32.exe
  C:\Windows\system32\Afbgkl32.exe
  2⤵
  PID:10144

C:\Windows\SysWOW64\Aoioli32.exe
C:\Windows\system32\Aoioli32.exe
1⤵
- Modifies registry class
PID:10184
- C:\Windows\SysWOW64\Aagkhd32.exe
  C:\Windows\system32\Aagkhd32.exe
  2⤵
  - Drops file in System32 directory
  PID:10228

C:\Windows\SysWOW64\Apjkcadp.exe
C:\Windows\system32\Apjkcadp.exe
1⤵
PID:9248
- C:\Windows\SysWOW64\Adfgdpmi.exe
  C:\Windows\system32\Adfgdpmi.exe
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  PID:9296
- - C:\Windows\SysWOW64\Akpoaj32.exe
    C:\Windows\system32\Akpoaj32.exe
    3⤵
    PID:9392

C:\Windows\SysWOW64\Amnlme32.exe
C:\Windows\system32\Amnlme32.exe
1⤵
PID:9460
- C:\Windows\SysWOW64\Aajhndkb.exe
  C:\Windows\system32\Aajhndkb.exe
  2⤵
  - Modifies registry class
  PID:9540
- - C:\Windows\SysWOW64\Ahdpjn32.exe
    C:\Windows\system32\Ahdpjn32.exe
    3⤵
    - Drops file in System32 directory
    PID:9576

C:\Windows\SysWOW64\Aggpfkjj.exe
C:\Windows\system32\Aggpfkjj.exe
1⤵
- Modifies registry class
PID:9664
- C:\Windows\SysWOW64\Aonhghjl.exe
  C:\Windows\system32\Aonhghjl.exe
  2⤵
  PID:9544

C:\Windows\SysWOW64\Amqhbe32.exe
C:\Windows\system32\Amqhbe32.exe
1⤵
PID:9800
- C:\Windows\SysWOW64\Aaldccip.exe
  C:\Windows\system32\Aaldccip.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:9888

C:\Windows\SysWOW64\Ahfmpnql.exe
C:\Windows\system32\Ahfmpnql.exe
1⤵
PID:9956
- C:\Windows\SysWOW64\Akdilipp.exe
  C:\Windows\system32\Akdilipp.exe
  2⤵
  - Modifies registry class
  PID:10032
- - C:\Windows\SysWOW64\Aopemh32.exe
    C:\Windows\system32\Aopemh32.exe
    3⤵
    PID:10088

C:\Windows\SysWOW64\Aaoaic32.exe
C:\Windows\system32\Aaoaic32.exe
1⤵
PID:10140
- C:\Windows\SysWOW64\Apaadpng.exe
  C:\Windows\system32\Apaadpng.exe
  2⤵
  PID:10224
- - C:\Windows\SysWOW64\Bhhiemoj.exe
    C:\Windows\system32\Bhhiemoj.exe
    3⤵
    PID:9308
  - - C:\Windows\SysWOW64\Bmeandma.exe
      C:\Windows\system32\Bmeandma.exe
      4⤵
      Drops file in System32 directory
      PID:9428

C:\Windows\SysWOW64\Baannc32.exe
C:\Windows\system32\Baannc32.exe
1⤵
PID:9504
- C:\Windows\SysWOW64\Bdojjo32.exe
  C:\Windows\system32\Bdojjo32.exe
  2⤵
  PID:9636

C:\Windows\SysWOW64\Bgnffj32.exe
C:\Windows\system32\Bgnffj32.exe
1⤵
- Drops file in System32 directory
PID:9716
- C:\Windows\SysWOW64\Bkibgh32.exe
  C:\Windows\system32\Bkibgh32.exe
  2⤵
  PID:9808

C:\Windows\SysWOW64\Bmhocd32.exe
C:\Windows\system32\Bmhocd32.exe
1⤵
PID:9904
- C:\Windows\SysWOW64\Bpfkpp32.exe
  C:\Windows\system32\Bpfkpp32.exe
  2⤵
  PID:10008
- - C:\Windows\SysWOW64\Bhmbqm32.exe
    C:\Windows\system32\Bhmbqm32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Drops file in System32 directory
    PID:10132

C:\Windows\SysWOW64\Bgpcliao.exe
C:\Windows\system32\Bgpcliao.exe
1⤵
PID:10196
- C:\Windows\SysWOW64\Bogkmgba.exe
  C:\Windows\system32\Bogkmgba.exe
  2⤵
  PID:3976
- - C:\Windows\SysWOW64\Baegibae.exe
    C:\Windows\system32\Baegibae.exe
    3⤵
    PID:9468
  - - C:\Windows\SysWOW64\Bhpofl32.exe
      C:\Windows\system32\Bhpofl32.exe
      4⤵
      Drops file in System32 directory
      PID:3632
    - - C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        5⤵
        Modifies registry class
        
        PID:9736

C:\Windows\SysWOW64\Bpkdjofm.exe
C:\Windows\system32\Bpkdjofm.exe
1⤵
PID:3440
- C:\Windows\SysWOW64\Bhblllfo.exe
  C:\Windows\system32\Bhblllfo.exe
  2⤵
  PID:10128
- - C:\Windows\SysWOW64\Bkphhgfc.exe
    C:\Windows\system32\Bkphhgfc.exe
    3⤵
    PID:2780

C:\Windows\SysWOW64\Cpmapodj.exe
C:\Windows\system32\Cpmapodj.exe
1⤵
PID:9692
- C:\Windows\SysWOW64\Chdialdl.exe
  C:\Windows\system32\Chdialdl.exe
  2⤵
  PID:768

C:\Windows\SysWOW64\Ckbemgcp.exe
C:\Windows\system32\Ckbemgcp.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:10056
- C:\Windows\SysWOW64\Cnaaib32.exe
  C:\Windows\system32\Cnaaib32.exe
  2⤵
  PID:9500
- - C:\Windows\SysWOW64\Cponen32.exe
    C:\Windows\system32\Cponen32.exe
    3⤵
    - Drops file in System32 directory
    PID:9676

C:\Windows\SysWOW64\Chfegk32.exe
C:\Windows\system32\Chfegk32.exe
1⤵
PID:10004
- C:\Windows\SysWOW64\Ckebcg32.exe
  C:\Windows\system32\Ckebcg32.exe
  2⤵
  PID:9304
- - C:\Windows\SysWOW64\Coqncejg.exe
    C:\Windows\system32\Coqncejg.exe
    3⤵
    PID:3676
  - - C:\Windows\SysWOW64\Coegoe32.exe
      C:\Windows\system32\Coegoe32.exe
      4⤵
      PID:10112
    - - C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9588
      - C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        6⤵
        Modifies registry class
        
        PID:9260

C:\Windows\SysWOW64\Boldhf32.exe
C:\Windows\system32\Boldhf32.exe
1⤵
- Modifies registry class
PID:9444

C:\Windows\SysWOW64\Cklhcfle.exe
C:\Windows\system32\Cklhcfle.exe
1⤵
PID:10252
- C:\Windows\SysWOW64\Cnjdpaki.exe
  C:\Windows\system32\Cnjdpaki.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:10296
- - C:\Windows\SysWOW64\Dddllkbf.exe
    C:\Windows\system32\Dddllkbf.exe
    3⤵
    PID:10340
  - - C:\Windows\SysWOW64\Dojqjdbl.exe
      C:\Windows\system32\Dojqjdbl.exe
      4⤵
      Drops file in System32 directory
      PID:10384
    - - C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10424
      - C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        6⤵
        
        PID:10472

C:\Windows\SysWOW64\Ddifgk32.exe
C:\Windows\system32\Ddifgk32.exe
1⤵
PID:10512
- C:\Windows\SysWOW64\Dhdbhifj.exe
  C:\Windows\system32\Dhdbhifj.exe
  2⤵
  PID:10552

C:\Windows\SysWOW64\Dkcndeen.exe
C:\Windows\system32\Dkcndeen.exe
1⤵
PID:10588
- C:\Windows\SysWOW64\Doojec32.exe
  C:\Windows\system32\Doojec32.exe
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  PID:10632

C:\Windows\SysWOW64\Dqpfmlce.exe
C:\Windows\system32\Dqpfmlce.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:10680
- C:\Windows\SysWOW64\Ddkbmj32.exe
  C:\Windows\system32\Ddkbmj32.exe
  2⤵
  PID:10724

C:\Windows\SysWOW64\Doagjc32.exe
C:\Windows\system32\Doagjc32.exe
1⤵
PID:10804
- C:\Windows\SysWOW64\Dqbcbkab.exe
  C:\Windows\system32\Dqbcbkab.exe
  2⤵
  PID:10848
- - C:\Windows\SysWOW64\Ddnobj32.exe
    C:\Windows\system32\Ddnobj32.exe
    3⤵
    - Drops file in System32 directory
    PID:10892

C:\Windows\SysWOW64\Dglkoeio.exe
C:\Windows\system32\Dglkoeio.exe
1⤵
PID:10932
- C:\Windows\SysWOW64\Doccpcja.exe
  C:\Windows\system32\Doccpcja.exe
  2⤵
  PID:10968

C:\Windows\SysWOW64\Ebaplnie.exe
C:\Windows\system32\Ebaplnie.exe
1⤵
PID:11008
- C:\Windows\SysWOW64\Eqdpgk32.exe
  C:\Windows\system32\Eqdpgk32.exe
  2⤵
  - Drops file in System32 directory
  PID:11052

