68562c8d136a2f4f0d690a3099eb8459409dba3eba857bc2d6a8cc6ecd3820e4

Analysis

max time kernel
50s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 20:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0fb7da825ba085164f2f2f2a00a192b5.exe
Size 80KB
Sample240101-zgrwcaacck
SHA256 68562c8d136a2f4f0d690a3099eb8459409dba3eba857bc2d6a8cc6ecd3820e4
MD5 0fb7da825ba085164f2f2f2a00a192b5
SHA1 c60d905c1d16550d286ffabf0bce35e15a193f89
SHA512 86d53c5cafdbc0cbf8da18a06a51c142f92ba14d12d1d0058cabfb184531fa771e88cbc3744dbdf0c7c656ab12f53da6eb815419dfa1e55f5f1bbe2914e43f0a
SSDEEP 1536:slryrSkYMUNKS/omSxRQv3PJHoo2LeS5DUHRbPa9b6i+sIk:sobYMYKW6RQfxHAeS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fohfbpgi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkofga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpnnle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibgdlg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fiodpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjiipk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imgicgca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfjola32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocohmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dqpfmlce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nglhld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckbemgcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ganldgib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klljnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emhkdmlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfeeabda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nncccnol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koodbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oeoblb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imkbnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlolpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibqnkh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbcke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ioolkncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hioflcbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgjgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oobfob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dahmfpap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gacepg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnplfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnfmbmbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hemmac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Keifdpif.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppnenlka.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jklinohd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Epmmqheb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfhnaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhmbqm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdbpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmmlla32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gemkelcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glipgf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jokkgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfiddm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaldccip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lifjnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgehfkop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eecphp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlgepanl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnpdegjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbpchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nndjndbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhahaiec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kofkbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdnhih32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eecphp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdnbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jnkldqkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obnehj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pllgnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkokcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Piphgq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnjqmpgg.exe

Executes dropped EXE 64 IoCs

pid	Process
4852	Kmdqgd32.exe
868	Klljnp32.exe
4712	Kdcbom32.exe
4272	Kfankifm.exe
4396	Kipkhdeq.exe
4820	Kdeoemeg.exe
1272	Miemjaci.exe
4320	Ngbpidjh.exe
2748	Igcoqocb.exe
728	Kfqgab32.exe
1892	Lhfmdj32.exe
2896	Lnqeqd32.exe
4916	Lfhnaa32.exe
2100	Lifjnm32.exe
1952	Onkidm32.exe
4636	Mpnnle32.exe
408	Pfoann32.exe
1944	Mekgdl32.exe
4404	Mpqkad32.exe
2860	Nbadcpbh.exe
4792	Niklpj32.exe
3592	Npedmdab.exe
4504	Ngomin32.exe
2060	Nlleaeff.exe
4092	Ngaionfl.exe
3972	Npjnhc32.exe
1568	Nookip32.exe
1428	Aobilkcl.exe
2944	Aflaie32.exe
1184	Aodfajaj.exe
3636	Afnnnd32.exe
1920	Bqfoamfj.exe
740	Bfchidda.exe
3092	Biadeoce.exe
440	Ibgdlg32.exe
220	Fibojhim.exe
1052	Hdkidohn.exe
2928	Ihdldn32.exe
4312	Jikoopij.exe
2176	Hpbiip32.exe
5044	Hkgnfhnh.exe
3220	Jhgiim32.exe
4456	Hgnoki32.exe
3812	Hjlkge32.exe
1592	Keifdpif.exe
1076	Ocihgnam.exe
3576	Jhndljll.exe
2976	Jklphekp.exe
3940	Jnkldqkc.exe
3728	Jnmijq32.exe
1520	Ppnenlka.exe
2648	Loacdc32.exe
4344	Kqnbkl32.exe
1436	Kiejmi32.exe
4900	Kkcfid32.exe
3600	Knbbep32.exe
1812	Mpclce32.exe
3128	Kgjgne32.exe
1596	Kjhcjq32.exe
4392	Kbpkkn32.exe
4932	Mnlnbl32.exe
368	Mbgjbkfg.exe
4308	Mhdckaeo.exe
3492	Mjbogmdb.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jiglnf32.exe	Jghpbk32.exe
File opened for modification	C:\Windows\SysWOW64\Pmlfqh32.exe	Pjmjdm32.exe
File created	C:\Windows\SysWOW64\Akpoaj32.exe	Adfgdpmi.exe
File created	C:\Windows\SysWOW64\Aggpfkjj.exe	Ahdpjn32.exe
File created	C:\Windows\SysWOW64\Kofkbk32.exe	Kfnfjehl.exe
File created	C:\Windows\SysWOW64\Qmfqknfm.dll	Lnangaoa.exe
File created	C:\Windows\SysWOW64\Pkoaeldi.dll	Bhpofl32.exe
File created	C:\Windows\SysWOW64\Cnnnfkal.dll	Ggfglb32.exe
File created	C:\Windows\SysWOW64\Kmfpdfnd.dll	Fdnhih32.exe
File opened for modification	C:\Windows\SysWOW64\Kjjiej32.exe	Kcpahpmd.exe
File created	C:\Windows\SysWOW64\Filclgic.dll	Geaepk32.exe
File created	C:\Windows\SysWOW64\Bdimkqnb.dll	Jleijb32.exe
File created	C:\Windows\SysWOW64\Idaiki32.dll	Pdjgha32.exe
File opened for modification	C:\Windows\SysWOW64\Egohdegl.exe	Ehlhih32.exe
File opened for modification	C:\Windows\SysWOW64\Hemmac32.exe	Hbnaeh32.exe
File created	C:\Windows\SysWOW64\Bqbijpeo.dll	Omqmop32.exe
File created	C:\Windows\SysWOW64\Nbjnhape.dll	Hifmmb32.exe
File created	C:\Windows\SysWOW64\Nbnpcj32.exe	Mldhfpib.exe
File created	C:\Windows\SysWOW64\Ahoemi32.dll	Fflohaij.exe
File opened for modification	C:\Windows\SysWOW64\Jniood32.exe	Jebfng32.exe
File opened for modification	C:\Windows\SysWOW64\Opnbae32.exe	Ompfej32.exe
File opened for modification	C:\Windows\SysWOW64\Bgpcliao.exe	Bhmbqm32.exe
File opened for modification	C:\Windows\SysWOW64\Dqpfmlce.exe	Doojec32.exe
File created	C:\Windows\SysWOW64\Nojjcj32.exe	Opbean32.exe
File created	C:\Windows\SysWOW64\Bdkohe32.dll	Mkhapk32.exe
File opened for modification	C:\Windows\SysWOW64\Ioolkncg.exe	Iplkpa32.exe
File created	C:\Windows\SysWOW64\Lfjfecno.exe	Lomqcjie.exe
File created	C:\Windows\SysWOW64\Ehlhih32.exe	Eqdpgk32.exe
File created	C:\Windows\SysWOW64\Dddjmo32.dll	Panhbfep.exe
File created	C:\Windows\SysWOW64\Ggfglb32.exe	Gicgpelg.exe
File opened for modification	C:\Windows\SysWOW64\Ihkjno32.exe	Hemmac32.exe
File created	C:\Windows\SysWOW64\Mjmoag32.exe	Mccfdmmo.exe
File opened for modification	C:\Windows\SysWOW64\Fmfgek32.exe	Fflohaij.exe
File created	C:\Windows\SysWOW64\Gcbpne32.dll	Mhdckaeo.exe
File created	C:\Windows\SysWOW64\Nfjola32.exe	Nclbpf32.exe
File opened for modification	C:\Windows\SysWOW64\Plndcl32.exe	Piphgq32.exe
File created	C:\Windows\SysWOW64\Nfmifiap.dll	Fngcmcfe.exe
File created	C:\Windows\SysWOW64\Ggpdhj32.dll	Gbchdp32.exe
File opened for modification	C:\Windows\SysWOW64\Kgnbdh32.exe	Kofkbk32.exe
File created	C:\Windows\SysWOW64\Dglkoeio.exe	Ddnobj32.exe
File created	C:\Windows\SysWOW64\Hmhkgijk.dll	Mkadfj32.exe
File created	C:\Windows\SysWOW64\Mgmodn32.dll	Bmeandma.exe
File created	C:\Windows\SysWOW64\Jngbjd32.exe	Jepjhg32.exe
File created	C:\Windows\SysWOW64\Chfegk32.exe	Cponen32.exe
File created	C:\Windows\SysWOW64\Jjgobjmp.dll	Nndjndbh.exe
File opened for modification	C:\Windows\SysWOW64\Jgpfbjlo.exe	Jpenfp32.exe
File opened for modification	C:\Windows\SysWOW64\Bkibgh32.exe	Bgnffj32.exe
File created	C:\Windows\SysWOW64\Kgjgne32.exe	Mpclce32.exe
File opened for modification	C:\Windows\SysWOW64\Pnkbkk32.exe	Phajna32.exe
File created	C:\Windows\SysWOW64\Afbgkl32.exe	Adcjop32.exe
File opened for modification	C:\Windows\SysWOW64\Dahmfpap.exe	Dojqjdbl.exe
File created	C:\Windows\SysWOW64\Nafjjf32.exe	Nklbmllg.exe
File opened for modification	C:\Windows\SysWOW64\Lqndhcdc.exe	Lnohlgep.exe
File created	C:\Windows\SysWOW64\Lkchelci.exe	Lggldm32.exe
File created	C:\Windows\SysWOW64\Hnphoj32.exe	Hpmhdmea.exe
File opened for modification	C:\Windows\SysWOW64\Apjkcadp.exe	Aagkhd32.exe
File created	C:\Windows\SysWOW64\Lfojfj32.dll	Halhfe32.exe
File created	C:\Windows\SysWOW64\Ngomin32.exe	Npedmdab.exe
File created	C:\Windows\SysWOW64\Jnhpoamf.exe	Hjlkge32.exe
File created	C:\Windows\SysWOW64\Gbfnhm32.dll	Nlkgmh32.exe
File created	C:\Windows\SysWOW64\Oeehkn32.exe	Nnkpnclp.exe
File created	C:\Windows\SysWOW64\Eecphp32.exe	Enigke32.exe
File opened for modification	C:\Windows\SysWOW64\Giecfejd.exe	Ganldgib.exe
File created	C:\Windows\SysWOW64\Hldiinke.exe	Hifmmb32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5668	5976	WerFault.exe	597

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idkkpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpelhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbadcpbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfkegm32.dll"	Mgclpkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnfmbmbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbgcih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chnpamkc.dll"	Aggpfkjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdeodj32.dll"	Ljhefhha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ngqagcag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eklajcmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Glfmgp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfchidda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jiglnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adfgdpmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdcbom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gilmfhhk.dll"	Afnnnd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Doaneiop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjeiodek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkokcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eegcnaoo.dll"	Egcaod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pidlqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqpamb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hlpfhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igdgglfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aoioli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fndpmndl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiaafn32.dll"	Gmdcfidg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Polppg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncdmbe32.dll"	Mgehfkop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hoobdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgeakekd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npiiffqe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Panhbfep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Biafno32.dll"	Chnlgjlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehbnigjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fgmdec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnlnbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oiccje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnbddbhk.dll"	Aajhndkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehojko32.dll"	Boihcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbpedjnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihkjno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mhdckaeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Biadeoce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkcfid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oboijgbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgclpkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Boldhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggiabl32.dll"	Mjkblhfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gikdkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Begfqa32.dll"	Eiekog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	0fb7da825ba085164f2f2f2a00a192b5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcbnnpka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egilaj32.dll"	Qdaniq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Doojec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkqkhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgccinoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjdhbppo.dll"	Jlgepanl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eiekog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iplkpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcppfn32.dll"	Nbadcpbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gldglf32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 4852	2920	0fb7da825ba085164f2f2f2a00a192b5.exe	33
PID 2920 wrote to memory of 4852	2920	0fb7da825ba085164f2f2f2a00a192b5.exe	33
PID 2920 wrote to memory of 4852	2920	0fb7da825ba085164f2f2f2a00a192b5.exe	33
PID 4852 wrote to memory of 868	4852	Kmdqgd32.exe	32
PID 4852 wrote to memory of 868	4852	Kmdqgd32.exe	32
PID 4852 wrote to memory of 868	4852	Kmdqgd32.exe	32
PID 868 wrote to memory of 4712	868	Klljnp32.exe	28
PID 868 wrote to memory of 4712	868	Klljnp32.exe	28
PID 868 wrote to memory of 4712	868	Klljnp32.exe	28
PID 4712 wrote to memory of 4272	4712	Kdcbom32.exe	30
PID 4712 wrote to memory of 4272	4712	Kdcbom32.exe	30
PID 4712 wrote to memory of 4272	4712	Kdcbom32.exe	30
PID 4272 wrote to memory of 4396	4272	Kfankifm.exe	29
PID 4272 wrote to memory of 4396	4272	Kfankifm.exe	29
PID 4272 wrote to memory of 4396	4272	Kfankifm.exe	29
PID 4396 wrote to memory of 4820	4396	Kipkhdeq.exe	40
PID 4396 wrote to memory of 4820	4396	Kipkhdeq.exe	40
PID 4396 wrote to memory of 4820	4396	Kipkhdeq.exe	40
PID 4820 wrote to memory of 1272	4820	Kdeoemeg.exe	49
PID 4820 wrote to memory of 1272	4820	Kdeoemeg.exe	49
PID 4820 wrote to memory of 1272	4820	Kdeoemeg.exe	49
PID 1272 wrote to memory of 4320	1272	Miemjaci.exe	96
PID 1272 wrote to memory of 4320	1272	Miemjaci.exe	96
PID 1272 wrote to memory of 4320	1272	Miemjaci.exe	96
PID 4320 wrote to memory of 2748	4320	Ngbpidjh.exe	97
PID 4320 wrote to memory of 2748	4320	Ngbpidjh.exe	97
PID 4320 wrote to memory of 2748	4320	Ngbpidjh.exe	97
PID 2748 wrote to memory of 728	2748	Igcoqocb.exe	116
PID 2748 wrote to memory of 728	2748	Igcoqocb.exe	116
PID 2748 wrote to memory of 728	2748	Igcoqocb.exe	116
PID 728 wrote to memory of 1892	728	Kfqgab32.exe	101
PID 728 wrote to memory of 1892	728	Kfqgab32.exe	101
PID 728 wrote to memory of 1892	728	Kfqgab32.exe	101
PID 1892 wrote to memory of 2896	1892	Lhfmdj32.exe	100
PID 1892 wrote to memory of 2896	1892	Lhfmdj32.exe	100
PID 1892 wrote to memory of 2896	1892	Lhfmdj32.exe	100
PID 2896 wrote to memory of 4916	2896	Lnqeqd32.exe	99
PID 2896 wrote to memory of 4916	2896	Lnqeqd32.exe	99
PID 2896 wrote to memory of 4916	2896	Lnqeqd32.exe	99
PID 4916 wrote to memory of 2100	4916	Lfhnaa32.exe	98
PID 4916 wrote to memory of 2100	4916	Lfhnaa32.exe	98
PID 4916 wrote to memory of 2100	4916	Lfhnaa32.exe	98
PID 2100 wrote to memory of 1952	2100	Lifjnm32.exe	397
PID 2100 wrote to memory of 1952	2100	Lifjnm32.exe	397
PID 2100 wrote to memory of 1952	2100	Lifjnm32.exe	397
PID 1952 wrote to memory of 4636	1952	Onkidm32.exe	113
PID 1952 wrote to memory of 4636	1952	Onkidm32.exe	113
PID 1952 wrote to memory of 4636	1952	Onkidm32.exe	113
PID 4636 wrote to memory of 408	4636	Mpnnle32.exe	406
PID 4636 wrote to memory of 408	4636	Mpnnle32.exe	406
PID 4636 wrote to memory of 408	4636	Mpnnle32.exe	406
PID 408 wrote to memory of 1944	408	Pfoann32.exe	112
PID 408 wrote to memory of 1944	408	Pfoann32.exe	112
PID 408 wrote to memory of 1944	408	Pfoann32.exe	112
PID 1944 wrote to memory of 4404	1944	Mekgdl32.exe	111
PID 1944 wrote to memory of 4404	1944	Mekgdl32.exe	111
PID 1944 wrote to memory of 4404	1944	Mekgdl32.exe	111
PID 4404 wrote to memory of 2860	4404	Mpqkad32.exe	110
PID 4404 wrote to memory of 2860	4404	Mpqkad32.exe	110
PID 4404 wrote to memory of 2860	4404	Mpqkad32.exe	110
PID 2860 wrote to memory of 4792	2860	Nbadcpbh.exe	109
PID 2860 wrote to memory of 4792	2860	Nbadcpbh.exe	109
PID 2860 wrote to memory of 4792	2860	Nbadcpbh.exe	109
PID 4792 wrote to memory of 3592	4792	Niklpj32.exe	104

C:\Users\Admin\AppData\Local\Temp\0fb7da825ba085164f2f2f2a00a192b5.exe
"C:\Users\Admin\AppData\Local\Temp\0fb7da825ba085164f2f2f2a00a192b5.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\Kmdqgd32.exe
  C:\Windows\system32\Kmdqgd32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4852