C:\Windows\SysWOW64\Ehlhih32.exe
C:\Windows\system32\Ehlhih32.exe
1⤵
- Drops file in System32 directory
PID:11096
- C:\Windows\SysWOW64\Egohdegl.exe
  C:\Windows\system32\Egohdegl.exe
  2⤵
  PID:11140

C:\Windows\SysWOW64\Eoepebho.exe
C:\Windows\system32\Eoepebho.exe
1⤵
PID:11180
- C:\Windows\SysWOW64\Enhpao32.exe
  C:\Windows\system32\Enhpao32.exe
  2⤵
  PID:11224

C:\Windows\SysWOW64\Eqgmmk32.exe
C:\Windows\system32\Eqgmmk32.exe
1⤵
PID:9604
- C:\Windows\SysWOW64\Ehndnh32.exe
  C:\Windows\system32\Ehndnh32.exe
  2⤵
  PID:10292
- - C:\Windows\SysWOW64\Eklajcmc.exe
    C:\Windows\system32\Eklajcmc.exe
    3⤵
    - Modifies registry class
    PID:10364
  - - C:\Windows\SysWOW64\Enkmfolf.exe
      C:\Windows\system32\Enkmfolf.exe
      4⤵
      PID:10432

C:\Windows\SysWOW64\Eqiibjlj.exe
C:\Windows\system32\Eqiibjlj.exe
1⤵
PID:10504
- C:\Windows\SysWOW64\Egcaod32.exe
  C:\Windows\system32\Egcaod32.exe
  2⤵
  - Modifies registry class
  PID:10576
- - C:\Windows\SysWOW64\Eojiqb32.exe
    C:\Windows\system32\Eojiqb32.exe
    3⤵
    PID:10640
  - - C:\Windows\SysWOW64\Eqlfhjig.exe
      C:\Windows\system32\Eqlfhjig.exe
      4⤵
      PID:10720

C:\Windows\SysWOW64\Ehbnigjj.exe
C:\Windows\system32\Ehbnigjj.exe
1⤵
- Modifies registry class
PID:10796
- C:\Windows\SysWOW64\Eomffaag.exe
  C:\Windows\system32\Eomffaag.exe
  2⤵
  PID:10832
- - C:\Windows\SysWOW64\Ebkbbmqj.exe
    C:\Windows\system32\Ebkbbmqj.exe
    3⤵
    PID:10924

C:\Windows\SysWOW64\Eqncnj32.exe
C:\Windows\system32\Eqncnj32.exe
1⤵
PID:10748
- C:\Windows\SysWOW64\Eiekog32.exe
  C:\Windows\system32\Eiekog32.exe
  2⤵
  - Modifies registry class
  PID:11036
- - C:\Windows\SysWOW64\Ekcgkb32.exe
    C:\Windows\system32\Ekcgkb32.exe
    3⤵
    PID:11136
  - - C:\Windows\SysWOW64\Foapaa32.exe
      C:\Windows\system32\Foapaa32.exe
      4⤵
      PID:11188

C:\Windows\SysWOW64\Fndpmndl.exe
C:\Windows\system32\Fndpmndl.exe
1⤵
- Modifies registry class
PID:11236
- C:\Windows\SysWOW64\Fqbliicp.exe
  C:\Windows\system32\Fqbliicp.exe
  2⤵
  PID:10244

C:\Windows\SysWOW64\Fdnhih32.exe
C:\Windows\system32\Fdnhih32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:10376
- C:\Windows\SysWOW64\Fgmdec32.exe
  C:\Windows\system32\Fgmdec32.exe
  2⤵
  - Modifies registry class
  PID:10492

C:\Windows\SysWOW64\Foclgq32.exe
C:\Windows\system32\Foclgq32.exe
1⤵
PID:10620
- C:\Windows\SysWOW64\Fnfmbmbi.exe
  C:\Windows\system32\Fnfmbmbi.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Modifies registry class
  PID:4520
- - C:\Windows\SysWOW64\Feqeog32.exe
    C:\Windows\system32\Feqeog32.exe
    3⤵
    PID:10840
  - - C:\Windows\SysWOW64\Fgoakc32.exe
      C:\Windows\system32\Fgoakc32.exe
      4⤵
      PID:10964

C:\Windows\SysWOW64\Fofilp32.exe
C:\Windows\system32\Fofilp32.exe
1⤵
PID:11040
- C:\Windows\SysWOW64\Fniihmpf.exe
  C:\Windows\system32\Fniihmpf.exe
  2⤵
  PID:11148
- - C:\Windows\SysWOW64\Fecadghc.exe
    C:\Windows\system32\Fecadghc.exe
    3⤵
    PID:11232

C:\Windows\SysWOW64\Fganqbgg.exe
C:\Windows\system32\Fganqbgg.exe
1⤵
PID:10268
- C:\Windows\SysWOW64\Fohfbpgi.exe
  C:\Windows\system32\Fohfbpgi.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:1972

C:\Windows\SysWOW64\Fnkfmm32.exe
C:\Windows\system32\Fnkfmm32.exe
1⤵
PID:10688
- C:\Windows\SysWOW64\Fajbjh32.exe
  C:\Windows\system32\Fajbjh32.exe
  2⤵
  PID:10816
- - C:\Windows\SysWOW64\Fiqjke32.exe
    C:\Windows\system32\Fiqjke32.exe
    3⤵
    PID:11032

C:\Windows\SysWOW64\Fkofga32.exe
C:\Windows\system32\Fkofga32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11172
- C:\Windows\SysWOW64\Gokbgpeg.exe
  C:\Windows\system32\Gokbgpeg.exe
  2⤵
  PID:10356

C:\Windows\SysWOW64\Gbiockdj.exe
C:\Windows\system32\Gbiockdj.exe
1⤵
PID:10600
- C:\Windows\SysWOW64\Galoohke.exe
  C:\Windows\system32\Galoohke.exe
  2⤵
  PID:11104

C:\Windows\SysWOW64\Gpmomo32.exe
C:\Windows\system32\Gpmomo32.exe
1⤵
PID:10788
- C:\Windows\SysWOW64\Gnpphljo.exe
  C:\Windows\system32\Gnpphljo.exe
  2⤵
  PID:11208

C:\Windows\SysWOW64\Ganldgib.exe
C:\Windows\system32\Ganldgib.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:10532
- C:\Windows\SysWOW64\Giecfejd.exe
  C:\Windows\system32\Giecfejd.exe
  2⤵
  PID:11164

C:\Windows\SysWOW64\Gghdaa32.exe
C:\Windows\system32\Gghdaa32.exe
1⤵
PID:10792
- C:\Windows\SysWOW64\Gnblnlhl.exe
  C:\Windows\system32\Gnblnlhl.exe
  2⤵
  PID:1144
- - C:\Windows\SysWOW64\Gbnhoj32.exe
    C:\Windows\system32\Gbnhoj32.exe
    3⤵
    PID:11280

C:\Windows\SysWOW64\Geldkfpi.exe
C:\Windows\system32\Geldkfpi.exe
1⤵
PID:11328
- C:\Windows\SysWOW64\Glfmgp32.exe
  C:\Windows\system32\Glfmgp32.exe
  2⤵
  - Modifies registry class
  PID:11372

C:\Windows\SysWOW64\Gacepg32.exe
C:\Windows\system32\Gacepg32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11492
- C:\Windows\SysWOW64\Gijmad32.exe
  C:\Windows\system32\Gijmad32.exe
  2⤵
  PID:11536
- - C:\Windows\SysWOW64\Gpdennml.exe
    C:\Windows\system32\Gpdennml.exe
    3⤵
    PID:11576
  - - C:\Windows\SysWOW64\Gaebef32.exe
      C:\Windows\system32\Gaebef32.exe
      4⤵
      PID:11616
    - - C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        5⤵
        
        PID:11660

C:\Windows\SysWOW64\Hlkfbocp.exe
C:\Windows\system32\Hlkfbocp.exe
1⤵
PID:11704
- C:\Windows\SysWOW64\Hnibokbd.exe
  C:\Windows\system32\Hnibokbd.exe
  2⤵
  PID:11748
- - C:\Windows\SysWOW64\Hecjke32.exe
    C:\Windows\system32\Hecjke32.exe
    3⤵
    PID:11792
  - - C:\Windows\SysWOW64\Hioflcbj.exe
      C:\Windows\system32\Hioflcbj.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:11832

C:\Windows\SysWOW64\Hpioin32.exe
C:\Windows\system32\Hpioin32.exe
1⤵
PID:11864
- C:\Windows\SysWOW64\Hbgkei32.exe
  C:\Windows\system32\Hbgkei32.exe
  2⤵
  PID:11912
- - C:\Windows\SysWOW64\Hiacacpg.exe
    C:\Windows\system32\Hiacacpg.exe
    3⤵
    PID:11952

C:\Windows\SysWOW64\Hlppno32.exe
C:\Windows\system32\Hlppno32.exe
1⤵
PID:12000
- C:\Windows\SysWOW64\Hnnljj32.exe
  C:\Windows\system32\Hnnljj32.exe
  2⤵
  PID:12048

C:\Windows\SysWOW64\Halhfe32.exe
C:\Windows\system32\Halhfe32.exe
1⤵
- Drops file in System32 directory
PID:12088
- C:\Windows\SysWOW64\Hehdfdek.exe
  C:\Windows\system32\Hehdfdek.exe
  2⤵
  PID:12128

C:\Windows\SysWOW64\Hhfpbpdo.exe
C:\Windows\system32\Hhfpbpdo.exe
1⤵
PID:12172
- C:\Windows\SysWOW64\Hpmhdmea.exe
  C:\Windows\system32\Hpmhdmea.exe
  2⤵
  - Drops file in System32 directory
  PID:12216
- - C:\Windows\SysWOW64\Hnphoj32.exe
    C:\Windows\system32\Hnphoj32.exe
    3⤵
    PID:12252

C:\Windows\SysWOW64\Haodle32.exe
C:\Windows\system32\Haodle32.exe
1⤵
PID:10336
- C:\Windows\SysWOW64\Hifmmb32.exe
  C:\Windows\system32\Hifmmb32.exe
  2⤵
  - Drops file in System32 directory
  PID:11336
- - C:\Windows\SysWOW64\Hldiinke.exe
    C:\Windows\system32\Hldiinke.exe
    3⤵
    PID:11408

C:\Windows\SysWOW64\Hbnaeh32.exe
C:\Windows\system32\Hbnaeh32.exe
1⤵
- Drops file in System32 directory
PID:11488
- C:\Windows\SysWOW64\Hemmac32.exe
  C:\Windows\system32\Hemmac32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  PID:11564
- - C:\Windows\SysWOW64\Ihkjno32.exe
    C:\Windows\system32\Ihkjno32.exe
    3⤵
    - Modifies registry class
    PID:11396

C:\Windows\SysWOW64\Ibqnkh32.exe
C:\Windows\system32\Ibqnkh32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11560
- C:\Windows\SysWOW64\Iijfhbhl.exe
  C:\Windows\system32\Iijfhbhl.exe
  2⤵
  PID:11828
- - C:\Windows\SysWOW64\Ihmfco32.exe
    C:\Windows\system32\Ihmfco32.exe
    3⤵
    PID:11872

C:\Windows\SysWOW64\Ibcjqgnm.exe
C:\Windows\system32\Ibcjqgnm.exe
1⤵
PID:11992
- C:\Windows\SysWOW64\Iafkld32.exe
  C:\Windows\system32\Iafkld32.exe
  2⤵
  PID:12036

C:\Windows\SysWOW64\Iahgad32.exe
C:\Windows\system32\Iahgad32.exe
1⤵
PID:12264
- C:\Windows\SysWOW64\Ieccbbkn.exe
  C:\Windows\system32\Ieccbbkn.exe
  2⤵
  PID:11316

C:\Windows\SysWOW64\Ihbponja.exe
C:\Windows\system32\Ihbponja.exe
1⤵
PID:11432
- C:\Windows\SysWOW64\Ilnlom32.exe
  C:\Windows\system32\Ilnlom32.exe
  2⤵
  PID:11528

C:\Windows\SysWOW64\Ibgdlg32.exe
C:\Windows\system32\Ibgdlg32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:440
- C:\Windows\SysWOW64\Iajdgcab.exe
  C:\Windows\system32\Iajdgcab.exe
  2⤵
  PID:11740
- - C:\Windows\SysWOW64\Iialhaad.exe
    C:\Windows\system32\Iialhaad.exe
    3⤵
    PID:11820

C:\Windows\SysWOW64\Ihdldn32.exe
C:\Windows\system32\Ihdldn32.exe
1⤵
- Executes dropped EXE
PID:2928
- C:\Windows\SysWOW64\Ipkdek32.exe
  C:\Windows\system32\Ipkdek32.exe
  2⤵
  PID:11944

C:\Windows\SysWOW64\Ibjqaf32.exe
C:\Windows\system32\Ibjqaf32.exe
1⤵
PID:12044
- C:\Windows\SysWOW64\Iehmmb32.exe
  C:\Windows\system32\Iehmmb32.exe
  2⤵
  PID:12136

C:\Windows\SysWOW64\Jhgiim32.exe
C:\Windows\system32\Jhgiim32.exe
1⤵
- Executes dropped EXE
PID:3220
- C:\Windows\SysWOW64\Jpnakk32.exe
  C:\Windows\system32\Jpnakk32.exe
  2⤵
  PID:12268

C:\Windows\SysWOW64\Jblmgf32.exe
C:\Windows\system32\Jblmgf32.exe
1⤵
PID:11380
- C:\Windows\SysWOW64\Jekjcaef.exe
  C:\Windows\system32\Jekjcaef.exe
  2⤵
  PID:11604
- - C:\Windows\SysWOW64\Jifecp32.exe
    C:\Windows\system32\Jifecp32.exe
    3⤵
    PID:11712

C:\Windows\SysWOW64\Jldbpl32.exe
C:\Windows\system32\Jldbpl32.exe
1⤵
PID:4008
- C:\Windows\SysWOW64\Jocnlg32.exe
  C:\Windows\system32\Jocnlg32.exe
  2⤵
  PID:11968
- - C:\Windows\SysWOW64\Jaajhb32.exe
    C:\Windows\system32\Jaajhb32.exe
    3⤵
    PID:2104

C:\Windows\SysWOW64\Jemfhacc.exe
C:\Windows\system32\Jemfhacc.exe
1⤵
PID:12108
- C:\Windows\SysWOW64\Jhkbdmbg.exe
  C:\Windows\system32\Jhkbdmbg.exe
  2⤵
  PID:11392

C:\Windows\SysWOW64\Jlgoek32.exe
C:\Windows\system32\Jlgoek32.exe
1⤵
PID:11544
- C:\Windows\SysWOW64\Jbagbebm.exe
  C:\Windows\system32\Jbagbebm.exe
  2⤵
  PID:5116
- - C:\Windows\SysWOW64\Jikoopij.exe
    C:\Windows\system32\Jikoopij.exe
    3⤵
    - Executes dropped EXE
    PID:4312
  - - C:\Windows\SysWOW64\Jlikkkhn.exe
      C:\Windows\system32\Jlikkkhn.exe
      4⤵
      PID:12040

C:\Windows\SysWOW64\Johggfha.exe
C:\Windows\system32\Johggfha.exe
1⤵
PID:12236
- C:\Windows\SysWOW64\Jbccge32.exe
  C:\Windows\system32\Jbccge32.exe
  2⤵
  PID:11516

C:\Windows\SysWOW64\Jeapcq32.exe
C:\Windows\system32\Jeapcq32.exe
1⤵
PID:3964
- C:\Windows\SysWOW64\Jimldogg.exe
  C:\Windows\system32\Jimldogg.exe
  2⤵
  PID:2900
- - C:\Windows\SysWOW64\Jllhpkfk.exe
    C:\Windows\system32\Jllhpkfk.exe
    3⤵
    PID:5096

C:\Windows\SysWOW64\Jbepme32.exe
C:\Windows\system32\Jbepme32.exe
1⤵
PID:11908
- C:\Windows\SysWOW64\Kedlip32.exe
  C:\Windows\system32\Kedlip32.exe
  2⤵
  PID:12244
- - C:\Windows\SysWOW64\Khbiello.exe
    C:\Windows\system32\Khbiello.exe
    3⤵
    PID:2700

C:\Windows\SysWOW64\Kefiopki.exe
C:\Windows\system32\Kefiopki.exe
1⤵
PID:11760
- C:\Windows\SysWOW64\Kheekkjl.exe
  C:\Windows\system32\Kheekkjl.exe
  2⤵
  PID:12284

C:\Windows\SysWOW64\Kplmliko.exe
C:\Windows\system32\Kplmliko.exe
1⤵
PID:4972
- C:\Windows\SysWOW64\Koonge32.exe
  C:\Windows\system32\Koonge32.exe
  2⤵
  PID:3924

C:\Windows\SysWOW64\Kcjjhdjb.exe
C:\Windows\system32\Kcjjhdjb.exe
1⤵
PID:2264
- C:\Windows\SysWOW64\Keifdpif.exe
  C:\Windows\system32\Keifdpif.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  PID:1592

C:\Windows\SysWOW64\Kpnjah32.exe
C:\Windows\system32\Kpnjah32.exe
1⤵
PID:3652
- C:\Windows\SysWOW64\Kcmfnd32.exe
  C:\Windows\system32\Kcmfnd32.exe
  2⤵
  PID:12332

C:\Windows\SysWOW64\Khiofk32.exe
C:\Windows\system32\Khiofk32.exe
1⤵
PID:12424
- C:\Windows\SysWOW64\Klekfinp.exe
  C:\Windows\system32\Klekfinp.exe
  2⤵
  PID:12464

C:\Windows\SysWOW64\Kcapicdj.exe
C:\Windows\system32\Kcapicdj.exe
1⤵
PID:12720
- C:\Windows\SysWOW64\Lepleocn.exe
  C:\Windows\system32\Lepleocn.exe
  2⤵
  PID:12764

C:\Windows\SysWOW64\Lljdai32.exe
C:\Windows\system32\Lljdai32.exe
1⤵
PID:12804
- C:\Windows\SysWOW64\Lohqnd32.exe
  C:\Windows\system32\Lohqnd32.exe
  2⤵
  PID:12848

C:\Windows\SysWOW64\Lindkm32.exe
C:\Windows\system32\Lindkm32.exe
1⤵
PID:12924
- C:\Windows\SysWOW64\Lhqefjpo.exe
  C:\Windows\system32\Lhqefjpo.exe
  2⤵
  PID:12960

C:\Windows\SysWOW64\Lpgmhg32.exe
C:\Windows\system32\Lpgmhg32.exe
1⤵
PID:12996
- C:\Windows\SysWOW64\Lojmcdgl.exe
  C:\Windows\system32\Lojmcdgl.exe
  2⤵
  PID:13032