C:\Windows\SysWOW64\Kdcbom32.exe
C:\Windows\system32\Kdcbom32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\SysWOW64\Kfankifm.exe
  C:\Windows\system32\Kfankifm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4272

C:\Windows\SysWOW64\Kipkhdeq.exe
C:\Windows\system32\Kipkhdeq.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\Kdeoemeg.exe
  C:\Windows\system32\Kdeoemeg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\Miemjaci.exe
    C:\Windows\system32\Miemjaci.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Windows\SysWOW64\Ngbpidjh.exe
      C:\Windows\system32\Ngbpidjh.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4320
    - - C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2748
      - C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:728

C:\Windows\SysWOW64\Klljnp32.exe
C:\Windows\system32\Klljnp32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\SysWOW64\Lifjnm32.exe
C:\Windows\system32\Lifjnm32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\Lldfjh32.exe
  C:\Windows\system32\Lldfjh32.exe
  2⤵
  PID:1952

C:\Windows\SysWOW64\Lfhnaa32.exe
C:\Windows\system32\Lfhnaa32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916

C:\Windows\SysWOW64\Lnqeqd32.exe
C:\Windows\system32\Lnqeqd32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896

C:\Windows\SysWOW64\Lhfmdj32.exe
C:\Windows\system32\Lhfmdj32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\SysWOW64\Mblkhq32.exe
C:\Windows\system32\Mblkhq32.exe
1⤵
PID:408
- C:\Windows\SysWOW64\Mekgdl32.exe
  C:\Windows\system32\Mekgdl32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1944

C:\Windows\SysWOW64\Npedmdab.exe
C:\Windows\system32\Npedmdab.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3592
- C:\Windows\SysWOW64\Ngomin32.exe
  C:\Windows\system32\Ngomin32.exe
  2⤵
  - Executes dropped EXE
  PID:4504

C:\Windows\SysWOW64\Nlleaeff.exe
C:\Windows\system32\Nlleaeff.exe
1⤵
- Executes dropped EXE
PID:2060
- C:\Windows\SysWOW64\Ngaionfl.exe
  C:\Windows\system32\Ngaionfl.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- - C:\Windows\SysWOW64\Npjnhc32.exe
    C:\Windows\system32\Npjnhc32.exe
    3⤵
    - Executes dropped EXE
    PID:3972
  - - C:\Windows\SysWOW64\Nookip32.exe
      C:\Windows\system32\Nookip32.exe
      4⤵
      Executes dropped EXE
      PID:1568

C:\Windows\SysWOW64\Niklpj32.exe
C:\Windows\system32\Niklpj32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792

C:\Windows\SysWOW64\Nbadcpbh.exe
C:\Windows\system32\Nbadcpbh.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\SysWOW64\Mpqkad32.exe
C:\Windows\system32\Mpqkad32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404

C:\Windows\SysWOW64\Mpnnle32.exe
C:\Windows\system32\Mpnnle32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636

C:\Windows\SysWOW64\Aobilkcl.exe
C:\Windows\system32\Aobilkcl.exe
1⤵
- Executes dropped EXE
PID:1428
- C:\Windows\SysWOW64\Aflaie32.exe
  C:\Windows\system32\Aflaie32.exe
  2⤵
  - Executes dropped EXE
  PID:2944

C:\Windows\SysWOW64\Bfchidda.exe
C:\Windows\system32\Bfchidda.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:740
- C:\Windows\SysWOW64\Biadeoce.exe
  C:\Windows\system32\Biadeoce.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:3092
- - C:\Windows\SysWOW64\Fdffbake.exe
    C:\Windows\system32\Fdffbake.exe
    3⤵
    PID:440
  - - C:\Windows\SysWOW64\Fibojhim.exe
      C:\Windows\system32\Fibojhim.exe
      4⤵
      Executes dropped EXE
      PID:220
    - - C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        5⤵
        Executes dropped EXE
        
        PID:1052

C:\Windows\SysWOW64\Bqfoamfj.exe
C:\Windows\system32\Bqfoamfj.exe
1⤵
- Executes dropped EXE
PID:1920

C:\Windows\SysWOW64\Afnnnd32.exe
C:\Windows\system32\Afnnnd32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:3636

C:\Windows\SysWOW64\Aodfajaj.exe
C:\Windows\system32\Aodfajaj.exe
1⤵
- Executes dropped EXE
PID:1184

C:\Windows\SysWOW64\Hpbiip32.exe
C:\Windows\system32\Hpbiip32.exe
1⤵
- Executes dropped EXE
PID:2176
- C:\Windows\SysWOW64\Hkgnfhnh.exe
  C:\Windows\system32\Hkgnfhnh.exe
  2⤵
  - Executes dropped EXE
  PID:5044

C:\Windows\SysWOW64\Hpdfnolo.exe
C:\Windows\system32\Hpdfnolo.exe
1⤵
PID:3220
- C:\Windows\SysWOW64\Hgnoki32.exe
  C:\Windows\system32\Hgnoki32.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- - C:\Windows\SysWOW64\Hjlkge32.exe
    C:\Windows\system32\Hjlkge32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3812

C:\Windows\SysWOW64\Hjhalefe.exe
C:\Windows\system32\Hjhalefe.exe
1⤵
PID:4312

C:\Windows\SysWOW64\Hkeaqi32.exe
C:\Windows\system32\Hkeaqi32.exe
1⤵
PID:2928

C:\Windows\SysWOW64\Jqglkmlj.exe
C:\Windows\system32\Jqglkmlj.exe
1⤵
PID:1076
- C:\Windows\SysWOW64\Jhndljll.exe
  C:\Windows\system32\Jhndljll.exe
  2⤵
  - Executes dropped EXE
  PID:3576

C:\Windows\SysWOW64\Jklphekp.exe
C:\Windows\system32\Jklphekp.exe
1⤵
- Executes dropped EXE
PID:2976
- C:\Windows\SysWOW64\Jnkldqkc.exe
  C:\Windows\system32\Jnkldqkc.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  PID:3940
- - C:\Windows\SysWOW64\Jnmijq32.exe
    C:\Windows\system32\Jnmijq32.exe
    3⤵
    - Executes dropped EXE
    PID:3728

C:\Windows\SysWOW64\Kiejmi32.exe
C:\Windows\system32\Kiejmi32.exe
1⤵
- Executes dropped EXE
PID:1436
- C:\Windows\SysWOW64\Kkcfid32.exe
  C:\Windows\system32\Kkcfid32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:4900
- - C:\Windows\SysWOW64\Knbbep32.exe
    C:\Windows\system32\Knbbep32.exe
    3⤵
    - Executes dropped EXE
    PID:3600

C:\Windows\SysWOW64\Kjhcjq32.exe
C:\Windows\system32\Kjhcjq32.exe
1⤵
- Executes dropped EXE
PID:1596
- C:\Windows\SysWOW64\Kbpkkn32.exe
  C:\Windows\system32\Kbpkkn32.exe
  2⤵
  - Executes dropped EXE
  PID:4392

C:\Windows\SysWOW64\Kgjgne32.exe
C:\Windows\system32\Kgjgne32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3128

C:\Windows\SysWOW64\Kqpoakco.exe
C:\Windows\system32\Kqpoakco.exe
1⤵
PID:1812
- C:\Windows\SysWOW64\Mcaipa32.exe
  C:\Windows\system32\Mcaipa32.exe
  2⤵
  PID:12788
- - C:\Windows\SysWOW64\Mfpell32.exe
    C:\Windows\system32\Mfpell32.exe
    3⤵
    PID:12836
  - - C:\Windows\SysWOW64\Mqjbddpl.exe
      C:\Windows\system32\Mqjbddpl.exe
      4⤵
      PID:12920

C:\Windows\SysWOW64\Kqnbkl32.exe
C:\Windows\system32\Kqnbkl32.exe
1⤵
- Executes dropped EXE
PID:4344

C:\Windows\SysWOW64\Jibmgi32.exe
C:\Windows\system32\Jibmgi32.exe
1⤵
PID:2648

C:\Windows\SysWOW64\Jqlefl32.exe
C:\Windows\system32\Jqlefl32.exe
1⤵
PID:1520
- C:\Windows\SysWOW64\Pciqnk32.exe
  C:\Windows\system32\Pciqnk32.exe
  2⤵
  PID:4068
- - C:\Windows\SysWOW64\Pjcikejg.exe
    C:\Windows\system32\Pjcikejg.exe
    3⤵
    PID:5264
  - - C:\Windows\SysWOW64\Pififb32.exe
      C:\Windows\system32\Pififb32.exe
      4⤵
      PID:5976
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5976 -s 400
        5⤵
        Program crash
        
        PID:5668

C:\Windows\SysWOW64\Jnhpoamf.exe
C:\Windows\system32\Jnhpoamf.exe
1⤵
PID:1592
- C:\Windows\SysWOW64\Khgbqkhj.exe
  C:\Windows\system32\Khgbqkhj.exe
  2⤵
  PID:3400
- - C:\Windows\SysWOW64\Klbnajqc.exe
    C:\Windows\system32\Klbnajqc.exe
    3⤵
    PID:4064

C:\Windows\SysWOW64\Mnlnbl32.exe
C:\Windows\system32\Mnlnbl32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:4932
- C:\Windows\SysWOW64\Mbgjbkfg.exe
  C:\Windows\system32\Mbgjbkfg.exe
  2⤵
  - Executes dropped EXE
  PID:368

C:\Windows\SysWOW64\Mjbogmdb.exe
C:\Windows\system32\Mjbogmdb.exe
1⤵
- Executes dropped EXE
PID:3492
- C:\Windows\SysWOW64\Mbighjdd.exe
  C:\Windows\system32\Mbighjdd.exe
  2⤵
  PID:4068
- - C:\Windows\SysWOW64\Micoed32.exe
    C:\Windows\system32\Micoed32.exe
    3⤵
    PID:2740
  - - C:\Windows\SysWOW64\Mjellmbp.exe
      C:\Windows\system32\Mjellmbp.exe
      4⤵
      PID:2024
    - - C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        5⤵
        
        PID:8

C:\Windows\SysWOW64\Maodigil.exe
C:\Windows\system32\Maodigil.exe
1⤵
PID:1540
- C:\Windows\SysWOW64\Mldhfpib.exe
  C:\Windows\system32\Mldhfpib.exe
  2⤵
  - Drops file in System32 directory
  PID:732
- - C:\Windows\SysWOW64\Nbnpcj32.exe
    C:\Windows\system32\Nbnpcj32.exe
    3⤵
    PID:1860
  - - C:\Windows\SysWOW64\Nacmdf32.exe
      C:\Windows\system32\Nacmdf32.exe
      4⤵
      PID:5136

C:\Windows\SysWOW64\Nklbmllg.exe
C:\Windows\system32\Nklbmllg.exe
1⤵
- Drops file in System32 directory
PID:5216
- C:\Windows\SysWOW64\Nafjjf32.exe
  C:\Windows\system32\Nafjjf32.exe
  2⤵
  PID:5256
- - C:\Windows\SysWOW64\Nhpbfpka.exe
    C:\Windows\system32\Nhpbfpka.exe
    3⤵
    PID:5296
  - - C:\Windows\SysWOW64\Obqanjdb.exe
      C:\Windows\system32\Obqanjdb.exe
      4⤵
      PID:12784

C:\Windows\SysWOW64\Nijeec32.exe
C:\Windows\system32\Nijeec32.exe
1⤵
PID:5176
- C:\Windows\SysWOW64\Oihmedma.exe
  C:\Windows\system32\Oihmedma.exe
  2⤵
  PID:1264
- - C:\Windows\SysWOW64\Oqoefand.exe
    C:\Windows\system32\Oqoefand.exe
    3⤵
    PID:12348

C:\Windows\SysWOW64\Nojjcj32.exe
C:\Windows\system32\Nojjcj32.exe
1⤵
PID:5336
- C:\Windows\SysWOW64\Nahgoe32.exe
  C:\Windows\system32\Nahgoe32.exe
  2⤵
  PID:5376
- - C:\Windows\SysWOW64\Neccpd32.exe
    C:\Windows\system32\Neccpd32.exe
    3⤵
    PID:5416
  - - C:\Windows\SysWOW64\Nkqkhk32.exe
      C:\Windows\system32\Nkqkhk32.exe
      4⤵
      Modifies registry class
      PID:5460
    - - C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        5⤵
        Modifies registry class
        
        PID:5500
      - C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        6⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        7⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        8⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        9⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        10⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        11⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        9⤵
        
        PID:540
- C:\Windows\SysWOW64\Pplhhm32.exe
  C:\Windows\system32\Pplhhm32.exe
  2⤵
  PID:5632

C:\Windows\SysWOW64\Okgaijaj.exe
C:\Windows\system32\Okgaijaj.exe
1⤵
PID:5836
- C:\Windows\SysWOW64\Oboijgbl.exe
  C:\Windows\system32\Oboijgbl.exe
  2⤵
  - Modifies registry class
  PID:5888
- - C:\Windows\SysWOW64\Ohkbbn32.exe
    C:\Windows\system32\Ohkbbn32.exe
    3⤵
    PID:5960
  - - C:\Windows\SysWOW64\Ooejohhq.exe
      C:\Windows\system32\Ooejohhq.exe
      4⤵
      PID:6004
    - - C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064

C:\Windows\SysWOW64\Ohnohn32.exe
C:\Windows\system32\Ohnohn32.exe
1⤵
PID:6112
- C:\Windows\SysWOW64\Oklkdi32.exe
  C:\Windows\system32\Oklkdi32.exe
  2⤵
  PID:5164

C:\Windows\SysWOW64\Obcceg32.exe
C:\Windows\system32\Obcceg32.exe
1⤵
PID:5240
- C:\Windows\SysWOW64\Ohpkmn32.exe
  C:\Windows\system32\Ohpkmn32.exe
  2⤵
  PID:5364
- - C:\Windows\SysWOW64\Pllgnl32.exe
    C:\Windows\system32\Pllgnl32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:5468
  - - C:\Windows\SysWOW64\Pahpfc32.exe
      C:\Windows\system32\Pahpfc32.exe
      4⤵
      PID:5524

C:\Windows\SysWOW64\Piphgq32.exe
C:\Windows\system32\Piphgq32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5640
- C:\Windows\SysWOW64\Plndcl32.exe
  C:\Windows\system32\Plndcl32.exe
  2⤵
  PID:5712
- - C:\Windows\SysWOW64\Polppg32.exe
    C:\Windows\system32\Polppg32.exe
    3⤵
    - Modifies registry class
    PID:5812

C:\Windows\SysWOW64\Pakllc32.exe
C:\Windows\system32\Pakllc32.exe
1⤵
PID:5904
- C:\Windows\SysWOW64\Phedhmhi.exe
  C:\Windows\system32\Phedhmhi.exe
  2⤵
  PID:5984
- - C:\Windows\SysWOW64\Pkcadhgm.exe
    C:\Windows\system32\Pkcadhgm.exe
    3⤵
    PID:5132
  - - C:\Windows\SysWOW64\Idkkpf32.exe
      C:\Windows\system32\Idkkpf32.exe
      4⤵
      Modifies registry class
      PID:5444
    - - C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5596
      - C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        6⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        7⤵
        
        PID:5988

C:\Windows\SysWOW64\Mhdckaeo.exe
C:\Windows\system32\Mhdckaeo.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
PID:4308

C:\Windows\SysWOW64\Kcpahpmd.exe
C:\Windows\system32\Kcpahpmd.exe
1⤵
- Drops file in System32 directory
PID:4720
- C:\Windows\SysWOW64\Kjjiej32.exe
  C:\Windows\system32\Kjjiej32.exe
  2⤵
  PID:2128
- - C:\Windows\SysWOW64\Kqdaadln.exe
    C:\Windows\system32\Kqdaadln.exe
    3⤵
    PID:4292
  - - C:\Windows\SysWOW64\Kcbnnpka.exe
      C:\Windows\system32\Kcbnnpka.exe
      4⤵
      Modifies registry class
      PID:6084

C:\Windows\SysWOW64\Kkjeomld.exe
C:\Windows\system32\Kkjeomld.exe
1⤵
PID:4656
- C:\Windows\SysWOW64\Kmkbfeab.exe
  C:\Windows\system32\Kmkbfeab.exe
  2⤵
  PID:4044
- - C:\Windows\SysWOW64\Lnjnqh32.exe
    C:\Windows\system32\Lnjnqh32.exe
    3⤵
    PID:5652
  - - C:\Windows\SysWOW64\Lgccinoe.exe
      C:\Windows\system32\Lgccinoe.exe
      4⤵
      Modifies registry class
      PID:5020
    - - C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        5⤵
        
        PID:5972

C:\Windows\SysWOW64\Lkalplel.exe
C:\Windows\system32\Lkalplel.exe
1⤵
PID:3132
- C:\Windows\SysWOW64\Lnohlgep.exe
  C:\Windows\system32\Lnohlgep.exe
  2⤵
  - Drops file in System32 directory
  PID:5368