C:\Windows\SysWOW64\Laiipofp.exe
C:\Windows\system32\Laiipofp.exe
1⤵
PID:13068
- C:\Windows\SysWOW64\Ljpaqmgb.exe
  C:\Windows\system32\Ljpaqmgb.exe
  2⤵
  PID:13104
- - C:\Windows\SysWOW64\Llnnmhfe.exe
    C:\Windows\system32\Llnnmhfe.exe
    3⤵
    PID:13140
  - - C:\Windows\SysWOW64\Lomjicei.exe
      C:\Windows\system32\Lomjicei.exe
      4⤵
      PID:13176

C:\Windows\SysWOW64\Legben32.exe
C:\Windows\system32\Legben32.exe
1⤵
PID:13212
- C:\Windows\SysWOW64\Lhenai32.exe
  C:\Windows\system32\Lhenai32.exe
  2⤵
  PID:13248
- - C:\Windows\SysWOW64\Llqjbhdc.exe
    C:\Windows\system32\Llqjbhdc.exe
    3⤵
    PID:13284
  - - C:\Windows\SysWOW64\Lckboblp.exe
      C:\Windows\system32\Lckboblp.exe
      4⤵
      PID:4072

C:\Windows\SysWOW64\Lfiokmkc.exe
C:\Windows\system32\Lfiokmkc.exe
1⤵
PID:12312
- C:\Windows\SysWOW64\Lhgkgijg.exe
  C:\Windows\system32\Lhgkgijg.exe
  2⤵
  PID:12356
- - C:\Windows\SysWOW64\Lpochfji.exe
    C:\Windows\system32\Lpochfji.exe
    3⤵
    PID:12420

C:\Windows\SysWOW64\Loacdc32.exe
C:\Windows\system32\Loacdc32.exe
1⤵
- Executes dropped EXE
PID:2648
- C:\Windows\SysWOW64\Mfkkqmiq.exe
  C:\Windows\system32\Mfkkqmiq.exe
  2⤵
  PID:12504
- - C:\Windows\SysWOW64\Mjggal32.exe
    C:\Windows\system32\Mjggal32.exe
    3⤵
    PID:12556
  - - C:\Windows\SysWOW64\Mpapnfhg.exe
      C:\Windows\system32\Mpapnfhg.exe
      4⤵
      PID:12576
    - - C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        5⤵
        
        PID:12644
      - C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        6⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1812

C:\Windows\SysWOW64\Nmaciefp.exe
C:\Windows\system32\Nmaciefp.exe
1⤵
PID:12992

C:\Windows\SysWOW64\Nckkfp32.exe
C:\Windows\system32\Nckkfp32.exe
1⤵
PID:13132
- C:\Windows\SysWOW64\Nfihbk32.exe
  C:\Windows\system32\Nfihbk32.exe
  2⤵
  PID:13220

C:\Windows\SysWOW64\Nfldgk32.exe
C:\Windows\system32\Nfldgk32.exe
1⤵
PID:12540
- C:\Windows\SysWOW64\Nijqcf32.exe
  C:\Windows\system32\Nijqcf32.exe
  2⤵
  PID:2052

C:\Windows\SysWOW64\Nmfmde32.exe
C:\Windows\system32\Nmfmde32.exe
1⤵
PID:12660
- C:\Windows\SysWOW64\Nodiqp32.exe
  C:\Windows\system32\Nodiqp32.exe
  2⤵
  PID:4544

C:\Windows\SysWOW64\Nbbeml32.exe
C:\Windows\system32\Nbbeml32.exe
1⤵
PID:12820
- C:\Windows\SysWOW64\Nfnamjhk.exe
  C:\Windows\system32\Nfnamjhk.exe
  2⤵
  PID:2380

C:\Windows\SysWOW64\Nqcejcha.exe
C:\Windows\system32\Nqcejcha.exe
1⤵
PID:12912
- C:\Windows\SysWOW64\Nbebbk32.exe
  C:\Windows\system32\Nbebbk32.exe
  2⤵
  PID:12948

C:\Windows\SysWOW64\Nmjfodne.exe
C:\Windows\system32\Nmjfodne.exe
1⤵
PID:13268
- C:\Windows\SysWOW64\Ooibkpmi.exe
  C:\Windows\system32\Ooibkpmi.exe
  2⤵
  PID:12320
- - C:\Windows\SysWOW64\Ocdnln32.exe
    C:\Windows\system32\Ocdnln32.exe
    3⤵
    PID:536
  - - C:\Windows\SysWOW64\Objkmkjj.exe
      C:\Windows\system32\Objkmkjj.exe
      4⤵
      PID:5348

C:\Windows\SysWOW64\Ocihgnam.exe
C:\Windows\system32\Ocihgnam.exe
1⤵
- Executes dropped EXE
PID:1076
- C:\Windows\SysWOW64\Ofgdcipq.exe
  C:\Windows\system32\Ofgdcipq.exe
  2⤵
  PID:12896

C:\Windows\SysWOW64\Oifppdpd.exe
C:\Windows\system32\Oifppdpd.exe
1⤵
PID:13060
- C:\Windows\SysWOW64\Omalpc32.exe
  C:\Windows\system32\Omalpc32.exe
  2⤵
  PID:13196

C:\Windows\SysWOW64\Obnehj32.exe
C:\Windows\system32\Obnehj32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5136
- C:\Windows\SysWOW64\Ojemig32.exe
  C:\Windows\system32\Ojemig32.exe
  2⤵
  PID:5176

C:\Windows\SysWOW64\Pbcncibp.exe
C:\Windows\system32\Pbcncibp.exe
1⤵
PID:6128
- C:\Windows\SysWOW64\Pfojdh32.exe
  C:\Windows\system32\Pfojdh32.exe
  2⤵
  PID:5700

C:\Windows\SysWOW64\Pbekii32.exe
C:\Windows\system32\Pbekii32.exe
1⤵
PID:5912
- C:\Windows\SysWOW64\Pjlcjf32.exe
  C:\Windows\system32\Pjlcjf32.exe
  2⤵
  PID:12860

C:\Windows\SysWOW64\Pmkofa32.exe
C:\Windows\system32\Pmkofa32.exe
1⤵
PID:5148
- C:\Windows\SysWOW64\Ppikbm32.exe
  C:\Windows\system32\Ppikbm32.exe
  2⤵
  PID:5740

C:\Windows\SysWOW64\Pfepdg32.exe
C:\Windows\system32\Pfepdg32.exe
1⤵
PID:2968
- C:\Windows\SysWOW64\Pidlqb32.exe
  C:\Windows\system32\Pidlqb32.exe
  2⤵
  - Modifies registry class
  PID:5416
- - C:\Windows\SysWOW64\Pmphaaln.exe
    C:\Windows\system32\Pmphaaln.exe
    3⤵
    PID:5768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5976 -ip 5976
1⤵
PID:12416

C:\Windows\SysWOW64\Ppnenlka.exe
C:\Windows\system32\Ppnenlka.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1520

C:\Windows\SysWOW64\Pmmlla32.exe
C:\Windows\system32\Pmmlla32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5336

C:\Windows\SysWOW64\Piapkbeg.exe
C:\Windows\system32\Piapkbeg.exe
1⤵
PID:5352

C:\Windows\SysWOW64\Pfccogfc.exe
C:\Windows\system32\Pfccogfc.exe
1⤵
PID:12412

C:\Windows\SysWOW64\Pcegclgp.exe
C:\Windows\system32\Pcegclgp.exe
1⤵
PID:5780

C:\Windows\SysWOW64\Pcbkml32.exe
C:\Windows\system32\Pcbkml32.exe
1⤵
PID:5300

C:\Windows\SysWOW64\Padnaq32.exe
C:\Windows\system32\Padnaq32.exe
1⤵
PID:12732

C:\Windows\SysWOW64\Pimfpc32.exe
C:\Windows\system32\Pimfpc32.exe
1⤵
PID:5180

C:\Windows\SysWOW64\Ppdbgncl.exe
C:\Windows\system32\Ppdbgncl.exe
1⤵
PID:13096

C:\Windows\SysWOW64\Omfekbdh.exe
C:\Windows\system32\Omfekbdh.exe
1⤵
PID:13024

C:\Windows\SysWOW64\Ojhiogdd.exe
C:\Windows\system32\Ojhiogdd.exe
1⤵
PID:5512

C:\Windows\SysWOW64\Opbean32.exe
C:\Windows\system32\Opbean32.exe
1⤵
- Drops file in System32 directory
PID:5296

C:\Windows\SysWOW64\Oqmhqapg.exe
C:\Windows\system32\Oqmhqapg.exe
1⤵
PID:2208

C:\Windows\SysWOW64\Oiccje32.exe
C:\Windows\system32\Oiccje32.exe
1⤵
- Modifies registry class
PID:2024

C:\Windows\SysWOW64\Ofegni32.exe
C:\Windows\system32\Ofegni32.exe
1⤵
PID:5392

C:\Windows\SysWOW64\Niojoeel.exe
C:\Windows\system32\Niojoeel.exe
1⤵
PID:13172

C:\Windows\SysWOW64\Nfqnbjfi.exe
C:\Windows\system32\Nfqnbjfi.exe
1⤵
PID:13124

C:\Windows\SysWOW64\Noblkqca.exe
C:\Windows\system32\Noblkqca.exe
1⤵
PID:12452

C:\Windows\SysWOW64\Nqoloc32.exe
C:\Windows\system32\Nqoloc32.exe
1⤵
PID:2856

C:\Windows\SysWOW64\Nhhdnf32.exe
C:\Windows\system32\Nhhdnf32.exe
1⤵
PID:13292

C:\Windows\SysWOW64\Noppeaed.exe
C:\Windows\system32\Noppeaed.exe
1⤵
PID:13076

C:\Windows\SysWOW64\Lafmjp32.exe
C:\Windows\system32\Lafmjp32.exe
1⤵
PID:12888

C:\Windows\SysWOW64\Kofdhd32.exe
C:\Windows\system32\Kofdhd32.exe
1⤵
PID:12676

C:\Windows\SysWOW64\Klggli32.exe
C:\Windows\system32\Klggli32.exe
1⤵
PID:12628

C:\Windows\SysWOW64\Kiikpnmj.exe
C:\Windows\system32\Kiikpnmj.exe
1⤵
PID:12588

C:\Windows\SysWOW64\Kemooo32.exe
C:\Windows\system32\Kemooo32.exe
1⤵
PID:12544

C:\Windows\SysWOW64\Kcoccc32.exe
C:\Windows\system32\Kcoccc32.exe
1⤵
PID:12508

C:\Windows\SysWOW64\Kekbjo32.exe
C:\Windows\system32\Kekbjo32.exe
1⤵
PID:12380

C:\Windows\SysWOW64\Kolabf32.exe
C:\Windows\system32\Kolabf32.exe
1⤵
PID:3896

C:\Windows\SysWOW64\Klndfj32.exe
C:\Windows\system32\Klndfj32.exe
1⤵
PID:2212

C:\Windows\SysWOW64\Jojdlfeo.exe
C:\Windows\system32\Jojdlfeo.exe
1⤵
PID:11404

C:\Windows\SysWOW64\Iojkeh32.exe
C:\Windows\system32\Iojkeh32.exe
1⤵
PID:12200

C:\Windows\SysWOW64\Ilkoim32.exe
C:\Windows\system32\Ilkoim32.exe
1⤵
PID:12152

C:\Windows\SysWOW64\Iimcma32.exe
C:\Windows\system32\Iimcma32.exe
1⤵
PID:4212

C:\Windows\SysWOW64\Ipdndloi.exe
C:\Windows\system32\Ipdndloi.exe
1⤵
PID:4336

C:\Windows\SysWOW64\Inebjihf.exe
C:\Windows\system32\Inebjihf.exe
1⤵
PID:11688

C:\Windows\SysWOW64\Gbpedjnb.exe
C:\Windows\system32\Gbpedjnb.exe
1⤵
- Modifies registry class
PID:11448

C:\Windows\SysWOW64\Gpaihooo.exe
C:\Windows\system32\Gpaihooo.exe
1⤵
PID:11412

C:\Windows\SysWOW64\Ggfglb32.exe
C:\Windows\system32\Ggfglb32.exe
1⤵
- Drops file in System32 directory
PID:10348

C:\Windows\SysWOW64\Gicgpelg.exe
C:\Windows\system32\Gicgpelg.exe
1⤵
- Drops file in System32 directory
PID:11160

C:\Windows\SysWOW64\Dgjoif32.exe
C:\Windows\system32\Dgjoif32.exe
1⤵
PID:10764

C:\Windows\SysWOW64\Bnlhncgi.exe
C:\Windows\system32\Bnlhncgi.exe
1⤵
PID:9840

C:\Windows\SysWOW64\Pnplfj32.exe
C:\Windows\system32\Pnplfj32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:9560

C:\Windows\SysWOW64\Gehbjm32.exe
C:\Windows\system32\Gehbjm32.exe
1⤵
PID:7192

C:\Windows\SysWOW64\Dnmhpg32.exe
C:\Windows\system32\Dnmhpg32.exe
1⤵
PID:6752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaldccip.exe

Filesize
80KB

MD5
9693725f4e456da4e757323aa537f8ad

SHA1
e3f44ae0b563a6c6ae079854156910b3d914f9d5

SHA256
a9992d6c756c580d7bd1872c73dab8761efda0c3bc1b15dccd2647b417fd11e5

SHA512
df31df29ff1ba0ec347dead4da5e8834232e39785542582728329a632c3a484e4768fcd9e9162322727d45b5b0176228ca8662821bb94af9654c0a3bf357e276

Download Submit
C:\Windows\SysWOW64\Aflaie32.exe

Filesize
80KB

MD5
b1403087dd271efe542566fbc4257133

SHA1
61d4578069ebe0781613c8662af299906558c90a

SHA256
22069790628c87ca6defa7d5737787f297e68897c86d8314c76f9690ac989a5e

SHA512
f1228e6021ec942757e5ead7851a802624fc6e9ba853c4c1b0b42a44707c611f157d5b0e2047b54a82edd9e980ac64abdd1b555c1860f74726f19459f8421a49

Download Submit
C:\Windows\SysWOW64\Afnnnd32.exe

Filesize
80KB

MD5
8effa63c6df924b9de8b62fb7d94be76

SHA1
35c715356bda4fb0261075ce0343441d5bab41e4

SHA256
b482f7f1d86d2b81b8642a1608bbb89acb5c7b7e54452c2a07dff4aa50de7bb7

SHA512
a43404727ea122d56ca89fdf413d1345855f9b08e1dde3271ad2a6145eb2896867b2fdf5abc08fa4f5e8b9a438ab7358b76b7dbeb5bb4f149e4dbe7a4b15f2c4

Download Submit
C:\Windows\SysWOW64\Amjbbfgo.exe

Filesize
80KB

MD5
d12d387bef9ca3a1a934fbf14533cfe2

SHA1
320be3553262991c7caa9a3cee19e5c038025eea

SHA256
11e6cdeb4fdc92700180025997bbcdb8a8e5703e5c1cb330a941742f589dd1e1

SHA512
83e4ef6ba6e6f0d8dcd6deacdebf948ec342b9d7e7061c150e281299a7e16d0ee92ddfa0062f220f6a2401862465df883bbcbba542945477e6fa41cec77dc38d

Download Submit
C:\Windows\SysWOW64\Aobilkcl.exe

Filesize
80KB

MD5
59df43b136cf2bad980520752b787314

SHA1
a46fa645f0adf84370962713c9c8bc2d2525f7e2

SHA256
8af195cff8cdb5dfbf160ada7b566ce4eba3c4dd98cf1de7897e942528cfdbb5

SHA512
4363f5ccf1f1e1f06240e5efd8a07634c0205d18d8737024f707d61365dca35a846593e2db2c637bcd9cec69ba15cc700fba485f2ec53bcdb9510e16d7aa7be3

Download Submit
C:\Windows\SysWOW64\Aodfajaj.exe

Filesize
80KB

MD5
759e5f5195285cbb782d9f25731e4a35

SHA1
479a8aba966d42dbcbad2ef874cbd4c7f634c4ab

SHA256
070912b4da89d504bf56a4160b751389e16900a57308f5c309e17e005991e3bd

SHA512
41ff89b2c950d4b9176eb33fee9b92afaf84460a8ce992418b567003bbe0964d0d7e3e0c8e80c966aa3f51865ad7d2fecde3457d60f4e0088f392113279f811a

Download Submit
C:\Windows\SysWOW64\Bhpofl32.exe

Filesize
80KB

MD5
9075cd651251e6a1a95c56dfc69ffde1

SHA1
62cf9a10f6f65e4523c9b77e2813ef1cdc3758a9

SHA256
eeea9284b63ca72c315b5e706ba454092be6d7b9b7ebf4ac4e37904b6d471086

SHA512
f215da795385607795c1d151aa1bbfb2a9038475bdea2dd5cc4e0ee2952ad49e2339a399619f0efea82da104b92a20d194e2a92b6825e2eab82d04464d07e1d2

Download Submit
C:\Windows\SysWOW64\Biadeoce.exe

Filesize
80KB

MD5
b63772a87d4805340ad753cea1efbac7

SHA1
5b3eb0444d9b27d3e6487d17c930c1bcc5827c87

SHA256
b3b91dae6623457c57b77c2be4902f22d652b12939e930fda49b13dfef9297f8

SHA512
fe62322221802493d2ddd5c639776c22d4334a33d8e173796e0112136ef9469131f16a3f59698da598ca44bb8e98760cf70f4d4741a58e46bd3c38cdfb666eaf

Download Submit
C:\Windows\SysWOW64\Boldhf32.exe

Filesize
80KB

MD5
5bca32af84c32a2b315f68f0150e9197

SHA1
38b14886d73d3435539b945a35fc345ab2ccea7b

SHA256
e716f3fdb980102fa94131df3b330f893ee927cd36865e0bd3987dd2fd067541

SHA512
66a7683d8559f1bb445093d2a8f31607d960cc0b6e358d289dc3e447ecfa563ed7695691ab22f4a4729776fd6e2172deb2fc9636546b42644568e7ced70d136f

Download Submit
C:\Windows\SysWOW64\Bqfoamfj.exe

Filesize
80KB

MD5
1a609f2f6d972cb6af04115221855776

SHA1
ecfdf54d81a9163854c3c949c1cd325649fbaba2

SHA256
2c8528ae676bc4c66094d7dfcb264eb525463a42548e0d7a012c9ee97b33e06a

SHA512
38cc21703311eeca285e035cb4a113c4ddfef32d53d5f8723374f0fcbd3c8dacb3f46d4fc890642eefb23c2a5f309cb838ae36533592843647a076f3cc33915f