C:\Windows\SysWOW64\Lqndhcdc.exe
C:\Windows\system32\Lqndhcdc.exe
1⤵
PID:2140
- C:\Windows\SysWOW64\Ldipha32.exe
  C:\Windows\system32\Ldipha32.exe
  2⤵
  PID:5696

C:\Windows\SysWOW64\Lggldm32.exe
C:\Windows\system32\Lggldm32.exe
1⤵
- Drops file in System32 directory
PID:4284
- C:\Windows\SysWOW64\Lkchelci.exe
  C:\Windows\system32\Lkchelci.exe
  2⤵
  PID:6060

C:\Windows\SysWOW64\Lnadagbm.exe
C:\Windows\system32\Lnadagbm.exe
1⤵
PID:4788
- C:\Windows\SysWOW64\Lqpamb32.exe
  C:\Windows\system32\Lqpamb32.exe
  2⤵
  - Modifies registry class
  PID:4756

C:\Windows\SysWOW64\Lcnmin32.exe
C:\Windows\system32\Lcnmin32.exe
1⤵
PID:5952
- C:\Windows\SysWOW64\Ljhefhha.exe
  C:\Windows\system32\Ljhefhha.exe
  2⤵
  - Modifies registry class
  PID:4424
- - C:\Windows\SysWOW64\Lmgabcge.exe
    C:\Windows\system32\Lmgabcge.exe
    3⤵
    PID:5440

C:\Windows\SysWOW64\Lqbncb32.exe
C:\Windows\system32\Lqbncb32.exe
1⤵
PID:2964
- C:\Windows\SysWOW64\Mcqjon32.exe
  C:\Windows\system32\Mcqjon32.exe
  2⤵
  PID:6020

C:\Windows\SysWOW64\Mkhapk32.exe
C:\Windows\system32\Mkhapk32.exe
1⤵
- Drops file in System32 directory
PID:2548
- C:\Windows\SysWOW64\Mjkblhfo.exe
  C:\Windows\system32\Mjkblhfo.exe
  2⤵
  - Modifies registry class
  PID:4888

C:\Windows\SysWOW64\Mminhceb.exe
C:\Windows\system32\Mminhceb.exe
1⤵
PID:6164
- C:\Windows\SysWOW64\Madjhb32.exe
  C:\Windows\system32\Madjhb32.exe
  2⤵
  PID:6212
- - C:\Windows\SysWOW64\Mccfdmmo.exe
    C:\Windows\system32\Mccfdmmo.exe
    3⤵
    - Drops file in System32 directory
    PID:6260

C:\Windows\SysWOW64\Mjmoag32.exe
C:\Windows\system32\Mjmoag32.exe
1⤵
PID:6304
- C:\Windows\SysWOW64\Maggnali.exe
  C:\Windows\system32\Maggnali.exe
  2⤵
  PID:6344
- - C:\Windows\SysWOW64\Mgaokl32.exe
    C:\Windows\system32\Mgaokl32.exe
    3⤵
    PID:6388
  - - C:\Windows\SysWOW64\Mjokgg32.exe
      C:\Windows\system32\Mjokgg32.exe
      4⤵
      PID:6428
    - - C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        5⤵
        
        PID:6468
      - C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        6⤵
        
        PID:6508

C:\Windows\SysWOW64\Mgclpkac.exe
C:\Windows\system32\Mgclpkac.exe
1⤵
- Modifies registry class
PID:6552
- C:\Windows\SysWOW64\Mnmdme32.exe
  C:\Windows\system32\Mnmdme32.exe
  2⤵
  PID:6592
- - C:\Windows\SysWOW64\Megljppl.exe
    C:\Windows\system32\Megljppl.exe
    3⤵
    PID:6640

C:\Windows\SysWOW64\Mgehfkop.exe
C:\Windows\system32\Mgehfkop.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6680
- C:\Windows\SysWOW64\Mkadfj32.exe
  C:\Windows\system32\Mkadfj32.exe
  2⤵
  - Drops file in System32 directory
  PID:6728
- - C:\Windows\SysWOW64\Mmbanbmg.exe
    C:\Windows\system32\Mmbanbmg.exe
    3⤵
    PID:6776
  - - C:\Windows\SysWOW64\Nclikl32.exe
      C:\Windows\system32\Nclikl32.exe
      4⤵
      PID:6820
    - - C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        5⤵
        
        PID:6864

C:\Windows\SysWOW64\Ngjbaj32.exe
C:\Windows\system32\Ngjbaj32.exe
1⤵
PID:6988
- C:\Windows\SysWOW64\Nndjndbh.exe
  C:\Windows\system32\Nndjndbh.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  PID:7036
- - C:\Windows\SysWOW64\Nabfjpak.exe
    C:\Windows\system32\Nabfjpak.exe
    3⤵
    PID:7084

C:\Windows\SysWOW64\Ncofplba.exe
C:\Windows\system32\Ncofplba.exe
1⤵
PID:6944

C:\Windows\SysWOW64\Ncabfkqo.exe
C:\Windows\system32\Ncabfkqo.exe
1⤵
PID:7128
- C:\Windows\SysWOW64\Njkkbehl.exe
  C:\Windows\system32\Njkkbehl.exe
  2⤵
  PID:3796
- - C:\Windows\SysWOW64\Nmigoagp.exe
    C:\Windows\system32\Nmigoagp.exe
    3⤵
    PID:6200
  - - C:\Windows\SysWOW64\Neqopnhb.exe
      C:\Windows\system32\Neqopnhb.exe
      4⤵
      PID:6292

C:\Windows\SysWOW64\Nhokljge.exe
C:\Windows\system32\Nhokljge.exe
1⤵
PID:3852
- C:\Windows\SysWOW64\Nlkgmh32.exe
  C:\Windows\system32\Nlkgmh32.exe
  2⤵
  - Drops file in System32 directory
  PID:6372
- - C:\Windows\SysWOW64\Nmlddqem.exe
    C:\Windows\system32\Nmlddqem.exe
    3⤵
    PID:6436
  - - C:\Windows\SysWOW64\Ndflak32.exe
      C:\Windows\system32\Ndflak32.exe
      4⤵
      PID:6492
    - - C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6584
      - C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        6⤵
        Drops file in System32 directory
        
        PID:6648
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        7⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        8⤵
        
        PID:6760

C:\Windows\SysWOW64\Oeheqm32.exe
C:\Windows\system32\Oeheqm32.exe
1⤵
PID:6904
- C:\Windows\SysWOW64\Ohfami32.exe
  C:\Windows\system32\Ohfami32.exe
  2⤵
  PID:6968
- - C:\Windows\SysWOW64\Oanfen32.exe
    C:\Windows\system32\Oanfen32.exe
    3⤵
    PID:7032
  - - C:\Windows\SysWOW64\Ohhnbhok.exe
      C:\Windows\system32\Ohhnbhok.exe
      4⤵
      PID:7076

C:\Windows\SysWOW64\Oobfob32.exe
C:\Windows\system32\Oobfob32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7156
- C:\Windows\SysWOW64\Oelolmnd.exe
  C:\Windows\system32\Oelolmnd.exe
  2⤵
  PID:736

C:\Windows\SysWOW64\Omqmop32.exe
C:\Windows\system32\Omqmop32.exe
1⤵
- Drops file in System32 directory
PID:6860

C:\Windows\SysWOW64\Napjdpcn.exe
C:\Windows\system32\Napjdpcn.exe
1⤵
PID:6908

C:\Windows\SysWOW64\Lqkgbcff.exe
C:\Windows\system32\Lqkgbcff.exe
1⤵
PID:4568

C:\Windows\SysWOW64\Cfbcke32.exe
C:\Windows\system32\Cfbcke32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6404
- C:\Windows\SysWOW64\Dkokcl32.exe
  C:\Windows\system32\Dkokcl32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Modifies registry class
  PID:6560

C:\Windows\SysWOW64\Ddgplado.exe
C:\Windows\system32\Ddgplado.exe
1⤵
PID:6916
- C:\Windows\SysWOW64\Dkahilkl.exe
  C:\Windows\system32\Dkahilkl.exe
  2⤵
  PID:3772
- - C:\Windows\SysWOW64\Dnpdegjp.exe
    C:\Windows\system32\Dnpdegjp.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:1620

C:\Windows\SysWOW64\Dfdpad32.exe
C:\Windows\system32\Dfdpad32.exe
1⤵
PID:6848

C:\Windows\SysWOW64\Ddjmba32.exe
C:\Windows\system32\Ddjmba32.exe
1⤵
PID:6240
- C:\Windows\SysWOW64\Dmadco32.exe
  C:\Windows\system32\Dmadco32.exe
  2⤵
  PID:6188

C:\Windows\SysWOW64\Dbnmke32.exe
C:\Windows\system32\Dbnmke32.exe
1⤵
PID:6496
- C:\Windows\SysWOW64\Ddligq32.exe
  C:\Windows\system32\Ddligq32.exe
  2⤵
  PID:4232

C:\Windows\SysWOW64\Dbpjaeoc.exe
C:\Windows\system32\Dbpjaeoc.exe
1⤵
PID:4532
- C:\Windows\SysWOW64\Ddnfmqng.exe
  C:\Windows\system32\Ddnfmqng.exe
  2⤵
  PID:6244
- - C:\Windows\SysWOW64\Dkhnjk32.exe
    C:\Windows\system32\Dkhnjk32.exe
    3⤵
    PID:6548
  - - C:\Windows\SysWOW64\Deqcbpld.exe
      C:\Windows\system32\Deqcbpld.exe
      4⤵
      PID:7080
    - - C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1496
      - C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        6⤵
        
        PID:6952

C:\Windows\SysWOW64\Enigke32.exe
C:\Windows\system32\Enigke32.exe
1⤵
- Drops file in System32 directory
PID:388
- C:\Windows\SysWOW64\Eecphp32.exe
  C:\Windows\system32\Eecphp32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:468

C:\Windows\SysWOW64\Eiokinbk.exe
C:\Windows\system32\Eiokinbk.exe
1⤵
PID:7172
- C:\Windows\SysWOW64\Ebgpad32.exe
  C:\Windows\system32\Ebgpad32.exe
  2⤵
  PID:7224
- - C:\Windows\SysWOW64\Emmdom32.exe
    C:\Windows\system32\Emmdom32.exe
    3⤵
    PID:7272

C:\Windows\SysWOW64\Doaneiop.exe
C:\Windows\system32\Doaneiop.exe
1⤵
- Modifies registry class
PID:7000

C:\Windows\SysWOW64\Epmmqheb.exe
C:\Windows\system32\Epmmqheb.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7316
- C:\Windows\SysWOW64\Eejeiocj.exe
  C:\Windows\system32\Eejeiocj.exe
  2⤵
  PID:7360
- - C:\Windows\SysWOW64\Eppjfgcp.exe
    C:\Windows\system32\Eppjfgcp.exe
    3⤵
    PID:7408
  - - C:\Windows\SysWOW64\Fihnomjp.exe
      C:\Windows\system32\Fihnomjp.exe
      4⤵
      PID:7448
    - - C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        5⤵
        
        PID:7520

C:\Windows\SysWOW64\Fbpchb32.exe
C:\Windows\system32\Fbpchb32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7564
- C:\Windows\SysWOW64\Fflohaij.exe
  C:\Windows\system32\Fflohaij.exe
  2⤵
  - Drops file in System32 directory
  PID:7608
- - C:\Windows\SysWOW64\Fmfgek32.exe
    C:\Windows\system32\Fmfgek32.exe
    3⤵
    PID:7648

C:\Windows\SysWOW64\Fngcmcfe.exe
C:\Windows\system32\Fngcmcfe.exe
1⤵
- Drops file in System32 directory
PID:7684
- C:\Windows\SysWOW64\Fbbpmb32.exe
  C:\Windows\system32\Fbbpmb32.exe
  2⤵
  PID:7728

C:\Windows\SysWOW64\Fealin32.exe
C:\Windows\system32\Fealin32.exe
1⤵
PID:7772
- C:\Windows\SysWOW64\Fmhdkknd.exe
  C:\Windows\system32\Fmhdkknd.exe
  2⤵
  PID:7812
- - C:\Windows\SysWOW64\Fnipbc32.exe
    C:\Windows\system32\Fnipbc32.exe
    3⤵
    PID:7856
  - - C:\Windows\SysWOW64\Ffqhcq32.exe
      C:\Windows\system32\Ffqhcq32.exe
      4⤵
      PID:7896

C:\Windows\SysWOW64\Fiodpl32.exe
C:\Windows\system32\Fiodpl32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7940
- C:\Windows\SysWOW64\Fmkqpkla.exe
  C:\Windows\system32\Fmkqpkla.exe
  2⤵
  PID:7984
- - C:\Windows\SysWOW64\Fnlmhc32.exe
    C:\Windows\system32\Fnlmhc32.exe
    3⤵
    PID:8024
  - - C:\Windows\SysWOW64\Fefedmil.exe
      C:\Windows\system32\Fefedmil.exe
      4⤵
      PID:8064
    - - C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        5⤵
        
        PID:8104

C:\Windows\SysWOW64\Fnnjmbpm.exe
C:\Windows\system32\Fnnjmbpm.exe
1⤵
PID:8148
- C:\Windows\SysWOW64\Gfeaopqo.exe
  C:\Windows\system32\Gfeaopqo.exe
  2⤵
  PID:8188

C:\Windows\SysWOW64\Gmojkj32.exe
C:\Windows\system32\Gmojkj32.exe
1⤵
PID:7260
- C:\Windows\SysWOW64\Gnqfcbnj.exe
  C:\Windows\system32\Gnqfcbnj.exe
  2⤵
  PID:7336
- - C:\Windows\SysWOW64\Gejopl32.exe
    C:\Windows\system32\Gejopl32.exe
    3⤵
    PID:5616
  - - C:\Windows\SysWOW64\Gmafajfi.exe
      C:\Windows\system32\Gmafajfi.exe
      4⤵
      PID:7400

C:\Windows\SysWOW64\Gldglf32.exe
C:\Windows\system32\Gldglf32.exe
1⤵
- Modifies registry class
PID:7504
- C:\Windows\SysWOW64\Gbnoiqdq.exe
  C:\Windows\system32\Gbnoiqdq.exe
  2⤵
  PID:7576
- - C:\Windows\SysWOW64\Gemkelcd.exe
    C:\Windows\system32\Gemkelcd.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:7632
  - - C:\Windows\SysWOW64\Gmdcfidg.exe
      C:\Windows\system32\Gmdcfidg.exe
      4⤵
      Modifies registry class
      PID:7716

C:\Windows\SysWOW64\Glgcbf32.exe
C:\Windows\system32\Glgcbf32.exe
1⤵
PID:7780
- C:\Windows\SysWOW64\Gnepna32.exe
  C:\Windows\system32\Gnepna32.exe
  2⤵
  PID:7844

C:\Windows\SysWOW64\Gbalopbn.exe
C:\Windows\system32\Gbalopbn.exe
1⤵
PID:7908
- C:\Windows\SysWOW64\Geohklaa.exe
  C:\Windows\system32\Geohklaa.exe
  2⤵
  PID:7964

C:\Windows\SysWOW64\Gikdkj32.exe
C:\Windows\system32\Gikdkj32.exe
1⤵
- Modifies registry class
PID:8052
- C:\Windows\SysWOW64\Glipgf32.exe
  C:\Windows\system32\Glipgf32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:8124

C:\Windows\SysWOW64\Gpelhd32.exe
C:\Windows\system32\Gpelhd32.exe
1⤵
- Modifies registry class
PID:6876
- C:\Windows\SysWOW64\Gbchdp32.exe
  C:\Windows\system32\Gbchdp32.exe
  2⤵
  - Drops file in System32 directory
  PID:7264

C:\Windows\SysWOW64\Geaepk32.exe
C:\Windows\system32\Geaepk32.exe
1⤵
- Drops file in System32 directory
PID:7368
- C:\Windows\SysWOW64\Gmimai32.exe
  C:\Windows\system32\Gmimai32.exe
  2⤵
  PID:7428

C:\Windows\SysWOW64\Glkmmefl.exe
C:\Windows\system32\Glkmmefl.exe
1⤵
PID:7548
- C:\Windows\SysWOW64\Gojiiafp.exe
  C:\Windows\system32\Gojiiafp.exe
  2⤵
  PID:7680
- - C:\Windows\SysWOW64\Gbeejp32.exe
    C:\Windows\system32\Gbeejp32.exe
    3⤵
    PID:7808
  - - C:\Windows\SysWOW64\Hmkigh32.exe
      C:\Windows\system32\Hmkigh32.exe
      4⤵
      PID:7864

C:\Windows\SysWOW64\Hlnjbedi.exe
C:\Windows\system32\Hlnjbedi.exe
1⤵
PID:8004
- C:\Windows\SysWOW64\Hpiecd32.exe
  C:\Windows\system32\Hpiecd32.exe
  2⤵
  PID:8088