Download Submit
C:\Windows\SysWOW64\Coqncejg.exe

Filesize
80KB

MD5
9a02562208b91a6dbc1354c520a886c8

SHA1
0ec2f609fa763ef74380e182d22c9bfdc5150a01

SHA256
2b0a36e6a66abe7175ac720f42111798be28544630c1a5ff74aabd90bcd385c8

SHA512
24973d61eb9dbe24968df19d8b97305027a1e3708b17c67297e50488e1b0347636ec877aa3ede169f089e2f8b4fcfbf66d5a3e5d8f41613a2f6140d1c54947b5

Download Submit
C:\Windows\SysWOW64\Dglkoeio.exe

Filesize
80KB

MD5
3204387b93bbda8f7a56a5cec766f3cc

SHA1
4d73a19b1d485bf4cbfbf6f0c82b7692ad17558d

SHA256
90ba579baa9c2ce77110c78434127bd8c3c5ddfd034123bec7551ccec49d5ca5

SHA512
01f51d84067c06ab93ad42734ffb79305378303a1522f72e096465960f875c1d3c59380e65acb5dc75bd07afafd3ca6823bb522077cf7b21a0a0f516cea25e3e

Download Submit
C:\Windows\SysWOW64\Doaneiop.exe

Filesize
20KB

MD5
55de9a70651b0f42eebd85e52f2d2b79

SHA1
fdb2c1639a501103a90a086c38bec140b5110c15

SHA256
8b7b152a9e85c5b98563cb3a05fb9b12ec2e9fe5395d6edfafe535c14a185506

SHA512
b9c43ab0328cd6f5d1a125addec341db4717b5d22b2cd6fddd0cd88439d2eaba6cfbb5cf6359b14eb20cbde749af0083effdaec26098c92474bb82aa71b41803

Download Submit
C:\Windows\SysWOW64\Ekcgkb32.exe

Filesize
80KB

MD5
bb08ac3dddb8336be6fc6ab02160ee0f

SHA1
ac782c15fc38e29546600464b16d7c9a55be6c2d

SHA256
97fb0f8ad69ff709711fed98c91c788375c49af20631480317d4d3b3644d416a

SHA512
75b6b77d33e2373d52fda1c6029a57da82b68fd40dcd70809166b574df279cc2bd5697deb920e7b68a4d0d881d5c6ffd5e3d496b3fb76c374fe058907a8bc90b

Download Submit
C:\Windows\SysWOW64\Eojiqb32.exe

Filesize
80KB

MD5
72c61ec681db437ba4f53e944c15782b

SHA1
c1d88b0d289e1fffa8d5e2a90ceb673fc258b0ac

SHA256
5eb97d376d8f9232c16d65f6ed2f8f29fc7d7da8441650a426fe53583677ba6b

SHA512
1b3acce1381facb44b5e9a4b1da0d5ce2f228ad3fa6cf9e5998e5b9468a8d34495a605c45a14c82a2e84fda995e52ce40c7e88d884fe35d6c373c2304d7901dc

Download Submit
C:\Windows\SysWOW64\Fajbjh32.exe

Filesize
80KB

MD5
f89728c7b691bd852cfdff91bd4b18d0

SHA1
c00b8b0629339c847552ee7dfb0ee8f25357d9e8

SHA256
86f7b7079b68f591446c5f23548d0d8859c2f53c4956b1de40fc82c0337109b4

SHA512
15bd82b42fab7e922831f61bdad579a42a0e7344911b8d52e6bc4b505df92d7d1b7877024c9f7e84bcecef5573b404b1f0c5b0772ca04156259fa5405e0c90b8

Download Submit
C:\Windows\SysWOW64\Fecadghc.exe

Filesize
80KB

MD5
5fcd5552f9b3da074d3eed7d7cb24b5e

SHA1
66806759179f22c80c052dabcfd29ec9d5669871

SHA256
875c38ce95d13bd9172917d15d9bde832f4113d4fee100d7f18d036d0ae1f1b3

SHA512
a2ab8e674dc6e15cc21f6a3f585df8e5495eb5d488a4db2e0d2ee31a966ea8b03421bcdb329ad47836a388847d06c42bbc2311c2c4ee0f34ad353672913e6bda

Download Submit
C:\Windows\SysWOW64\Fnfmbmbi.exe

Filesize
80KB

MD5
47968549616bcfcc4031c22d2b48b52e

SHA1
63971d9d516d73290a29895101b5c90cdcaa787a

SHA256
07d0d9f407da82272c266492b074444f1944b43fbcd060074a63e3d97d1014f2

SHA512
21ec3673ebf5a0d461e42f7afb863bfb6f86b4074709bfd0aab835bacc0d075e801b9c4422175c175d878fd034380f251677d76da5289eb991c6f2061ea71578

Download Submit
C:\Windows\SysWOW64\Gemkelcd.exe

Filesize
80KB

MD5
f44b77afb1956a54606ec13b4bc61519

SHA1
d5ca599f44b9ef324ef72173df8c4777671103db

SHA256
aa7d67a869a9459f8d9461c3d85b82df4c315834bcdec1a8ab72515dfb8bd62f

SHA512
b2fb3cc18cbc81ddf2e1d9c1c4013e6ce3feb7c218735b075f4447024e2f7b89e4b5354cb80714859016cb3b7638eab047c5790bfb52d981b137efb054c05a39

Download Submit
C:\Windows\SysWOW64\Gpdennml.exe

Filesize
80KB

MD5
85924c69652f74a269b7769b969cdb98

SHA1
8a75c81d697533ec1633bfff1b939d742571dded

SHA256
725d25d8adcdd7880202c1cb76cdd7597ce56e95848af9aa26fa2ba77d916dda

SHA512
e5fd9759085f65e91d52cdd664a3513c8dd457ebbd2c365c83cff003cb2592772c5bfe5cb3468c5664c324e5e590d9562a46964e48ba14f04eac9f19a590ee23

Download Submit
C:\Windows\SysWOW64\Hbgkei32.exe

Filesize
80KB

MD5
f6cf3c73dde4a00709c5efa73beeba7b

SHA1
7ff7f0287fe70f203bc3a14a4a1ed9d100ec8e33

SHA256
abee5b63b5402c9ae106c669bd4559aa8f35e3420a0825b2cd0518922871e6f2

SHA512
dc533ffea804f27287ded79dc752333a2bc1f7414b27fc7deb0b62e0ea4875b2dc573d71021cfbea5054e4ca287fa400a54d4ca032c4b1a1d4696edb1e4a41e8

Download Submit
C:\Windows\SysWOW64\Hblkjo32.exe

Filesize
21KB

MD5
6344f8666214399d4ba693e756d9ea81

SHA1
4ecd8df6e59753b995cbc53cdbe96a3c15f7145c

SHA256
3b65d9c0fa52769fe368ccc25cfb67939bc3a5dc48eb7eb6390dc550783b84c6

SHA512
4d6b1b4ac7a029c89a00c8d77dd016856389fd0d60084a0b4f83ab947222c1243781ddac7f5a7cc826bcab78ce77ceff5910618a576b858f5c200c9dc8a184be

Download Submit
C:\Windows\SysWOW64\Hioflcbj.exe

Filesize
80KB

MD5
2c77bbb120184f512653eb44c7f9c356

SHA1
79618f7e293816628723e5484c94c11832599964

SHA256
0183011b523a0dd2bb15e2f6f37ac513660d77a6ed1bc89be3b3a8efb32ae353

SHA512
40d278513c5c18d07d7e452da16d67c2b52375fe58f0a72007e9e5f4c7373653611f62d3d9db23bd2f3859a6745b1ff9dc412a92d4bb5a1499265006ec81b346

Download Submit
C:\Windows\SysWOW64\Hnibokbd.exe

Filesize
80KB

MD5
4a6643562c59f5104872a10c1809acc7

SHA1
b62f4e39849642d5eda5de3071d6cb0e5d1a65d7

SHA256
e7dd30dc32802a0229aa4b1a5aeb1025072b3c570be2c0ecba5344bc3a5143c2

SHA512
d2ec0d2c8953649801bc8fd1698624fe24dd459eb85ee3fd14b85c47a500630d2316c94bd92e86594c50c794d17f71e8ce294672729e0bce60442f9d9a757dff

Download Submit
C:\Windows\SysWOW64\Hpiecd32.exe

Filesize
80KB

MD5
610fe73665c7afa7548b05e0ee459120

SHA1
eb4e97df2ce931da630bf32f13401dbdd21c534e

SHA256
8504b816e15655e5401740b73ce8ffb2c6163f2dd89cbb42ab302ee5f5f3f55b

SHA512
06725d428c4ec26155e214213db64802629c75f7e696309e415911d7f54ed97c1819f4c645c69e67c1824487c5d81da37764b184236ae28ab3529e8bb3e08239

Download Submit
C:\Windows\SysWOW64\Ibjqaf32.exe

Filesize
52KB

MD5
daf730f92efffaf064e2bc91c437615f

SHA1
e1ef6226f2380ee73c314748d97ba8d16c643644

SHA256
e30dcc9656d6eeb8871c078347151bf8ecdb72c7b9f1a57e4d5a9067ce72070e

SHA512
e97a751028fa2e3a808295a974b4394c865956ed97ad6d393df95845bf0b64e12b07723073f1729345a86dafb1e9371d2a43915d5a9aa82f4df031c8de48ad4d

Download Submit
C:\Windows\SysWOW64\Ilnlom32.exe

Filesize
80KB

MD5
ef6927e321b7313f0299ab94c076823d

SHA1
1eb1999729eab92aeae8e9e8b9d34dd8460e64bc

SHA256
806d85cbf7284d9c8a77a09566ee2ce5ccda55162004a8e7a700d970b7613d17

SHA512
8f16df1f665fad770117a1c956f4a3d6680a6a4be5867dc0f3399c33dcd2cd4c41cc3597f02048ab5f07897fd47af904a5ce91134b88ec704ab240ff4f32d38a

Download Submit
C:\Windows\SysWOW64\Jifecp32.exe

Filesize
80KB

MD5
2de002385a89ba98ccd911e8ef8fdaec

SHA1
34646ad81131896e96b03696bf24fc28e02f2581

SHA256
cfa51b1fc61835be99bce65cbbffb01e027cf5fdbb00ae28b37f433bed27f2f8

SHA512
ab8bd275451877122878bac1e868a465fef7d0e9e792b34e8caef51379cb2037dbd8c1b83039a03c3a784fb6b88a344b39f7d8826d7cd5f64d7462ef8701311b

Download Submit
C:\Windows\SysWOW64\Johggfha.exe

Filesize
80KB

MD5
21696b78d34ae85b9dcf1069e163537e

SHA1
4682eebefcd903fdf75b9aea77d0fb0e8481f94b

SHA256
0c53da43763a617f7765e58df898007be1b1c02c3a726745379bb87ff7daec60

SHA512
d5ab542648984a24bfe7f7f1919353aa6b0eb32a200946092987fb572e5ff7a63463fe9acae07cf76d0f27a53aa016ce1bb6232733fb33efdacd29dd39760fa4

Download Submit
C:\Windows\SysWOW64\Jpnakk32.exe

Filesize
80KB

MD5
766f76d5caa1d75b2ad0f7f49917f3aa

SHA1
d38454f6edb820112a1bc80a2e65ded18b511204

SHA256
56a688a4a7a7c76b09f4daf29e2957c14849ad4e23591a5ce948045c31df8d12

SHA512
8b1fd6ae76d997d469ad7bfb87bd9f83b5c3d02344b2d2092e0f735b3afcd0036ade1120dd087dc43b8cabca0962daf8dd1d647ed49ab2ffe4fd9b7733975277

Download Submit
C:\Windows\SysWOW64\Kcjjhdjb.exe

Filesize
80KB

MD5
3fcde22c1145d967d2da0da07fc9bfb9

SHA1
0f75e3a61102820f356357e6ab88ac92885b8cae

SHA256
b0d770f51a5f40157fffd8c2620288e26eaba43eb088009ce65f93dbd06efa0b

SHA512
f28cb71471bc6e675339a62bfdac643c01de07baf65c82bb23d29c6a8717e5e87aef285a88df1fcf47b804e2dc24d025986850a4d37de1196a8f6c6288fe66c6

Download Submit
C:\Windows\SysWOW64\Kgnbdh32.exe

Filesize
7KB

MD5
50ed59187f5fd94423f072d1c53a0eec

SHA1
d13bb89487151ed1891b6c7e238fed1f8ca30076

SHA256
1390b65093ed8babca2b61b3015128dbf39df313b783cd7e2d5a44e0ff403d1a

SHA512
7227e08bf4fcef0d7506996392d4677e70aff47ae13f93f9ddc04c7f533e2041fda7a7025be4e32a986a7dda26fa7dc2b0e954561e5886394b2c6aa3bda3dfdc

Download Submit
C:\Windows\SysWOW64\Klbnajqc.exe

Filesize
80KB

MD5
9530187aa3c756a19e3eff82e5eaae9c

SHA1
64de355467ddc0d4cd8d37c8bf9ea640ec4193c1

SHA256
f197dc21951507d679ea8a6dcf4c34ea9c8d124f189f16638d70198bc77c98f9

SHA512
3d48dfd405cbcc9ee391bc9046b70b9e1b48a9bf20c7e50114bfff5867e5df9a374a24c5570a6d62b85a6710722d852b9a0b81e5d8b1e183fad2397e3a03af22

Download Submit
C:\Windows\SysWOW64\Kmdqgd32.exe

Filesize
33KB

MD5
87e96d7bff5c9dae1d10eb2173d872ef

SHA1
6a7b3da332ece110d5ce7b29de88cf21196fb0fa

SHA256
8ad68f48a376379debac52e779a658f069f8f62ea3befda35b702bfddcd4bff3

SHA512
e462ba3eb1d35cc3eeb42c12b9eed149490b3669fb3a5d36c31b5eb977b8286c63313b433ae7496de92a5621fc24d1f8f26da9fd48c1849412907889521efd7a

Download Submit
C:\Windows\SysWOW64\Kmdqgd32.exe

Filesize
26KB

MD5
b3bd8e69f846059c3d51882792c5c5fa

SHA1
fd48269eb7aa592eaa27b835e7cf7423a937385e

SHA256
df5843d41a9e2295d04441101da9a8d13e49fa2d668c372743f977dd42bdd0f8

SHA512
54b76c8e06701b1144a81e9db89d881c263edb2b6ef36bc2b5b8418aa0ed881227282b7a7d5c56bd2261aede1fb0de6de963fabb21cb53e46f0a211338a01761

Download Submit
C:\Windows\SysWOW64\Kqnbkl32.exe

Filesize
80KB

MD5
76cd6649f63694d270ec9812c1393230

SHA1
013ad368657fa2dc14f0dfc20cb161e43d603ff8

SHA256
b24ae168377bdc1a0246e63072832fca8bd04514894b5871438b330ce9cc889a

SHA512
5e19a4d6afda567b3b723f1b9d51a0593630fca9d914aaf4673baaacabc86cef1264c8200ed6bcae3dbfedb7d73e377ac9d950eeee5ea88518a30e73805dbb8c

Download Submit
C:\Windows\SysWOW64\Lmdnbn32.exe

Filesize
18KB

MD5
bd05fb65b2396a044035998643d6125e

SHA1
b185793f0c675e33212e488bec2f7fa70275ead9

SHA256
69fc7f281b3e57242e10e62342eafff0c2e1e9deacb70b8633f3cc1aba4846fe

SHA512
1a0da1cbe75eeb2c7072c44e054e7f3d58b5f4828a8820b1a8ef0a486ac2e732af40c1d33a26555ee44e6d6b3e0c020f51159a8071a5df727b12a088a6f530b7

Download Submit
C:\Windows\SysWOW64\Maodigil.exe

Filesize
80KB

MD5
55d7031e929ce3e94a47555dfd591311

SHA1
4b4ee76987a17dde65880586267963a879b4093c

SHA256
b8fa43df638c4d6fa132d82a8fecebf9aeb49c7336706756e45760ffee98add1

SHA512
e384007f85d162ce2e926e34c32e84971ecdd6bc4bc77a76d333838a5c8c1235e0c7156ab0027c99a420720fd1f537be64e6476de8c10c8f525cfab9f42d7e9b

Download Submit
C:\Windows\SysWOW64\Mblkhq32.exe

Filesize
80KB

MD5
a21f626657ae09a9fa79d9a1c983d388

SHA1
ce2a819ea3299b1bf01233029780661804d7d99f

SHA256
4153091aeadedb2ac5c34a7c5bd6d3ba5c47d0fdab9f04e1cc918de6d4c00999

SHA512
4901a2b5ce91785ea9c9873c137aedd9513889ae12c421d359f2e457b29c877b77908a0be0c6c0ad9c059861e5d808f133ee2a80d2b84f72d583e42bc9e71008

Download Submit
C:\Windows\SysWOW64\Mekgdl32.exe

Filesize
80KB

MD5
b81813323fc4f5b97ea47120dafc672b

SHA1
31149b4294ca31bf0089954bcef4cb0f4830fd4b

SHA256
53e5f32ad344e1a457f63c8c23431dbd8d119c5314670fe78ef73f83364537eb

SHA512
7521e96c704775fedf0b28d9fc044a37195c89610637662a20784457f43ed66ce077997e577a44281d85c3399009e9907db18a5446ea59127eaf7eae1f2f7f26

Download Submit
C:\Windows\SysWOW64\Mgclpkac.exe

Filesize
54KB

MD5
f42c637bdd316c9da55cc631d8ea6856

SHA1
31eb1dd7f6d7b4042c52f3844159d77a1238eaa4

SHA256
57f09610297564c7b953806128c3bf8e0704edec03b0fc9504a0b86c945ba23a

SHA512
be0d70bdb360794586ed836e373ee0f45396cf10a359468a116f940892f5e07fd387d5ac32a15b2d36f9a07359b794068168e5bef64d2c8dd2d74a8bd7346a48

Download Submit
C:\Windows\SysWOW64\Mjkblhfo.exe

Filesize
29KB

MD5
adafe5b3741a51a3330532ae1d3f3eb7

SHA1
d375f076b84a39a3f32e1877c8b637c7d5f9928f

SHA256
2f256f1cdac2e75fc26a66d2cb290ce8fcc0b5b40b66fc74d0d77268fdbe788f

SHA512
7cd2580b78ae170775d342be1ce96f69207de0ce0b8bd901f5f4d2b3d3b68bbbfeda1f130caeefc8f3434edf0920caee576fba5a9f52c3f61198f87cf23bc21d