C:\Windows\SysWOW64\Hfcnpn32.exe
C:\Windows\system32\Hfcnpn32.exe
1⤵
PID:7180
- C:\Windows\SysWOW64\Hibjli32.exe
  C:\Windows\system32\Hibjli32.exe
  2⤵
  PID:7348
- - C:\Windows\SysWOW64\Hlpfhe32.exe
    C:\Windows\system32\Hlpfhe32.exe
    3⤵
    - Modifies registry class
    PID:7444
  - - C:\Windows\SysWOW64\Hoobdp32.exe
      C:\Windows\system32\Hoobdp32.exe
      4⤵
      Modifies registry class
      PID:7636

C:\Windows\SysWOW64\Hffken32.exe
C:\Windows\system32\Hffken32.exe
1⤵
PID:7888
- C:\Windows\SysWOW64\Hmpcbhji.exe
  C:\Windows\system32\Hmpcbhji.exe
  2⤵
  PID:8096
- - C:\Windows\SysWOW64\Hpnoncim.exe
    C:\Windows\system32\Hpnoncim.exe
    3⤵
    PID:7212
  - - C:\Windows\SysWOW64\Hblkjo32.exe
      C:\Windows\system32\Hblkjo32.exe
      4⤵
      PID:7188
    - - C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        5⤵
        
        PID:7760
      - C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        6⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        7⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        8⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        9⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        10⤵
        
        PID:7880

C:\Windows\SysWOW64\Ibaeen32.exe
C:\Windows\system32\Ibaeen32.exe
1⤵
PID:7720
- C:\Windows\SysWOW64\Imgicgca.exe
  C:\Windows\system32\Imgicgca.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:8072

C:\Windows\SysWOW64\Iedjmioj.exe
C:\Windows\system32\Iedjmioj.exe
1⤵
PID:8208
- C:\Windows\SysWOW64\Imkbnf32.exe
  C:\Windows\system32\Imkbnf32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:8248

C:\Windows\SysWOW64\Ipjoja32.exe
C:\Windows\system32\Ipjoja32.exe
1⤵
PID:8292
- C:\Windows\SysWOW64\Iomoenej.exe
  C:\Windows\system32\Iomoenej.exe
  2⤵
  PID:8336

C:\Windows\SysWOW64\Igdgglfl.exe
C:\Windows\system32\Igdgglfl.exe
1⤵
- Modifies registry class
PID:8376
- C:\Windows\SysWOW64\Iefgbh32.exe
  C:\Windows\system32\Iefgbh32.exe
  2⤵
  PID:8416
- - C:\Windows\SysWOW64\Imnocf32.exe
    C:\Windows\system32\Imnocf32.exe
    3⤵
    PID:8460

C:\Windows\SysWOW64\Ioolkncg.exe
C:\Windows\system32\Ioolkncg.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8548
- C:\Windows\SysWOW64\Ieidhh32.exe
  C:\Windows\system32\Ieidhh32.exe
  2⤵
  PID:8588

C:\Windows\SysWOW64\Iplkpa32.exe
C:\Windows\system32\Iplkpa32.exe
1⤵
- Drops file in System32 directory
- Modifies registry class
PID:8504

C:\Windows\SysWOW64\Joahqn32.exe
C:\Windows\system32\Joahqn32.exe
1⤵
PID:8628
- C:\Windows\SysWOW64\Jghpbk32.exe
  C:\Windows\system32\Jghpbk32.exe
  2⤵
  - Drops file in System32 directory
  PID:8672
- - C:\Windows\SysWOW64\Jiglnf32.exe
    C:\Windows\system32\Jiglnf32.exe
    3⤵
    - Modifies registry class
    PID:8716
  - - C:\Windows\SysWOW64\Jleijb32.exe
      C:\Windows\system32\Jleijb32.exe
      4⤵
      Drops file in System32 directory
      PID:8756
    - - C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        5⤵
        
        PID:8796

C:\Windows\SysWOW64\Jenmcggo.exe
C:\Windows\system32\Jenmcggo.exe
1⤵
PID:8836
- C:\Windows\SysWOW64\Jmeede32.exe
  C:\Windows\system32\Jmeede32.exe
  2⤵
  PID:8876
- - C:\Windows\SysWOW64\Jlgepanl.exe
    C:\Windows\system32\Jlgepanl.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Modifies registry class
    PID:8924

C:\Windows\SysWOW64\Jgmjmjnb.exe
C:\Windows\system32\Jgmjmjnb.exe
1⤵
PID:8964
- C:\Windows\SysWOW64\Jepjhg32.exe
  C:\Windows\system32\Jepjhg32.exe
  2⤵
  - Drops file in System32 directory
  PID:9004

C:\Windows\SysWOW64\Jngbjd32.exe
C:\Windows\system32\Jngbjd32.exe
1⤵
PID:9044
- C:\Windows\SysWOW64\Jpenfp32.exe
  C:\Windows\system32\Jpenfp32.exe
  2⤵
  - Drops file in System32 directory
  PID:9092
- - C:\Windows\SysWOW64\Jgpfbjlo.exe
    C:\Windows\system32\Jgpfbjlo.exe
    3⤵
    PID:9132
  - - C:\Windows\SysWOW64\Jebfng32.exe
      C:\Windows\system32\Jebfng32.exe
      4⤵
      Drops file in System32 directory
      PID:9172

C:\Windows\SysWOW64\Jniood32.exe
C:\Windows\system32\Jniood32.exe
1⤵
PID:9212
- C:\Windows\SysWOW64\Jphkkpbp.exe
  C:\Windows\system32\Jphkkpbp.exe
  2⤵
  PID:8244

C:\Windows\SysWOW64\Jokkgl32.exe
C:\Windows\system32\Jokkgl32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8300
- C:\Windows\SysWOW64\Jgbchj32.exe
  C:\Windows\system32\Jgbchj32.exe
  2⤵
  PID:8384

C:\Windows\SysWOW64\Jjpode32.exe
C:\Windows\system32\Jjpode32.exe
1⤵
PID:8448
- C:\Windows\SysWOW64\Jlolpq32.exe
  C:\Windows\system32\Jlolpq32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:8512
- - C:\Windows\SysWOW64\Komhll32.exe
    C:\Windows\system32\Komhll32.exe
    3⤵
    PID:8572
  - - C:\Windows\SysWOW64\Kgdpni32.exe
      C:\Windows\system32\Kgdpni32.exe
      4⤵
      PID:8640

C:\Windows\SysWOW64\Knnhjcog.exe
C:\Windows\system32\Knnhjcog.exe
1⤵
PID:8704
- C:\Windows\SysWOW64\Klahfp32.exe
  C:\Windows\system32\Klahfp32.exe
  2⤵
  PID:5724

C:\Windows\SysWOW64\Koodbl32.exe
C:\Windows\system32\Koodbl32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8740
- C:\Windows\SysWOW64\Kgflcifg.exe
  C:\Windows\system32\Kgflcifg.exe
  2⤵
  PID:8832
- - C:\Windows\SysWOW64\Kjeiodek.exe
    C:\Windows\system32\Kjeiodek.exe
    3⤵
    - Modifies registry class
    PID:8860
  - - C:\Windows\SysWOW64\Klcekpdo.exe
      C:\Windows\system32\Klcekpdo.exe
      4⤵
      PID:8960
    - - C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        5⤵
        
        PID:9036
      - C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        6⤵
        Drops file in System32 directory
        
        PID:9112
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9164

C:\Windows\SysWOW64\Kngkqbgl.exe
C:\Windows\system32\Kngkqbgl.exe
1⤵
PID:8368
- C:\Windows\SysWOW64\Lljklo32.exe
  C:\Windows\system32\Lljklo32.exe
  2⤵
  PID:8440
- - C:\Windows\SysWOW64\Lcdciiec.exe
    C:\Windows\system32\Lcdciiec.exe
    3⤵
    PID:8536

C:\Windows\SysWOW64\Kgnbdh32.exe
C:\Windows\system32\Kgnbdh32.exe
1⤵
PID:8216

C:\Windows\SysWOW64\Ljqhkckn.exe
C:\Windows\system32\Ljqhkckn.exe
1⤵
PID:8616
- C:\Windows\SysWOW64\Lomqcjie.exe
  C:\Windows\system32\Lomqcjie.exe
  2⤵
  - Drops file in System32 directory
  PID:9140
- - C:\Windows\SysWOW64\Lfjfecno.exe
    C:\Windows\system32\Lfjfecno.exe
    3⤵
    PID:8232
  - - C:\Windows\SysWOW64\Lnangaoa.exe
      C:\Windows\system32\Lnangaoa.exe
      4⤵
      Drops file in System32 directory
      PID:8404
    - - C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4400

C:\Windows\SysWOW64\Mcpcdg32.exe
C:\Windows\system32\Mcpcdg32.exe
1⤵
PID:4844
- C:\Windows\SysWOW64\Mogcihaj.exe
  C:\Windows\system32\Mogcihaj.exe
  2⤵
  PID:8708
- - C:\Windows\SysWOW64\Mcelpggq.exe
    C:\Windows\system32\Mcelpggq.exe
    3⤵
    PID:1100
  - - C:\Windows\SysWOW64\Mnjqmpgg.exe
      C:\Windows\system32\Mnjqmpgg.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:8792

C:\Windows\SysWOW64\Mmmqhl32.exe
C:\Windows\system32\Mmmqhl32.exe
1⤵
PID:8908
- C:\Windows\SysWOW64\Mcgiefen.exe
  C:\Windows\system32\Mcgiefen.exe
  2⤵
  PID:9000
- - C:\Windows\SysWOW64\Mfeeabda.exe
    C:\Windows\system32\Mfeeabda.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:9072
  - - C:\Windows\SysWOW64\Monjjgkb.exe
      C:\Windows\system32\Monjjgkb.exe
      4⤵
      PID:8428
    - - C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        5⤵
        Modifies registry class
        
        PID:8484
      - C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        6⤵
        
        PID:7616

C:\Windows\SysWOW64\Nclbpf32.exe
C:\Windows\system32\Nclbpf32.exe
1⤵
- Drops file in System32 directory
PID:8568
- C:\Windows\SysWOW64\Nfjola32.exe
  C:\Windows\system32\Nfjola32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:8700
- - C:\Windows\SysWOW64\Njfkmphe.exe
    C:\Windows\system32\Njfkmphe.exe
    3⤵
    PID:8820
  - - C:\Windows\SysWOW64\Nqpcjj32.exe
      C:\Windows\system32\Nqpcjj32.exe
      4⤵
      PID:4584
    - - C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9116
      - C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8320
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        7⤵
        
        PID:1684

C:\Windows\SysWOW64\Ngndaccj.exe
C:\Windows\system32\Ngndaccj.exe
1⤵
PID:9100
- C:\Windows\SysWOW64\Npiiffqe.exe
  C:\Windows\system32\Npiiffqe.exe
  2⤵
  - Modifies registry class
  PID:8724

C:\Windows\SysWOW64\Ngqagcag.exe
C:\Windows\system32\Ngqagcag.exe
1⤵
- Modifies registry class
PID:8952
- C:\Windows\SysWOW64\Onkidm32.exe
  C:\Windows\system32\Onkidm32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\Ocgbld32.exe
    C:\Windows\system32\Ocgbld32.exe
    3⤵
    PID:2668

C:\Windows\SysWOW64\Ompfej32.exe
C:\Windows\system32\Ompfej32.exe
1⤵
- Drops file in System32 directory
PID:3524
- C:\Windows\SysWOW64\Opnbae32.exe
  C:\Windows\system32\Opnbae32.exe
  2⤵
  PID:1216
- - C:\Windows\SysWOW64\Ofhknodl.exe
    C:\Windows\system32\Ofhknodl.exe
    3⤵
    PID:2044
  - - C:\Windows\SysWOW64\Oghghb32.exe
      C:\Windows\system32\Oghghb32.exe
      4⤵
      PID:8776
    - - C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        5⤵
        
        PID:5012

C:\Windows\SysWOW64\Oaplqh32.exe
C:\Windows\system32\Oaplqh32.exe
1⤵
PID:8948
- C:\Windows\SysWOW64\Ocohmc32.exe
  C:\Windows\system32\Ocohmc32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:4944
- - C:\Windows\SysWOW64\Ondljl32.exe
    C:\Windows\system32\Ondljl32.exe
    3⤵
    PID:4980
  - - C:\Windows\SysWOW64\Oabhfg32.exe
      C:\Windows\system32\Oabhfg32.exe
      4⤵
      PID:8804
    - - C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        5⤵
        
        PID:9060

C:\Windows\SysWOW64\Pfoann32.exe
C:\Windows\system32\Pfoann32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\SysWOW64\Pnfiplog.exe
  C:\Windows\system32\Pnfiplog.exe
  2⤵
  PID:3624
- - C:\Windows\SysWOW64\Pccahbmn.exe
    C:\Windows\system32\Pccahbmn.exe
    3⤵
    PID:3176
  - - C:\Windows\SysWOW64\Pfandnla.exe
      C:\Windows\system32\Pfandnla.exe
      4⤵
      PID:4716

C:\Windows\SysWOW64\Pjmjdm32.exe
C:\Windows\system32\Pjmjdm32.exe
1⤵
- Drops file in System32 directory
PID:5100
- C:\Windows\SysWOW64\Pmlfqh32.exe
  C:\Windows\system32\Pmlfqh32.exe
  2⤵
  PID:3348

C:\Windows\SysWOW64\Ppjbmc32.exe
C:\Windows\system32\Ppjbmc32.exe
1⤵
PID:464
- C:\Windows\SysWOW64\Phajna32.exe
  C:\Windows\system32\Phajna32.exe
  2⤵
  - Drops file in System32 directory
  PID:9228
- - C:\Windows\SysWOW64\Pnkbkk32.exe
    C:\Windows\system32\Pnkbkk32.exe
    3⤵
    PID:9268
  - - C:\Windows\SysWOW64\Pplobcpp.exe
      C:\Windows\system32\Pplobcpp.exe
      4⤵
      PID:9316
    - - C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        5⤵
        
        PID:9356
      - C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        6⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        7⤵
        
        PID:9436

C:\Windows\SysWOW64\Pdjgha32.exe
C:\Windows\system32\Pdjgha32.exe
1⤵
- Drops file in System32 directory
PID:9476
- C:\Windows\SysWOW64\Pfiddm32.exe
  C:\Windows\system32\Pfiddm32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:9516

C:\Windows\SysWOW64\Panhbfep.exe
C:\Windows\system32\Panhbfep.exe
1⤵
- Drops file in System32 directory
- Modifies registry class
PID:9596
- C:\Windows\SysWOW64\Pdmdnadc.exe
  C:\Windows\system32\Pdmdnadc.exe
  2⤵
  PID:9644
- - C:\Windows\SysWOW64\Qjfmkk32.exe
    C:\Windows\system32\Qjfmkk32.exe
    3⤵
    PID:9684

C:\Windows\SysWOW64\Qobhkjdi.exe
C:\Windows\system32\Qobhkjdi.exe
1⤵
PID:9728
- C:\Windows\SysWOW64\Qdoacabq.exe
  C:\Windows\system32\Qdoacabq.exe
  2⤵
  PID:9772
- - C:\Windows\SysWOW64\Qjiipk32.exe
    C:\Windows\system32\Qjiipk32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:9816
  - - C:\Windows\SysWOW64\Qmgelf32.exe
      C:\Windows\system32\Qmgelf32.exe
      4⤵
      PID:9856

C:\Windows\SysWOW64\Qdaniq32.exe
C:\Windows\system32\Qdaniq32.exe
1⤵
- Modifies registry class
PID:9896
- C:\Windows\SysWOW64\Afpjel32.exe
  C:\Windows\system32\Afpjel32.exe
  2⤵
  PID:9936
- - C:\Windows\SysWOW64\Aogbfi32.exe
    C:\Windows\system32\Aogbfi32.exe
    3⤵
    PID:9976

C:\Windows\SysWOW64\Amjbbfgo.exe
C:\Windows\system32\Amjbbfgo.exe
1⤵
PID:10012
- C:\Windows\SysWOW64\Aphnnafb.exe
  C:\Windows\system32\Aphnnafb.exe
  2⤵
  PID:10060

C:\Windows\SysWOW64\Adcjop32.exe
C:\Windows\system32\Adcjop32.exe
1⤵
- Drops file in System32 directory
PID:10100
- C:\Windows\SysWOW64\Afbgkl32.exe
  C:\Windows\system32\Afbgkl32.exe
  2⤵
  PID:10144

C:\Windows\SysWOW64\Aoioli32.exe
C:\Windows\system32\Aoioli32.exe
1⤵
- Modifies registry class
PID:10184
- C:\Windows\SysWOW64\Aagkhd32.exe
  C:\Windows\system32\Aagkhd32.exe
  2⤵
  - Drops file in System32 directory
  PID:10228

C:\Windows\SysWOW64\Apjkcadp.exe
C:\Windows\system32\Apjkcadp.exe
1⤵
PID:9248
- C:\Windows\SysWOW64\Adfgdpmi.exe
  C:\Windows\system32\Adfgdpmi.exe
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  PID:9296
- - C:\Windows\SysWOW64\Akpoaj32.exe
    C:\Windows\system32\Akpoaj32.exe
    3⤵
    PID:9392

C:\Windows\SysWOW64\Amnlme32.exe
C:\Windows\system32\Amnlme32.exe
1⤵
PID:9460
- C:\Windows\SysWOW64\Aajhndkb.exe
  C:\Windows\system32\Aajhndkb.exe
  2⤵
  - Modifies registry class
  PID:9540
- - C:\Windows\SysWOW64\Ahdpjn32.exe
    C:\Windows\system32\Ahdpjn32.exe
    3⤵
    - Drops file in System32 directory
    PID:9576

C:\Windows\SysWOW64\Aggpfkjj.exe
C:\Windows\system32\Aggpfkjj.exe
1⤵
- Modifies registry class
PID:9664
- C:\Windows\SysWOW64\Aonhghjl.exe
  C:\Windows\system32\Aonhghjl.exe
  2⤵
  PID:9544

C:\Windows\SysWOW64\Amqhbe32.exe
C:\Windows\system32\Amqhbe32.exe
1⤵
PID:9800
- C:\Windows\SysWOW64\Aaldccip.exe
  C:\Windows\system32\Aaldccip.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:9888

C:\Windows\SysWOW64\Ahfmpnql.exe
C:\Windows\system32\Ahfmpnql.exe
1⤵
PID:9956
- C:\Windows\SysWOW64\Akdilipp.exe
  C:\Windows\system32\Akdilipp.exe
  2⤵
  - Modifies registry class
  PID:10032
- - C:\Windows\SysWOW64\Aopemh32.exe
    C:\Windows\system32\Aopemh32.exe
    3⤵
    PID:10088

C:\Windows\SysWOW64\Aaoaic32.exe
C:\Windows\system32\Aaoaic32.exe
1⤵
PID:10140
- C:\Windows\SysWOW64\Apaadpng.exe
  C:\Windows\system32\Apaadpng.exe
  2⤵
  PID:10224
- - C:\Windows\SysWOW64\Bhhiemoj.exe
    C:\Windows\system32\Bhhiemoj.exe
    3⤵
    PID:9308
  - - C:\Windows\SysWOW64\Bmeandma.exe
      C:\Windows\system32\Bmeandma.exe
      4⤵
      Drops file in System32 directory
      PID:9428

C:\Windows\SysWOW64\Baannc32.exe
C:\Windows\system32\Baannc32.exe
1⤵
PID:9504
- C:\Windows\SysWOW64\Bdojjo32.exe
  C:\Windows\system32\Bdojjo32.exe
  2⤵
  PID:9636

C:\Windows\SysWOW64\Bgnffj32.exe
C:\Windows\system32\Bgnffj32.exe
1⤵
- Drops file in System32 directory
PID:9716
- C:\Windows\SysWOW64\Bkibgh32.exe
  C:\Windows\system32\Bkibgh32.exe
  2⤵
  PID:9808

C:\Windows\SysWOW64\Bmhocd32.exe
C:\Windows\system32\Bmhocd32.exe
1⤵
PID:9904
- C:\Windows\SysWOW64\Bpfkpp32.exe
  C:\Windows\system32\Bpfkpp32.exe
  2⤵
  PID:10008
- - C:\Windows\SysWOW64\Bhmbqm32.exe
    C:\Windows\system32\Bhmbqm32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Drops file in System32 directory
    PID:10132

C:\Windows\SysWOW64\Bgpcliao.exe
C:\Windows\system32\Bgpcliao.exe
1⤵
PID:10196
- C:\Windows\SysWOW64\Bogkmgba.exe
  C:\Windows\system32\Bogkmgba.exe
  2⤵
  PID:3976
- - C:\Windows\SysWOW64\Baegibae.exe
    C:\Windows\system32\Baegibae.exe
    3⤵
    PID:9468
  - - C:\Windows\SysWOW64\Bhpofl32.exe
      C:\Windows\system32\Bhpofl32.exe
      4⤵
      Drops file in System32 directory
      PID:3632
    - - C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        5⤵
        Modifies registry class
        
        PID:9736

C:\Windows\SysWOW64\Bpkdjofm.exe
C:\Windows\system32\Bpkdjofm.exe
1⤵
PID:3440
- C:\Windows\SysWOW64\Bhblllfo.exe
  C:\Windows\system32\Bhblllfo.exe
  2⤵
  PID:10128
- - C:\Windows\SysWOW64\Bkphhgfc.exe
    C:\Windows\system32\Bkphhgfc.exe
    3⤵
    PID:2780

C:\Windows\SysWOW64\Cpmapodj.exe
C:\Windows\system32\Cpmapodj.exe
1⤵
PID:9692
- C:\Windows\SysWOW64\Chdialdl.exe
  C:\Windows\system32\Chdialdl.exe
  2⤵
  PID:768

C:\Windows\SysWOW64\Ckbemgcp.exe
C:\Windows\system32\Ckbemgcp.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:10056
- C:\Windows\SysWOW64\Cnaaib32.exe
  C:\Windows\system32\Cnaaib32.exe
  2⤵
  PID:9500
- - C:\Windows\SysWOW64\Cponen32.exe
    C:\Windows\system32\Cponen32.exe
    3⤵
    - Drops file in System32 directory
    PID:9676

C:\Windows\SysWOW64\Chfegk32.exe
C:\Windows\system32\Chfegk32.exe
1⤵
PID:10004
- C:\Windows\SysWOW64\Ckebcg32.exe
  C:\Windows\system32\Ckebcg32.exe
  2⤵
  PID:9304
- - C:\Windows\SysWOW64\Coqncejg.exe
    C:\Windows\system32\Coqncejg.exe
    3⤵
    PID:3676
  - - C:\Windows\SysWOW64\Coegoe32.exe
      C:\Windows\system32\Coegoe32.exe
      4⤵
      PID:10112
    - - C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9588
      - C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        6⤵
        Modifies registry class
        
        PID:9260

C:\Windows\SysWOW64\Boldhf32.exe
C:\Windows\system32\Boldhf32.exe
1⤵
- Modifies registry class
PID:9444

C:\Windows\SysWOW64\Cklhcfle.exe
C:\Windows\system32\Cklhcfle.exe
1⤵
PID:10252
- C:\Windows\SysWOW64\Cnjdpaki.exe
  C:\Windows\system32\Cnjdpaki.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:10296
- - C:\Windows\SysWOW64\Dddllkbf.exe
    C:\Windows\system32\Dddllkbf.exe
    3⤵
    PID:10340
  - - C:\Windows\SysWOW64\Dojqjdbl.exe
      C:\Windows\system32\Dojqjdbl.exe
      4⤵
      Drops file in System32 directory
      PID:10384
    - - C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10424
      - C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        6⤵
        
        PID:10472

C:\Windows\SysWOW64\Ddifgk32.exe
C:\Windows\system32\Ddifgk32.exe
1⤵
PID:10512
- C:\Windows\SysWOW64\Dhdbhifj.exe
  C:\Windows\system32\Dhdbhifj.exe
  2⤵
  PID:10552

C:\Windows\SysWOW64\Dkcndeen.exe
C:\Windows\system32\Dkcndeen.exe
1⤵
PID:10588
- C:\Windows\SysWOW64\Doojec32.exe
  C:\Windows\system32\Doojec32.exe
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  PID:10632

C:\Windows\SysWOW64\Dqpfmlce.exe
C:\Windows\system32\Dqpfmlce.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:10680
- C:\Windows\SysWOW64\Ddkbmj32.exe
  C:\Windows\system32\Ddkbmj32.exe
  2⤵
  PID:10724

C:\Windows\SysWOW64\Doagjc32.exe
C:\Windows\system32\Doagjc32.exe
1⤵
PID:10804
- C:\Windows\SysWOW64\Dqbcbkab.exe
  C:\Windows\system32\Dqbcbkab.exe
  2⤵
  PID:10848
- - C:\Windows\SysWOW64\Ddnobj32.exe
    C:\Windows\system32\Ddnobj32.exe
    3⤵
    - Drops file in System32 directory
    PID:10892

C:\Windows\SysWOW64\Dglkoeio.exe
C:\Windows\system32\Dglkoeio.exe
1⤵
PID:10932
- C:\Windows\SysWOW64\Doccpcja.exe
  C:\Windows\system32\Doccpcja.exe
  2⤵
  PID:10968

C:\Windows\SysWOW64\Ebaplnie.exe
C:\Windows\system32\Ebaplnie.exe
1⤵
PID:11008
- C:\Windows\SysWOW64\Eqdpgk32.exe
  C:\Windows\system32\Eqdpgk32.exe
  2⤵
  - Drops file in System32 directory
  PID:11052

C:\Windows\SysWOW64\Ehlhih32.exe
C:\Windows\system32\Ehlhih32.exe
1⤵
- Drops file in System32 directory
PID:11096
- C:\Windows\SysWOW64\Egohdegl.exe
  C:\Windows\system32\Egohdegl.exe
  2⤵
  PID:11140

C:\Windows\SysWOW64\Eoepebho.exe
C:\Windows\system32\Eoepebho.exe
1⤵
PID:11180
- C:\Windows\SysWOW64\Enhpao32.exe
  C:\Windows\system32\Enhpao32.exe
  2⤵
  PID:11224

C:\Windows\SysWOW64\Eqgmmk32.exe
C:\Windows\system32\Eqgmmk32.exe
1⤵
PID:9604
- C:\Windows\SysWOW64\Ehndnh32.exe
  C:\Windows\system32\Ehndnh32.exe
  2⤵
  PID:10292
- - C:\Windows\SysWOW64\Eklajcmc.exe
    C:\Windows\system32\Eklajcmc.exe
    3⤵
    - Modifies registry class
    PID:10364
  - - C:\Windows\SysWOW64\Enkmfolf.exe
      C:\Windows\system32\Enkmfolf.exe
      4⤵
      PID:10432

C:\Windows\SysWOW64\Eqiibjlj.exe
C:\Windows\system32\Eqiibjlj.exe
1⤵
PID:10504
- C:\Windows\SysWOW64\Egcaod32.exe
  C:\Windows\system32\Egcaod32.exe
  2⤵
  - Modifies registry class
  PID:10576
- - C:\Windows\SysWOW64\Eojiqb32.exe
    C:\Windows\system32\Eojiqb32.exe
    3⤵
    PID:10640
  - - C:\Windows\SysWOW64\Eqlfhjig.exe
      C:\Windows\system32\Eqlfhjig.exe
      4⤵
      PID:10720

C:\Windows\SysWOW64\Ehbnigjj.exe
C:\Windows\system32\Ehbnigjj.exe
1⤵
- Modifies registry class
PID:10796
- C:\Windows\SysWOW64\Eomffaag.exe
  C:\Windows\system32\Eomffaag.exe
  2⤵
  PID:10832
- - C:\Windows\SysWOW64\Ebkbbmqj.exe
    C:\Windows\system32\Ebkbbmqj.exe
    3⤵
    PID:10924

C:\Windows\SysWOW64\Eqncnj32.exe
C:\Windows\system32\Eqncnj32.exe
1⤵
PID:10748
- C:\Windows\SysWOW64\Eiekog32.exe
  C:\Windows\system32\Eiekog32.exe
  2⤵
  - Modifies registry class
  PID:11036
- - C:\Windows\SysWOW64\Ekcgkb32.exe
    C:\Windows\system32\Ekcgkb32.exe
    3⤵
    PID:11136
  - - C:\Windows\SysWOW64\Foapaa32.exe
      C:\Windows\system32\Foapaa32.exe
      4⤵
      PID:11188

C:\Windows\SysWOW64\Fndpmndl.exe
C:\Windows\system32\Fndpmndl.exe
1⤵
- Modifies registry class
PID:11236
- C:\Windows\SysWOW64\Fqbliicp.exe
  C:\Windows\system32\Fqbliicp.exe
  2⤵
  PID:10244

C:\Windows\SysWOW64\Fdnhih32.exe
C:\Windows\system32\Fdnhih32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:10376
- C:\Windows\SysWOW64\Fgmdec32.exe
  C:\Windows\system32\Fgmdec32.exe
  2⤵
  - Modifies registry class
  PID:10492

C:\Windows\SysWOW64\Foclgq32.exe
C:\Windows\system32\Foclgq32.exe
1⤵
PID:10620
- C:\Windows\SysWOW64\Fnfmbmbi.exe
  C:\Windows\system32\Fnfmbmbi.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Modifies registry class
  PID:4520
- - C:\Windows\SysWOW64\Feqeog32.exe
    C:\Windows\system32\Feqeog32.exe
    3⤵
    PID:10840
  - - C:\Windows\SysWOW64\Fgoakc32.exe
      C:\Windows\system32\Fgoakc32.exe
      4⤵
      PID:10964

C:\Windows\SysWOW64\Fofilp32.exe
C:\Windows\system32\Fofilp32.exe
1⤵
PID:11040
- C:\Windows\SysWOW64\Fniihmpf.exe
  C:\Windows\system32\Fniihmpf.exe
  2⤵
  PID:11148
- - C:\Windows\SysWOW64\Fecadghc.exe
    C:\Windows\system32\Fecadghc.exe
    3⤵
    PID:11232

C:\Windows\SysWOW64\Fganqbgg.exe
C:\Windows\system32\Fganqbgg.exe
1⤵
PID:10268
- C:\Windows\SysWOW64\Fohfbpgi.exe
  C:\Windows\system32\Fohfbpgi.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:1972

C:\Windows\SysWOW64\Fnkfmm32.exe
C:\Windows\system32\Fnkfmm32.exe
1⤵
PID:10688
- C:\Windows\SysWOW64\Fajbjh32.exe
  C:\Windows\system32\Fajbjh32.exe
  2⤵
  PID:10816
- - C:\Windows\SysWOW64\Fiqjke32.exe
    C:\Windows\system32\Fiqjke32.exe
    3⤵
    PID:11032

C:\Windows\SysWOW64\Fkofga32.exe
C:\Windows\system32\Fkofga32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11172
- C:\Windows\SysWOW64\Gokbgpeg.exe
  C:\Windows\system32\Gokbgpeg.exe
  2⤵
  PID:10356

C:\Windows\SysWOW64\Gbiockdj.exe
C:\Windows\system32\Gbiockdj.exe
1⤵
PID:10600
- C:\Windows\SysWOW64\Galoohke.exe
  C:\Windows\system32\Galoohke.exe
  2⤵
  PID:11104

C:\Windows\SysWOW64\Gpmomo32.exe
C:\Windows\system32\Gpmomo32.exe
1⤵
PID:10788
- C:\Windows\SysWOW64\Gnpphljo.exe
  C:\Windows\system32\Gnpphljo.exe
  2⤵
  PID:11208

C:\Windows\SysWOW64\Ganldgib.exe
C:\Windows\system32\Ganldgib.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:10532
- C:\Windows\SysWOW64\Giecfejd.exe
  C:\Windows\system32\Giecfejd.exe
  2⤵
  PID:11164

C:\Windows\SysWOW64\Gghdaa32.exe
C:\Windows\system32\Gghdaa32.exe
1⤵
PID:10792
- C:\Windows\SysWOW64\Gnblnlhl.exe
  C:\Windows\system32\Gnblnlhl.exe
  2⤵
  PID:1144
- - C:\Windows\SysWOW64\Gbnhoj32.exe
    C:\Windows\system32\Gbnhoj32.exe
    3⤵
    PID:11280

C:\Windows\SysWOW64\Geldkfpi.exe
C:\Windows\system32\Geldkfpi.exe
1⤵
PID:11328
- C:\Windows\SysWOW64\Glfmgp32.exe
  C:\Windows\system32\Glfmgp32.exe
  2⤵
  - Modifies registry class
  PID:11372

C:\Windows\SysWOW64\Gacepg32.exe
C:\Windows\system32\Gacepg32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11492
- C:\Windows\SysWOW64\Gijmad32.exe
  C:\Windows\system32\Gijmad32.exe
  2⤵
  PID:11536
- - C:\Windows\SysWOW64\Gpdennml.exe
    C:\Windows\system32\Gpdennml.exe
    3⤵
    PID:11576
  - - C:\Windows\SysWOW64\Gaebef32.exe
      C:\Windows\system32\Gaebef32.exe
      4⤵
      PID:11616
    - - C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        5⤵
        
        PID:11660

C:\Windows\SysWOW64\Hlkfbocp.exe
C:\Windows\system32\Hlkfbocp.exe
1⤵
PID:11704
- C:\Windows\SysWOW64\Hnibokbd.exe
  C:\Windows\system32\Hnibokbd.exe
  2⤵
  PID:11748
- - C:\Windows\SysWOW64\Hecjke32.exe
    C:\Windows\system32\Hecjke32.exe
    3⤵
    PID:11792
  - - C:\Windows\SysWOW64\Hioflcbj.exe
      C:\Windows\system32\Hioflcbj.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:11832

C:\Windows\SysWOW64\Hpioin32.exe
C:\Windows\system32\Hpioin32.exe
1⤵
PID:11864
- C:\Windows\SysWOW64\Hbgkei32.exe
  C:\Windows\system32\Hbgkei32.exe
  2⤵
  PID:11912
- - C:\Windows\SysWOW64\Hiacacpg.exe
    C:\Windows\system32\Hiacacpg.exe
    3⤵
    PID:11952

C:\Windows\SysWOW64\Hlppno32.exe
C:\Windows\system32\Hlppno32.exe
1⤵
PID:12000
- C:\Windows\SysWOW64\Hnnljj32.exe
  C:\Windows\system32\Hnnljj32.exe
  2⤵
  PID:12048

C:\Windows\SysWOW64\Halhfe32.exe
C:\Windows\system32\Halhfe32.exe
1⤵
- Drops file in System32 directory
PID:12088
- C:\Windows\SysWOW64\Hehdfdek.exe
  C:\Windows\system32\Hehdfdek.exe
  2⤵
  PID:12128

C:\Windows\SysWOW64\Hhfpbpdo.exe
C:\Windows\system32\Hhfpbpdo.exe
1⤵
PID:12172
- C:\Windows\SysWOW64\Hpmhdmea.exe
  C:\Windows\system32\Hpmhdmea.exe
  2⤵
  - Drops file in System32 directory
  PID:12216
- - C:\Windows\SysWOW64\Hnphoj32.exe
    C:\Windows\system32\Hnphoj32.exe
    3⤵
    PID:12252

C:\Windows\SysWOW64\Haodle32.exe
C:\Windows\system32\Haodle32.exe
1⤵
PID:10336
- C:\Windows\SysWOW64\Hifmmb32.exe
  C:\Windows\system32\Hifmmb32.exe
  2⤵
  - Drops file in System32 directory
  PID:11336
- - C:\Windows\SysWOW64\Hldiinke.exe
    C:\Windows\system32\Hldiinke.exe
    3⤵
    PID:11408

C:\Windows\SysWOW64\Hbnaeh32.exe
C:\Windows\system32\Hbnaeh32.exe
1⤵
- Drops file in System32 directory
PID:11488
- C:\Windows\SysWOW64\Hemmac32.exe
  C:\Windows\system32\Hemmac32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  PID:11564
- - C:\Windows\SysWOW64\Ihkjno32.exe
    C:\Windows\system32\Ihkjno32.exe
    3⤵
    - Modifies registry class
    PID:11396

C:\Windows\SysWOW64\Ibqnkh32.exe
C:\Windows\system32\Ibqnkh32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11560
- C:\Windows\SysWOW64\Iijfhbhl.exe
  C:\Windows\system32\Iijfhbhl.exe
  2⤵
  PID:11828
- - C:\Windows\SysWOW64\Ihmfco32.exe
    C:\Windows\system32\Ihmfco32.exe
    3⤵
    PID:11872

C:\Windows\SysWOW64\Ibcjqgnm.exe
C:\Windows\system32\Ibcjqgnm.exe
1⤵
PID:11992
- C:\Windows\SysWOW64\Iafkld32.exe
  C:\Windows\system32\Iafkld32.exe
  2⤵
  PID:12036

C:\Windows\SysWOW64\Iahgad32.exe
C:\Windows\system32\Iahgad32.exe
1⤵
PID:12264
- C:\Windows\SysWOW64\Ieccbbkn.exe
  C:\Windows\system32\Ieccbbkn.exe
  2⤵
  PID:11316

C:\Windows\SysWOW64\Ihbponja.exe
C:\Windows\system32\Ihbponja.exe
1⤵
PID:11432
- C:\Windows\SysWOW64\Ilnlom32.exe
  C:\Windows\system32\Ilnlom32.exe
  2⤵
  PID:11528

C:\Windows\SysWOW64\Ibgdlg32.exe
C:\Windows\system32\Ibgdlg32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:440
- C:\Windows\SysWOW64\Iajdgcab.exe
  C:\Windows\system32\Iajdgcab.exe
  2⤵
  PID:11740
- - C:\Windows\SysWOW64\Iialhaad.exe
    C:\Windows\system32\Iialhaad.exe
    3⤵
    PID:11820

C:\Windows\SysWOW64\Ihdldn32.exe
C:\Windows\system32\Ihdldn32.exe
1⤵
- Executes dropped EXE
PID:2928
- C:\Windows\SysWOW64\Ipkdek32.exe
  C:\Windows\system32\Ipkdek32.exe
  2⤵
  PID:11944

C:\Windows\SysWOW64\Ibjqaf32.exe
C:\Windows\system32\Ibjqaf32.exe
1⤵
PID:12044
- C:\Windows\SysWOW64\Iehmmb32.exe
  C:\Windows\system32\Iehmmb32.exe
  2⤵
  PID:12136

C:\Windows\SysWOW64\Jhgiim32.exe
C:\Windows\system32\Jhgiim32.exe
1⤵
- Executes dropped EXE
PID:3220
- C:\Windows\SysWOW64\Jpnakk32.exe
  C:\Windows\system32\Jpnakk32.exe
  2⤵
  PID:12268

C:\Windows\SysWOW64\Jblmgf32.exe
C:\Windows\system32\Jblmgf32.exe
1⤵
PID:11380
- C:\Windows\SysWOW64\Jekjcaef.exe
  C:\Windows\system32\Jekjcaef.exe
  2⤵
  PID:11604
- - C:\Windows\SysWOW64\Jifecp32.exe
    C:\Windows\system32\Jifecp32.exe
    3⤵
    PID:11712

C:\Windows\SysWOW64\Jldbpl32.exe
C:\Windows\system32\Jldbpl32.exe
1⤵
PID:4008
- C:\Windows\SysWOW64\Jocnlg32.exe
  C:\Windows\system32\Jocnlg32.exe
  2⤵
  PID:11968
- - C:\Windows\SysWOW64\Jaajhb32.exe
    C:\Windows\system32\Jaajhb32.exe
    3⤵
    PID:2104

C:\Windows\SysWOW64\Jemfhacc.exe
C:\Windows\system32\Jemfhacc.exe
1⤵
PID:12108
- C:\Windows\SysWOW64\Jhkbdmbg.exe
  C:\Windows\system32\Jhkbdmbg.exe
  2⤵
  PID:11392

C:\Windows\SysWOW64\Jlgoek32.exe
C:\Windows\system32\Jlgoek32.exe
1⤵
PID:11544
- C:\Windows\SysWOW64\Jbagbebm.exe
  C:\Windows\system32\Jbagbebm.exe
  2⤵
  PID:5116
- - C:\Windows\SysWOW64\Jikoopij.exe
    C:\Windows\system32\Jikoopij.exe
    3⤵
    - Executes dropped EXE
    PID:4312
  - - C:\Windows\SysWOW64\Jlikkkhn.exe
      C:\Windows\system32\Jlikkkhn.exe
      4⤵
      PID:12040

C:\Windows\SysWOW64\Johggfha.exe
C:\Windows\system32\Johggfha.exe
1⤵
PID:12236
- C:\Windows\SysWOW64\Jbccge32.exe
  C:\Windows\system32\Jbccge32.exe
  2⤵
  PID:11516

C:\Windows\SysWOW64\Jeapcq32.exe
C:\Windows\system32\Jeapcq32.exe
1⤵
PID:3964
- C:\Windows\SysWOW64\Jimldogg.exe
  C:\Windows\system32\Jimldogg.exe
  2⤵
  PID:2900
- - C:\Windows\SysWOW64\Jllhpkfk.exe
    C:\Windows\system32\Jllhpkfk.exe
    3⤵
    PID:5096

C:\Windows\SysWOW64\Jbepme32.exe
C:\Windows\system32\Jbepme32.exe
1⤵
PID:11908
- C:\Windows\SysWOW64\Kedlip32.exe
  C:\Windows\system32\Kedlip32.exe
  2⤵
  PID:12244
- - C:\Windows\SysWOW64\Khbiello.exe
    C:\Windows\system32\Khbiello.exe
    3⤵
    PID:2700

C:\Windows\SysWOW64\Kefiopki.exe
C:\Windows\system32\Kefiopki.exe
1⤵
PID:11760
- C:\Windows\SysWOW64\Kheekkjl.exe
  C:\Windows\system32\Kheekkjl.exe
  2⤵
  PID:12284

C:\Windows\SysWOW64\Kplmliko.exe
C:\Windows\system32\Kplmliko.exe
1⤵
PID:4972
- C:\Windows\SysWOW64\Koonge32.exe
  C:\Windows\system32\Koonge32.exe
  2⤵
  PID:3924

C:\Windows\SysWOW64\Kcjjhdjb.exe
C:\Windows\system32\Kcjjhdjb.exe
1⤵
PID:2264
- C:\Windows\SysWOW64\Keifdpif.exe
  C:\Windows\system32\Keifdpif.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  PID:1592

C:\Windows\SysWOW64\Kpnjah32.exe
C:\Windows\system32\Kpnjah32.exe
1⤵
PID:3652
- C:\Windows\SysWOW64\Kcmfnd32.exe
  C:\Windows\system32\Kcmfnd32.exe
  2⤵
  PID:12332

C:\Windows\SysWOW64\Khiofk32.exe
C:\Windows\system32\Khiofk32.exe
1⤵
PID:12424
- C:\Windows\SysWOW64\Klekfinp.exe
  C:\Windows\system32\Klekfinp.exe
  2⤵
  PID:12464

C:\Windows\SysWOW64\Kcapicdj.exe
C:\Windows\system32\Kcapicdj.exe
1⤵
PID:12720
- C:\Windows\SysWOW64\Lepleocn.exe
  C:\Windows\system32\Lepleocn.exe
  2⤵
  PID:12764

C:\Windows\SysWOW64\Lljdai32.exe
C:\Windows\system32\Lljdai32.exe
1⤵
PID:12804
- C:\Windows\SysWOW64\Lohqnd32.exe
  C:\Windows\system32\Lohqnd32.exe
  2⤵
  PID:12848

C:\Windows\SysWOW64\Lindkm32.exe
C:\Windows\system32\Lindkm32.exe
1⤵
PID:12924
- C:\Windows\SysWOW64\Lhqefjpo.exe
  C:\Windows\system32\Lhqefjpo.exe
  2⤵
  PID:12960

C:\Windows\SysWOW64\Lpgmhg32.exe
C:\Windows\system32\Lpgmhg32.exe
1⤵
PID:12996
- C:\Windows\SysWOW64\Lojmcdgl.exe
  C:\Windows\system32\Lojmcdgl.exe
  2⤵
  PID:13032

C:\Windows\SysWOW64\Laiipofp.exe
C:\Windows\system32\Laiipofp.exe
1⤵
PID:13068
- C:\Windows\SysWOW64\Ljpaqmgb.exe
  C:\Windows\system32\Ljpaqmgb.exe
  2⤵
  PID:13104
- - C:\Windows\SysWOW64\Llnnmhfe.exe
    C:\Windows\system32\Llnnmhfe.exe
    3⤵
    PID:13140
  - - C:\Windows\SysWOW64\Lomjicei.exe
      C:\Windows\system32\Lomjicei.exe
      4⤵
      PID:13176

C:\Windows\SysWOW64\Legben32.exe
C:\Windows\system32\Legben32.exe
1⤵
PID:13212
- C:\Windows\SysWOW64\Lhenai32.exe
  C:\Windows\system32\Lhenai32.exe
  2⤵
  PID:13248
- - C:\Windows\SysWOW64\Llqjbhdc.exe
    C:\Windows\system32\Llqjbhdc.exe
    3⤵
    PID:13284
  - - C:\Windows\SysWOW64\Lckboblp.exe
      C:\Windows\system32\Lckboblp.exe
      4⤵
      PID:4072

C:\Windows\SysWOW64\Lfiokmkc.exe
C:\Windows\system32\Lfiokmkc.exe
1⤵
PID:12312
- C:\Windows\SysWOW64\Lhgkgijg.exe
  C:\Windows\system32\Lhgkgijg.exe
  2⤵
  PID:12356
- - C:\Windows\SysWOW64\Lpochfji.exe
    C:\Windows\system32\Lpochfji.exe
    3⤵
    PID:12420

C:\Windows\SysWOW64\Loacdc32.exe
C:\Windows\system32\Loacdc32.exe
1⤵
- Executes dropped EXE
PID:2648
- C:\Windows\SysWOW64\Mfkkqmiq.exe
  C:\Windows\system32\Mfkkqmiq.exe
  2⤵
  PID:12504
- - C:\Windows\SysWOW64\Mjggal32.exe
    C:\Windows\system32\Mjggal32.exe
    3⤵
    PID:12556
  - - C:\Windows\SysWOW64\Mpapnfhg.exe
      C:\Windows\system32\Mpapnfhg.exe
      4⤵
      PID:12576
    - - C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        5⤵
        
        PID:12644
      - C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        6⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1812

C:\Windows\SysWOW64\Nmaciefp.exe
C:\Windows\system32\Nmaciefp.exe
1⤵
PID:12992

C:\Windows\SysWOW64\Nckkfp32.exe
C:\Windows\system32\Nckkfp32.exe
1⤵
PID:13132
- C:\Windows\SysWOW64\Nfihbk32.exe
  C:\Windows\system32\Nfihbk32.exe
  2⤵
  PID:13220

C:\Windows\SysWOW64\Nfldgk32.exe
C:\Windows\system32\Nfldgk32.exe
1⤵
PID:12540
- C:\Windows\SysWOW64\Nijqcf32.exe
  C:\Windows\system32\Nijqcf32.exe
  2⤵
  PID:2052

C:\Windows\SysWOW64\Nmfmde32.exe
C:\Windows\system32\Nmfmde32.exe
1⤵
PID:12660
- C:\Windows\SysWOW64\Nodiqp32.exe
  C:\Windows\system32\Nodiqp32.exe
  2⤵
  PID:4544

C:\Windows\SysWOW64\Nbbeml32.exe
C:\Windows\system32\Nbbeml32.exe
1⤵
PID:12820
- C:\Windows\SysWOW64\Nfnamjhk.exe
  C:\Windows\system32\Nfnamjhk.exe
  2⤵
  PID:2380

C:\Windows\SysWOW64\Nqcejcha.exe
C:\Windows\system32\Nqcejcha.exe
1⤵
PID:12912
- C:\Windows\SysWOW64\Nbebbk32.exe
  C:\Windows\system32\Nbebbk32.exe
  2⤵
  PID:12948

C:\Windows\SysWOW64\Nmjfodne.exe
C:\Windows\system32\Nmjfodne.exe
1⤵
PID:13268
- C:\Windows\SysWOW64\Ooibkpmi.exe
  C:\Windows\system32\Ooibkpmi.exe
  2⤵
  PID:12320
- - C:\Windows\SysWOW64\Ocdnln32.exe
    C:\Windows\system32\Ocdnln32.exe
    3⤵
    PID:536
  - - C:\Windows\SysWOW64\Objkmkjj.exe
      C:\Windows\system32\Objkmkjj.exe
      4⤵
      PID:5348

C:\Windows\SysWOW64\Ocihgnam.exe
C:\Windows\system32\Ocihgnam.exe
1⤵
- Executes dropped EXE
PID:1076
- C:\Windows\SysWOW64\Ofgdcipq.exe
  C:\Windows\system32\Ofgdcipq.exe
  2⤵
  PID:12896

C:\Windows\SysWOW64\Oifppdpd.exe
C:\Windows\system32\Oifppdpd.exe
1⤵
PID:13060
- C:\Windows\SysWOW64\Omalpc32.exe
  C:\Windows\system32\Omalpc32.exe
  2⤵
  PID:13196

C:\Windows\SysWOW64\Obnehj32.exe
C:\Windows\system32\Obnehj32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5136
- C:\Windows\SysWOW64\Ojemig32.exe
  C:\Windows\system32\Ojemig32.exe
  2⤵
  PID:5176

C:\Windows\SysWOW64\Pbcncibp.exe
C:\Windows\system32\Pbcncibp.exe
1⤵
PID:6128
- C:\Windows\SysWOW64\Pfojdh32.exe
  C:\Windows\system32\Pfojdh32.exe
  2⤵
  PID:5700

C:\Windows\SysWOW64\Pbekii32.exe
C:\Windows\system32\Pbekii32.exe
1⤵
PID:5912
- C:\Windows\SysWOW64\Pjlcjf32.exe
  C:\Windows\system32\Pjlcjf32.exe
  2⤵
  PID:12860

C:\Windows\SysWOW64\Pmkofa32.exe
C:\Windows\system32\Pmkofa32.exe
1⤵
PID:5148
- C:\Windows\SysWOW64\Ppikbm32.exe
  C:\Windows\system32\Ppikbm32.exe
  2⤵
  PID:5740

C:\Windows\SysWOW64\Pfepdg32.exe
C:\Windows\system32\Pfepdg32.exe
1⤵
PID:2968
- C:\Windows\SysWOW64\Pidlqb32.exe
  C:\Windows\system32\Pidlqb32.exe
  2⤵
  - Modifies registry class
  PID:5416
- - C:\Windows\SysWOW64\Pmphaaln.exe
    C:\Windows\system32\Pmphaaln.exe
    3⤵
    PID:5768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5976 -ip 5976
1⤵
PID:12416

C:\Windows\SysWOW64\Ppnenlka.exe
C:\Windows\system32\Ppnenlka.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1520

C:\Windows\SysWOW64\Pmmlla32.exe
C:\Windows\system32\Pmmlla32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5336

C:\Windows\SysWOW64\Piapkbeg.exe
C:\Windows\system32\Piapkbeg.exe
1⤵
PID:5352

C:\Windows\SysWOW64\Pfccogfc.exe
C:\Windows\system32\Pfccogfc.exe
1⤵
PID:12412

C:\Windows\SysWOW64\Pcegclgp.exe
C:\Windows\system32\Pcegclgp.exe
1⤵
PID:5780

C:\Windows\SysWOW64\Pcbkml32.exe
C:\Windows\system32\Pcbkml32.exe
1⤵
PID:5300

C:\Windows\SysWOW64\Padnaq32.exe
C:\Windows\system32\Padnaq32.exe
1⤵
PID:12732

C:\Windows\SysWOW64\Pimfpc32.exe
C:\Windows\system32\Pimfpc32.exe
1⤵
PID:5180

C:\Windows\SysWOW64\Ppdbgncl.exe
C:\Windows\system32\Ppdbgncl.exe
1⤵
PID:13096

C:\Windows\SysWOW64\Omfekbdh.exe
C:\Windows\system32\Omfekbdh.exe
1⤵
PID:13024

C:\Windows\SysWOW64\Ojhiogdd.exe
C:\Windows\system32\Ojhiogdd.exe
1⤵
PID:5512

C:\Windows\SysWOW64\Opbean32.exe
C:\Windows\system32\Opbean32.exe
1⤵
- Drops file in System32 directory
PID:5296

C:\Windows\SysWOW64\Oqmhqapg.exe
C:\Windows\system32\Oqmhqapg.exe
1⤵
PID:2208

C:\Windows\SysWOW64\Oiccje32.exe
C:\Windows\system32\Oiccje32.exe
1⤵
- Modifies registry class
PID:2024

C:\Windows\SysWOW64\Ofegni32.exe
C:\Windows\system32\Ofegni32.exe
1⤵
PID:5392

C:\Windows\SysWOW64\Niojoeel.exe
C:\Windows\system32\Niojoeel.exe
1⤵
PID:13172

C:\Windows\SysWOW64\Nfqnbjfi.exe
C:\Windows\system32\Nfqnbjfi.exe
1⤵
PID:13124

C:\Windows\SysWOW64\Noblkqca.exe
C:\Windows\system32\Noblkqca.exe
1⤵
PID:12452

C:\Windows\SysWOW64\Nqoloc32.exe
C:\Windows\system32\Nqoloc32.exe
1⤵
PID:2856

C:\Windows\SysWOW64\Nhhdnf32.exe
C:\Windows\system32\Nhhdnf32.exe
1⤵
PID:13292

C:\Windows\SysWOW64\Noppeaed.exe
C:\Windows\system32\Noppeaed.exe
1⤵
PID:13076

C:\Windows\SysWOW64\Lafmjp32.exe
C:\Windows\system32\Lafmjp32.exe
1⤵
PID:12888

C:\Windows\SysWOW64\Kofdhd32.exe
C:\Windows\system32\Kofdhd32.exe
1⤵
PID:12676

C:\Windows\SysWOW64\Klggli32.exe
C:\Windows\system32\Klggli32.exe
1⤵
PID:12628

C:\Windows\SysWOW64\Kiikpnmj.exe
C:\Windows\system32\Kiikpnmj.exe
1⤵
PID:12588

C:\Windows\SysWOW64\Kemooo32.exe
C:\Windows\system32\Kemooo32.exe
1⤵
PID:12544

C:\Windows\SysWOW64\Kcoccc32.exe
C:\Windows\system32\Kcoccc32.exe
1⤵
PID:12508

C:\Windows\SysWOW64\Kekbjo32.exe
C:\Windows\system32\Kekbjo32.exe
1⤵
PID:12380

C:\Windows\SysWOW64\Kolabf32.exe
C:\Windows\system32\Kolabf32.exe
1⤵
PID:3896

C:\Windows\SysWOW64\Klndfj32.exe
C:\Windows\system32\Klndfj32.exe
1⤵
PID:2212

C:\Windows\SysWOW64\Jojdlfeo.exe
C:\Windows\system32\Jojdlfeo.exe
1⤵
PID:11404

C:\Windows\SysWOW64\Iojkeh32.exe
C:\Windows\system32\Iojkeh32.exe
1⤵
PID:12200

C:\Windows\SysWOW64\Ilkoim32.exe
C:\Windows\system32\Ilkoim32.exe
1⤵
PID:12152

C:\Windows\SysWOW64\Iimcma32.exe
C:\Windows\system32\Iimcma32.exe
1⤵
PID:4212

C:\Windows\SysWOW64\Ipdndloi.exe
C:\Windows\system32\Ipdndloi.exe
1⤵
PID:4336

C:\Windows\SysWOW64\Inebjihf.exe
C:\Windows\system32\Inebjihf.exe
1⤵
PID:11688

C:\Windows\SysWOW64\Gbpedjnb.exe
C:\Windows\system32\Gbpedjnb.exe
1⤵
- Modifies registry class
PID:11448

C:\Windows\SysWOW64\Gpaihooo.exe
C:\Windows\system32\Gpaihooo.exe
1⤵
PID:11412

C:\Windows\SysWOW64\Ggfglb32.exe
C:\Windows\system32\Ggfglb32.exe
1⤵
- Drops file in System32 directory
PID:10348

C:\Windows\SysWOW64\Gicgpelg.exe
C:\Windows\system32\Gicgpelg.exe
1⤵
- Drops file in System32 directory
PID:11160

C:\Windows\SysWOW64\Dgjoif32.exe
C:\Windows\system32\Dgjoif32.exe
1⤵
PID:10764

C:\Windows\SysWOW64\Bnlhncgi.exe
C:\Windows\system32\Bnlhncgi.exe
1⤵
PID:9840

C:\Windows\SysWOW64\Pnplfj32.exe
C:\Windows\system32\Pnplfj32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:9560

C:\Windows\SysWOW64\Gehbjm32.exe
C:\Windows\system32\Gehbjm32.exe
1⤵
PID:7192

C:\Windows\SysWOW64\Dnmhpg32.exe
C:\Windows\system32\Dnmhpg32.exe
1⤵
PID:6752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aaldccip.exe

Path C:\Windows\SysWOW64\Aaldccip.exe
Size 80KB
SHA256 a9992d6c756c580d7bd1872c73dab8761efda0c3bc1b15dccd2647b417fd11e5
MD5 9693725f4e456da4e757323aa537f8ad
SHA1 e3f44ae0b563a6c6ae079854156910b3d914f9d5
SHA512 df31df29ff1ba0ec347dead4da5e8834232e39785542582728329a632c3a484e4768fcd9e9162322727d45b5b0176228ca8662821bb94af9654c0a3bf357e276
SSDEEP 1536:20R7o6mYFSWkVo3XJQ2LJwS5DUHRbPa9b6i+sIk:OjTVQJBGS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aflaie32.exe

Path C:\Windows\SysWOW64\Aflaie32.exe
Size 80KB
SHA256 22069790628c87ca6defa7d5737787f297e68897c86d8314c76f9690ac989a5e
MD5 b1403087dd271efe542566fbc4257133
SHA1 61d4578069ebe0781613c8662af299906558c90a
SHA512 f1228e6021ec942757e5ead7851a802624fc6e9ba853c4c1b0b42a44707c611f157d5b0e2047b54a82edd9e980ac64abdd1b555c1860f74726f19459f8421a49
SSDEEP 1536:8t/4dUHzWfEWZDL5VOx03D4IBgDS2L/S5DUHRbPa9b6i+sIk:K/4dUTWfEcDL5403U1j/S5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Afnnnd32.exe

Path C:\Windows\SysWOW64\Afnnnd32.exe
Size 80KB
SHA256 b482f7f1d86d2b81b8642a1608bbb89acb5c7b7e54452c2a07dff4aa50de7bb7
MD5 8effa63c6df924b9de8b62fb7d94be76
SHA1 35c715356bda4fb0261075ce0343441d5bab41e4
SHA512 a43404727ea122d56ca89fdf413d1345855f9b08e1dde3271ad2a6145eb2896867b2fdf5abc08fa4f5e8b9a438ab7358b76b7dbeb5bb4f149e4dbe7a4b15f2c4
SSDEEP 1536:qSgyXp20rm7xxjJNHgpWDukxL1yvffm+2LKS5DUHRbPa9b6i+sIk:1g2/Oxxj30nkxL2ffMKS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Amjbbfgo.exe

Path C:\Windows\SysWOW64\Amjbbfgo.exe
Size 80KB
SHA256 11e6cdeb4fdc92700180025997bbcdb8a8e5703e5c1cb330a941742f589dd1e1
MD5 d12d387bef9ca3a1a934fbf14533cfe2
SHA1 320be3553262991c7caa9a3cee19e5c038025eea
SHA512 83e4ef6ba6e6f0d8dcd6deacdebf948ec342b9d7e7061c150e281299a7e16d0ee92ddfa0062f220f6a2401862465df883bbcbba542945477e6fa41cec77dc38d
SSDEEP 1536:X3QJ+/ettR/d36jCqSkP28zzFi2LfIS5DUHRbPa9b6i+sIk:wJzJ/dQSkP2iwS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aobilkcl.exe

Path C:\Windows\SysWOW64\Aobilkcl.exe
Size 80KB
SHA256 8af195cff8cdb5dfbf160ada7b566ce4eba3c4dd98cf1de7897e942528cfdbb5
MD5 59df43b136cf2bad980520752b787314
SHA1 a46fa645f0adf84370962713c9c8bc2d2525f7e2
SHA512 4363f5ccf1f1e1f06240e5efd8a07634c0205d18d8737024f707d61365dca35a846593e2db2c637bcd9cec69ba15cc700fba485f2ec53bcdb9510e16d7aa7be3
SSDEEP 1536:vkpZdqWuGJLnCGh0pDFivcIIANcyL2LjS5DUHRbPa9b6i+sIk:v0dqGJLCGh0pLbjS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Aodfajaj.exe

Path C:\Windows\SysWOW64\Aodfajaj.exe
Size 80KB
SHA256 070912b4da89d504bf56a4160b751389e16900a57308f5c309e17e005991e3bd
MD5 759e5f5195285cbb782d9f25731e4a35
SHA1 479a8aba966d42dbcbad2ef874cbd4c7f634c4ab
SHA512 41ff89b2c950d4b9176eb33fee9b92afaf84460a8ce992418b567003bbe0964d0d7e3e0c8e80c966aa3f51865ad7d2fecde3457d60f4e0088f392113279f811a
SSDEEP 1536:Fx56LcJ15QSCYbfjlPw9hzjvqS592LzS5DUHRbPa9b6i+sIk:j0IJQk7lPw9ljFOzS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bhpofl32.exe

Path C:\Windows\SysWOW64\Bhpofl32.exe
Size 80KB
SHA256 eeea9284b63ca72c315b5e706ba454092be6d7b9b7ebf4ac4e37904b6d471086
MD5 9075cd651251e6a1a95c56dfc69ffde1
SHA1 62cf9a10f6f65e4523c9b77e2813ef1cdc3758a9
SHA512 f215da795385607795c1d151aa1bbfb2a9038475bdea2dd5cc4e0ee2952ad49e2339a399619f0efea82da104b92a20d194e2a92b6825e2eab82d04464d07e1d2
SSDEEP 1536:Z+EWhW3OOQ3ATNWSZ3qmKP4tMpw5yFPWOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOW:Z+EgW3DWSZ3NKPaMm0FPWOOOOOOOOOOZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Biadeoce.exe

Path C:\Windows\SysWOW64\Biadeoce.exe
Size 80KB
SHA256 b3b91dae6623457c57b77c2be4902f22d652b12939e930fda49b13dfef9297f8
MD5 b63772a87d4805340ad753cea1efbac7
SHA1 5b3eb0444d9b27d3e6487d17c930c1bcc5827c87
SHA512 fe62322221802493d2ddd5c639776c22d4334a33d8e173796e0112136ef9469131f16a3f59698da598ca44bb8e98760cf70f4d4741a58e46bd3c38cdfb666eaf
SSDEEP 1536:T56VU/Pa6khDK/6fNO+2wB2xZt7EYj2LIS5DUHRbPa9b6i+sIk:wMa6khm/6n2nNEIS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Boldhf32.exe

Path C:\Windows\SysWOW64\Boldhf32.exe
Size 80KB
SHA256 e716f3fdb980102fa94131df3b330f893ee927cd36865e0bd3987dd2fd067541
MD5 5bca32af84c32a2b315f68f0150e9197
SHA1 38b14886d73d3435539b945a35fc345ab2ccea7b
SHA512 66a7683d8559f1bb445093d2a8f31607d960cc0b6e358d289dc3e447ecfa563ed7695691ab22f4a4729776fd6e2172deb2fc9636546b42644568e7ced70d136f
SSDEEP 1536:4+D9dP3HrmSLfDWEW9fG+f92LDS5DUHRbPa9b6i+sIk:1D9ZD55+fODS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bqfoamfj.exe

Path C:\Windows\SysWOW64\Bqfoamfj.exe
Size 80KB
SHA256 2c8528ae676bc4c66094d7dfcb264eb525463a42548e0d7a012c9ee97b33e06a
MD5 1a609f2f6d972cb6af04115221855776
SHA1 ecfdf54d81a9163854c3c949c1cd325649fbaba2
SHA512 38cc21703311eeca285e035cb4a113c4ddfef32d53d5f8723374f0fcbd3c8dacb3f46d4fc890642eefb23c2a5f309cb838ae36533592843647a076f3cc33915f
SSDEEP 1536:nfD+BZt4oxQlSKJ3zW1RSH+tZB4io2LzS5DUHRbPa9b6i+sIk:7+BZioxQt3CiHy8i5zS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Coqncejg.exe

Path C:\Windows\SysWOW64\Coqncejg.exe
Size 80KB
SHA256 2b0a36e6a66abe7175ac720f42111798be28544630c1a5ff74aabd90bcd385c8
MD5 9a02562208b91a6dbc1354c520a886c8
SHA1 0ec2f609fa763ef74380e182d22c9bfdc5150a01
SHA512 24973d61eb9dbe24968df19d8b97305027a1e3708b17c67297e50488e1b0347636ec877aa3ede169f089e2f8b4fcfbf66d5a3e5d8f41613a2f6140d1c54947b5
SSDEEP 1536:nSwaEoky0KR01XLIdkmb/Ql/pemvFhRo/wcv2LC4S5DUHRbPa9b6i+sIk:n9aEBKRMIdbYl/pe0FhRo/j0C4S5DSCR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dglkoeio.exe

Path C:\Windows\SysWOW64\Dglkoeio.exe
Size 80KB
SHA256 90ba579baa9c2ce77110c78434127bd8c3c5ddfd034123bec7551ccec49d5ca5
MD5 3204387b93bbda8f7a56a5cec766f3cc
SHA1 4d73a19b1d485bf4cbfbf6f0c82b7692ad17558d
SHA512 01f51d84067c06ab93ad42734ffb79305378303a1522f72e096465960f875c1d3c59380e65acb5dc75bd07afafd3ca6823bb522077cf7b21a0a0f516cea25e3e
SSDEEP 1536:cWFG9OVBQWI0tDF+J2LsS5DUHRbPa9b6i+sIk:nIwDJsS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Doaneiop.exe

Path C:\Windows\SysWOW64\Doaneiop.exe
Size 20KB
SHA256 8b7b152a9e85c5b98563cb3a05fb9b12ec2e9fe5395d6edfafe535c14a185506
MD5 55de9a70651b0f42eebd85e52f2d2b79
SHA1 fdb2c1639a501103a90a086c38bec140b5110c15
SHA512 b9c43ab0328cd6f5d1a125addec341db4717b5d22b2cd6fddd0cd88439d2eaba6cfbb5cf6359b14eb20cbde749af0083effdaec26098c92474bb82aa71b41803
SSDEEP 384:YrRbjr3mAPbaudh4rj+7fnN61cNy4rD0vY20Scsn2cExTmu3WZ2ePsRk:YtfRaww+7PCcNy1JddAT3PAsRk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ekcgkb32.exe

Path C:\Windows\SysWOW64\Ekcgkb32.exe
Size 80KB
SHA256 97fb0f8ad69ff709711fed98c91c788375c49af20631480317d4d3b3644d416a
MD5 bb08ac3dddb8336be6fc6ab02160ee0f
SHA1 ac782c15fc38e29546600464b16d7c9a55be6c2d
SHA512 75b6b77d33e2373d52fda1c6029a57da82b68fd40dcd70809166b574df279cc2bd5697deb920e7b68a4d0d881d5c6ffd5e3d496b3fb76c374fe058907a8bc90b
SSDEEP 1536:Xviz8+aaBdFRQ3Zb8kDgcG4HHZ98iYi2LtS5DUHRbPa9b6i+sIk:R+5U3ZgGv+vtS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Eojiqb32.exe

Path C:\Windows\SysWOW64\Eojiqb32.exe
Size 80KB
SHA256 5eb97d376d8f9232c16d65f6ed2f8f29fc7d7da8441650a426fe53583677ba6b
MD5 72c61ec681db437ba4f53e944c15782b
SHA1 c1d88b0d289e1fffa8d5e2a90ceb673fc258b0ac
SHA512 1b3acce1381facb44b5e9a4b1da0d5ce2f228ad3fa6cf9e5998e5b9468a8d34495a605c45a14c82a2e84fda995e52ce40c7e88d884fe35d6c373c2304d7901dc
SSDEEP 1536:RnbqGDs3YnTSdeeFKAOw/Nj7kO2LTS5DUHRbPa9b6i+sIk:BbXDs8TSUcKAOCvkTTS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fajbjh32.exe

Path C:\Windows\SysWOW64\Fajbjh32.exe
Size 80KB
SHA256 86f7b7079b68f591446c5f23548d0d8859c2f53c4956b1de40fc82c0337109b4
MD5 f89728c7b691bd852cfdff91bd4b18d0
SHA1 c00b8b0629339c847552ee7dfb0ee8f25357d9e8
SHA512 15bd82b42fab7e922831f61bdad579a42a0e7344911b8d52e6bc4b505df92d7d1b7877024c9f7e84bcecef5573b404b1f0c5b0772ca04156259fa5405e0c90b8
SSDEEP 1536:Vky2DZU4IPbRxkdfx+2LE/S5DUHRbPa9b6i+sIk:V8DGLPkfxDaS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fecadghc.exe

Path C:\Windows\SysWOW64\Fecadghc.exe
Size 80KB
SHA256 875c38ce95d13bd9172917d15d9bde832f4113d4fee100d7f18d036d0ae1f1b3
MD5 5fcd5552f9b3da074d3eed7d7cb24b5e
SHA1 66806759179f22c80c052dabcfd29ec9d5669871
SHA512 a2ab8e674dc6e15cc21f6a3f585df8e5495eb5d488a4db2e0d2ee31a966ea8b03421bcdb329ad47836a388847d06c42bbc2311c2c4ee0f34ad353672913e6bda
SSDEEP 1536:T7bYY1Ea7kTCnzPxclIAWSbulR2DQ5rvKZ2LsS5DUHRbPa9b6i+sIk:cY1EawTCn7KlBbulbPsS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fnfmbmbi.exe

Path C:\Windows\SysWOW64\Fnfmbmbi.exe
Size 80KB
SHA256 07d0d9f407da82272c266492b074444f1944b43fbcd060074a63e3d97d1014f2
MD5 47968549616bcfcc4031c22d2b48b52e
SHA1 63971d9d516d73290a29895101b5c90cdcaa787a
SHA512 21ec3673ebf5a0d461e42f7afb863bfb6f86b4074709bfd0aab835bacc0d075e801b9c4422175c175d878fd034380f251677d76da5289eb991c6f2061ea71578
SSDEEP 1536:iI6iVnB0f3WNWLg4pLHtv2LqS5DUHRbPa9b6i+sIk:RVnutggLN0qS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gemkelcd.exe

Path C:\Windows\SysWOW64\Gemkelcd.exe
Size 80KB
SHA256 aa7d67a869a9459f8d9461c3d85b82df4c315834bcdec1a8ab72515dfb8bd62f
MD5 f44b77afb1956a54606ec13b4bc61519
SHA1 d5ca599f44b9ef324ef72173df8c4777671103db
SHA512 b2fb3cc18cbc81ddf2e1d9c1c4013e6ce3feb7c218735b075f4447024e2f7b89e4b5354cb80714859016cb3b7638eab047c5790bfb52d981b137efb054c05a39
SSDEEP 1536:8fgjuKEidELIRa9LxQ1n20Zxtg2LcS5DUHRbPa9b6i+sIk:K+ugh+LG1n261cS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gpdennml.exe

Path C:\Windows\SysWOW64\Gpdennml.exe
Size 80KB
SHA256 725d25d8adcdd7880202c1cb76cdd7597ce56e95848af9aa26fa2ba77d916dda
MD5 85924c69652f74a269b7769b969cdb98
SHA1 8a75c81d697533ec1633bfff1b939d742571dded
SHA512 e5fd9759085f65e91d52cdd664a3513c8dd457ebbd2c365c83cff003cb2592772c5bfe5cb3468c5664c324e5e590d9562a46964e48ba14f04eac9f19a590ee23
SSDEEP 1536:Ouzb2jiSIe3yO6ltZknRon2b6vS3HUJQ2LFS5DUHRbPa9b6i+sIk:OWijiSIe3rXb6K8FS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hbgkei32.exe

Path C:\Windows\SysWOW64\Hbgkei32.exe
Size 80KB
SHA256 abee5b63b5402c9ae106c669bd4559aa8f35e3420a0825b2cd0518922871e6f2
MD5 f6cf3c73dde4a00709c5efa73beeba7b
SHA1 7ff7f0287fe70f203bc3a14a4a1ed9d100ec8e33
SHA512 dc533ffea804f27287ded79dc752333a2bc1f7414b27fc7deb0b62e0ea4875b2dc573d71021cfbea5054e4ca287fa400a54d4ca032c4b1a1d4696edb1e4a41e8
SSDEEP 1536:GEi4y03bjawDnSIc6J0jgL/rlj22LprdS5DUHRbPa9b6i+sIk:0p03b+xjOddS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hblkjo32.exe

Path C:\Windows\SysWOW64\Hblkjo32.exe
Size 21KB
SHA256 3b65d9c0fa52769fe368ccc25cfb67939bc3a5dc48eb7eb6390dc550783b84c6
MD5 6344f8666214399d4ba693e756d9ea81
SHA1 4ecd8df6e59753b995cbc53cdbe96a3c15f7145c
SHA512 4d6b1b4ac7a029c89a00c8d77dd016856389fd0d60084a0b4f83ab947222c1243781ddac7f5a7cc826bcab78ce77ceff5910618a576b858f5c200c9dc8a184be
SSDEEP 384:AEAgWOVdxHJA+oZ+aMdgm6CN+uEFwWAQVbt8hbwokA+wlYawencI0xK2SWzDMA1T:AEAgWwd7foAa9m6F1lubzLnd0/t945w
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hioflcbj.exe

Path C:\Windows\SysWOW64\Hioflcbj.exe
Size 80KB
SHA256 0183011b523a0dd2bb15e2f6f37ac513660d77a6ed1bc89be3b3a8efb32ae353
MD5 2c77bbb120184f512653eb44c7f9c356
SHA1 79618f7e293816628723e5484c94c11832599964
SHA512 40d278513c5c18d07d7e452da16d67c2b52375fe58f0a72007e9e5f4c7373653611f62d3d9db23bd2f3859a6745b1ff9dc412a92d4bb5a1499265006ec81b346
SSDEEP 1536:SZTtaWmF9clbj0XbAcVFtLl2LqS5DUHRbPa9b6i+sIk:SZ5aKbWbBrLWqS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hnibokbd.exe

Path C:\Windows\SysWOW64\Hnibokbd.exe
Size 80KB
SHA256 e7dd30dc32802a0229aa4b1a5aeb1025072b3c570be2c0ecba5344bc3a5143c2
MD5 4a6643562c59f5104872a10c1809acc7
SHA1 b62f4e39849642d5eda5de3071d6cb0e5d1a65d7
SHA512 d2ec0d2c8953649801bc8fd1698624fe24dd459eb85ee3fd14b85c47a500630d2316c94bd92e86594c50c794d17f71e8ce294672729e0bce60442f9d9a757dff
SSDEEP 1536:xSUSSmU6e+T+QLckpnVfWsFNEWkb2LaS5DUHRbPa9b6i+sIk:CSmUYT3dHaS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hpiecd32.exe

Path C:\Windows\SysWOW64\Hpiecd32.exe
Size 80KB
SHA256 8504b816e15655e5401740b73ce8ffb2c6163f2dd89cbb42ab302ee5f5f3f55b
MD5 610fe73665c7afa7548b05e0ee459120
SHA1 eb4e97df2ce931da630bf32f13401dbdd21c534e
SHA512 06725d428c4ec26155e214213db64802629c75f7e696309e415911d7f54ed97c1819f4c645c69e67c1824487c5d81da37764b184236ae28ab3529e8bb3e08239
SSDEEP 1536:C4mpcT0WS6G/CMCuJjls60KgJagMa2LVS5DUHRbPa9b6i+sIk:C4m+TbrMdlpgCVS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ibjqaf32.exe

Path C:\Windows\SysWOW64\Ibjqaf32.exe
Size 52KB
SHA256 e30dcc9656d6eeb8871c078347151bf8ecdb72c7b9f1a57e4d5a9067ce72070e
MD5 daf730f92efffaf064e2bc91c437615f
SHA1 e1ef6226f2380ee73c314748d97ba8d16c643644
SHA512 e97a751028fa2e3a808295a974b4394c865956ed97ad6d393df95845bf0b64e12b07723073f1729345a86dafb1e9371d2a43915d5a9aa82f4df031c8de48ad4d
SSDEEP 768:fL9hLZ1bNjh5D1tFH6Hz1pZjkxdevNxKmd6ziHm2p/1H5ZI0XdA:x9rNjh5BT6Hz1Qxd2d9Hm2LY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ilnlom32.exe

Path C:\Windows\SysWOW64\Ilnlom32.exe
Size 80KB
SHA256 806d85cbf7284d9c8a77a09566ee2ce5ccda55162004a8e7a700d970b7613d17
MD5 ef6927e321b7313f0299ab94c076823d
SHA1 1eb1999729eab92aeae8e9e8b9d34dd8460e64bc
SHA512 8f16df1f665fad770117a1c956f4a3d6680a6a4be5867dc0f3399c33dcd2cd4c41cc3597f02048ab5f07897fd47af904a5ce91134b88ec704ab240ff4f32d38a
SSDEEP 1536:1fM95GZhOHfw8a6Bl/ju+WcsNJN2LBS5DUHRbPa9b6i+sIk:1fGGkftLju+WcsNgBS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jifecp32.exe

Path C:\Windows\SysWOW64\Jifecp32.exe
Size 80KB
SHA256 cfa51b1fc61835be99bce65cbbffb01e027cf5fdbb00ae28b37f433bed27f2f8
MD5 2de002385a89ba98ccd911e8ef8fdaec
SHA1 34646ad81131896e96b03696bf24fc28e02f2581
SHA512 ab8bd275451877122878bac1e868a465fef7d0e9e792b34e8caef51379cb2037dbd8c1b83039a03c3a784fb6b88a344b39f7d8826d7cd5f64d7462ef8701311b
SSDEEP 1536:RiJcATaVQsOIwwQcSSb3wv92LKS5DUHRbPa9b6i+sIk:R8ZFIWcS8AWKS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Johggfha.exe

Path C:\Windows\SysWOW64\Johggfha.exe
Size 80KB
SHA256 0c53da43763a617f7765e58df898007be1b1c02c3a726745379bb87ff7daec60
MD5 21696b78d34ae85b9dcf1069e163537e
SHA1 4682eebefcd903fdf75b9aea77d0fb0e8481f94b
SHA512 d5ab542648984a24bfe7f7f1919353aa6b0eb32a200946092987fb572e5ff7a63463fe9acae07cf76d0f27a53aa016ce1bb6232733fb33efdacd29dd39760fa4
SSDEEP 1536:eFvu4t2jY8g6/aLNDU9xXIQv5hKel5ZRLcd2LqS5DUHRbPa9b6i+sIk:qV8g6/aLNDU9xXIO5hKIdcuqS5DSCopI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Jpnakk32.exe

Path C:\Windows\SysWOW64\Jpnakk32.exe
Size 80KB
SHA256 56a688a4a7a7c76b09f4daf29e2957c14849ad4e23591a5ce948045c31df8d12
MD5 766f76d5caa1d75b2ad0f7f49917f3aa
SHA1 d38454f6edb820112a1bc80a2e65ded18b511204
SHA512 8b1fd6ae76d997d469ad7bfb87bd9f83b5c3d02344b2d2092e0f735b3afcd0036ade1120dd087dc43b8cabca0962daf8dd1d647ed49ab2ffe4fd9b7733975277
SSDEEP 1536:Qap/yJE+PmibgmivjRw1ab93mNqm2L3S5DUHRbPa9b6i+sIk:QPJJ1ivj24b93mN43S5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kcjjhdjb.exe

Path C:\Windows\SysWOW64\Kcjjhdjb.exe
Size 80KB
SHA256 b0d770f51a5f40157fffd8c2620288e26eaba43eb088009ce65f93dbd06efa0b
MD5 3fcde22c1145d967d2da0da07fc9bfb9
SHA1 0f75e3a61102820f356357e6ab88ac92885b8cae
SHA512 f28cb71471bc6e675339a62bfdac643c01de07baf65c82bb23d29c6a8717e5e87aef285a88df1fcf47b804e2dc24d025986850a4d37de1196a8f6c6288fe66c6
SSDEEP 1536:hCuJrsGxupWLfIYn/oX7Fuz2LTS5DUHRbPa9b6i+sIk:oihWcfIYorFPTS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kgnbdh32.exe

Path C:\Windows\SysWOW64\Kgnbdh32.exe
Size 7KB
SHA256 1390b65093ed8babca2b61b3015128dbf39df313b783cd7e2d5a44e0ff403d1a
MD5 50ed59187f5fd94423f072d1c53a0eec
SHA1 d13bb89487151ed1891b6c7e238fed1f8ca30076
SHA512 7227e08bf4fcef0d7506996392d4677e70aff47ae13f93f9ddc04c7f533e2041fda7a7025be4e32a986a7dda26fa7dc2b0e954561e5886394b2c6aa3bda3dfdc
SSDEEP 192:26iGLxHj4e/2gdk59eEqaBBWr/rHY4z7n9Np:2cd4eugKqaOrjLt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Klbnajqc.exe

Path C:\Windows\SysWOW64\Klbnajqc.exe
Size 80KB
SHA256 f197dc21951507d679ea8a6dcf4c34ea9c8d124f189f16638d70198bc77c98f9
MD5 9530187aa3c756a19e3eff82e5eaae9c
SHA1 64de355467ddc0d4cd8d37c8bf9ea640ec4193c1
SHA512 3d48dfd405cbcc9ee391bc9046b70b9e1b48a9bf20c7e50114bfff5867e5df9a374a24c5570a6d62b85a6710722d852b9a0b81e5d8b1e183fad2397e3a03af22
SSDEEP 1536:ecyeQU38XKe10sAayrSrWGVJlTKyMmn2LFS5DUHRbPa9b6i+sIk:ieQge10s/rWLrFS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kmdqgd32.exe

Path C:\Windows\SysWOW64\Kmdqgd32.exe
Size 33KB
SHA256 8ad68f48a376379debac52e779a658f069f8f62ea3befda35b702bfddcd4bff3
MD5 87e96d7bff5c9dae1d10eb2173d872ef
SHA1 6a7b3da332ece110d5ce7b29de88cf21196fb0fa
SHA512 e462ba3eb1d35cc3eeb42c12b9eed149490b3669fb3a5d36c31b5eb977b8286c63313b433ae7496de92a5621fc24d1f8f26da9fd48c1849412907889521efd7a
SSDEEP 768:BHPxRVxAEvVaLMtcYyhkjukP5wdHrdA9vyjJ1bevFPXIh3:BZRVSOkLM2YpjlRwdHrGvyVkF/Ih3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kmdqgd32.exe

Path C:\Windows\SysWOW64\Kmdqgd32.exe
Size 26KB
SHA256 df5843d41a9e2295d04441101da9a8d13e49fa2d668c372743f977dd42bdd0f8
MD5 b3bd8e69f846059c3d51882792c5c5fa
SHA1 fd48269eb7aa592eaa27b835e7cf7423a937385e
SHA512 54b76c8e06701b1144a81e9db89d881c263edb2b6ef36bc2b5b8418aa0ed881227282b7a7d5c56bd2261aede1fb0de6de963fabb21cb53e46f0a211338a01761
SSDEEP 768:BHPxRVxAEvVaLMtcYyhkjukP5wdHrdA9vyjJx:BZRVSOkLM2YpjlRwdHrGvyVx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kqnbkl32.exe

Path C:\Windows\SysWOW64\Kqnbkl32.exe
Size 80KB
SHA256 b24ae168377bdc1a0246e63072832fca8bd04514894b5871438b330ce9cc889a
MD5 76cd6649f63694d270ec9812c1393230
SHA1 013ad368657fa2dc14f0dfc20cb161e43d603ff8
SHA512 5e19a4d6afda567b3b723f1b9d51a0593630fca9d914aaf4673baaacabc86cef1264c8200ed6bcae3dbfedb