Download Submit
C:\Windows\SysWOW64\Mpqkad32.exe

Filesize
80KB

MD5
8c6ef8b0a34b798c9ee385450a034a8d

SHA1
35fa75ddc8af1435dfd84515f5c294f4dd0a411f

SHA256
7e69c6a9eefb2d073178f37dd1fc8714de28d122879b2861673e6c6e82805eba

SHA512
c49afd1d6790199307334ce7af6e6b011e8b0e67aea3e3f3a6657ed6f2f30e99466b37f322671c29ff499287e668feaf54c21fcebf4f506d203ce92a1c9c8b27

Download Submit
C:\Windows\SysWOW64\Nbadcpbh.exe

Filesize
80KB

MD5
4f433e0ef9211952f3b9b1b845f8d5a3

SHA1
5ccd55ba4e39ddd7acc342558c61b8b5fff925e5

SHA256
9ccc1bb902c29d79d525cf726f1c86feda2ce331a2a1476602458b9579dd8301

SHA512
376faa16e333a74e49166ed4d229f475d899346074b267758914cb21ce5bd4dcda6533649693e1e509867d187920c226aaa66c4393867d8340919323d6db7dda

Download Submit
C:\Windows\SysWOW64\Ngaionfl.exe

Filesize
80KB

MD5
8de01083488554457f378f33aaede9dc

SHA1
95e4aef41849f0e305ef757b34aa8de37c36635b

SHA256
30e3cbdc832234b36c3c7d7f2b83ffef5a74f2e972377d9f350f013c7ecc2614

SHA512
530cb42960fa0f07f4147c0118f9078881089b2b9212911c769c4ff1a0a391ca1440b50b364398c7667f92c33e50bb83ff65b03d6eaa8ffb17562ea6f19b0c51

Download Submit
C:\Windows\SysWOW64\Ngomin32.exe

Filesize
80KB

MD5
7d1b1c914d43d2e4237b65a6ac20aa41

SHA1
e9fd29ba5708cade0042d52e31c382fcc28d6320

SHA256
25de697c2797e0f0aee33951d6085fec387cee29ac77e65bf3c9de00276146aa

SHA512
d9378f39b5945869c922b5f58ce4b77b20f51732102432eab2996b2260cc4f565945785346f66617ea345c5fa0dc31d4bf9962284b4b1aa7c9f805dc2664cfb0

Download Submit
C:\Windows\SysWOW64\Nhahaiec.exe

Filesize
13KB

MD5
71d7f3ea2e669e271b7031fd2998331f

SHA1
0f7b3b15297f54f84d6c1295943fb73f0a663225

SHA256
d9191237fc61f6bbc2d82be9261390bc5b837804e5c53c9c1df64e30b21e5ca6

SHA512
79ce6f64bca95f77423158fc5e1ca61512c4d4ad4551575d966a4f0e934197d51365b3e5ae6b381668e0737e7f373e6135596faafe1ceedb02e9033937298233

Download Submit
C:\Windows\SysWOW64\Nijeec32.exe

Filesize
80KB

MD5
2a2f12171cb3cb8fa6c6bcfb49b0f8d4

SHA1
13f3508b3090c0d996f2a546e5f36299c9502e31

SHA256
9cafccb81b41a36c2b4f444c0f1af01909d8c74c072293b9600a95b7185a64ae

SHA512
79cb70083075bf6f924cc51ef09e42465c024d0fcac2db38c2b004d542e4639512425ec099c43d7001627e15cf081fd9bd0ad0431378dd05eeeb46d5ba8b6b75

Download Submit
C:\Windows\SysWOW64\Niklpj32.exe

Filesize
80KB

MD5
0023b9df87244736127fcf1751e79fb0

SHA1
9533bd3961f21ead6f02ea6f3b823ff93fbdac7f

SHA256
07b2b05ff214f45009d4030d47cddf50b9d98e074034fdb6272d44fbc41720d0

SHA512
9884832c06558528197298632ed8852782c5793ea06b21b53ee1189c31bc534130bfd2cf666792bce37095543f763de71d18d177bb966a7874a85c928ee81c47

Download Submit
C:\Windows\SysWOW64\Nlleaeff.exe

Filesize
80KB

MD5
935beb9f9dfc28fc9b41081ec6c311b9

SHA1
ac2fe6c1d51cecb4c9941765258b63fab60bd1f6

SHA256
0f279b81b9306b8c0a471aa9d7c0aa7622aa728f49a64629c9cae458c04b85f0

SHA512
eb8d9f3918b3c7ee49e5db1b41519e530b286995b9a56e19d918d8062cd8851dde0b6dd964d612902fe6f77960f6efacdd1e5de3292be1bbe221ec4b6ca0f6ee

Download Submit
C:\Windows\SysWOW64\Noblkqca.exe

Filesize
75KB

MD5
82571941999bd5d1d7ad7cb68d66d3d0

SHA1
17683422e3054ea2eb1d36521d487e9e60b91aae

SHA256
d815101ca9cae876b4721c4a176920dd306c0d2f4fbbc3cb25e100bb748fbfc8

SHA512
183026a33beef8233594f84f1e90f3536bb08ae2a070ea2daff9cd47aab7e8e17790273b2a04fdaaedc2bca930815ea2938d374ac2c6f257c61a6a26634fe88a

Download Submit
C:\Windows\SysWOW64\Nookip32.exe

Filesize
80KB

MD5
9a363a0ffb49f10405c8e5cece0fd44d

SHA1
8ab05bd31c713e975fc5c05275cb4c048adef6f4

SHA256
8593480dc1d165fc3f8ceb3e0d4df7bb878757b369bdacebd6c3127390220091

SHA512
9097cd011d1ff627b551f28fee3e393b49a0dcf21d3b07c16c74f37c22710f14b563bf1fdd33b85d0a6c68717896da45d1ec571c6125447600da690784e3727f

Download Submit
C:\Windows\SysWOW64\Npedmdab.exe

Filesize
80KB

MD5
10f9adeaf6ec62a40a643ad56859fb60

SHA1
a9120763f89cb6b47dd5bc4e0e29ffdeaf5e6fd6

SHA256
38c4494ac5d632b7e7a263091d7225d92834f569647dd2dde471e485730082cc

SHA512
8a523d2562bae86eb04e4f91498720cc3ebd332176220a924d8884ea3ab552b4c8422cfe96d861515702f2954c24c07d20d9d73ea698841126435e3de1ec85a7

Download Submit
C:\Windows\SysWOW64\Npjnhc32.exe

Filesize
80KB

MD5
2173b5bbb250be23dddfef3ac4e3ddf4

SHA1
fd49a60c61b122e0f466956bbae8dd60c8b2ff50

SHA256
8611b0dbe5b531cfd5174d8a4244ffbea9550e681b289f81472503381ab7ce50

SHA512
b3e95821e53c44da0b75dea7537a71ae9e82c3c525a5c2c572ab116be22895a8e5fc8cc3d67098a57692f27de36a9fd9d3fd1f98b188ef627366a8d3a6cbfe82

Download Submit
C:\Windows\SysWOW64\Ojemig32.exe

Filesize
80KB

MD5
5912e8b6f87b717cb374118a3c829816

SHA1
a726a7aab14f066014d9b4ccd96d22fbb293e299

SHA256
5897b26d3484468e67b0972fe107b7ceb9bbd78304de5e8d79e6806edadcc192

SHA512
9b48410e91d511cb4b4c0313bcdd2df076060026bb3117e89721c14e14c52459c9dfe9fd3ec0b5e7f8d4d308d241512d4a0591a386c605ff3a04680b65dadc8f

Download Submit
C:\Windows\SysWOW64\Pffgom32.exe

Filesize
80KB

MD5
c6223c7a312f2f22a57e6c49902f7247

SHA1
cc040dcdabd35f8b18ed9b1ef41c2bc52acb04fc

SHA256
d05fbed8540ad8c99c4837721adee90d04699f3729bc0afc83507d9286ef8c1d

SHA512
9eecf0165273330b0502116ba0928b47ba12f11aa3b82c4cfd935ba55c5dce9f1a6a868d29702bb1eef35ad292d56f163eb41b63fbce97b3aa5637b26dfb2122

Download Submit
C:\Windows\SysWOW64\Pnplfj32.exe

Filesize
80KB

MD5
f4890d2b992d2cfafdbb5160528ca073

SHA1
4e36a82e8156efa48bdc9efc615feaab0b5f0645

SHA256
a086e39ba4dabca8e015be91709cf2beca5c1ed69c0db45666fce31fa4cf85ac

SHA512
0f658c71011be1bbb62fa1933a9774bbc6818201d29369d2a107e22189a6958a985dd205dd759c723a8c9f5a4823ec715b45803e73d811667260cf5b127a36db

Download Submit
memory/220-282-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/408-138-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/440-276-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/728-82-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/740-264-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/868-21-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1052-292-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1076-342-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1184-242-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1272-56-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1428-230-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1436-394-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1520-377-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1568-217-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1592-336-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1596-422-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1812-413-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1892-90-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1920-257-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1944-149-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1952-122-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2060-198-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2100-114-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2176-306-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2648-378-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2748-74-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2860-162-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2896-98-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2920-65-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2920-0-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2920-5-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2928-294-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2944-234-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2976-358-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3092-270-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3128-414-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3220-318-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3576-348-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3592-177-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3600-402-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3636-249-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3728-371-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3812-330-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3940-364-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3972-210-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4092-202-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4272-33-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4312-300-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4320-66-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4344-388-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4392-435-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4396-41-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4404-153-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4456-324-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4504-186-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4636-130-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4712-25-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4792-170-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4820-48-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4852-8-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4900-396-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4916-110-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4932-436-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/5044-312-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads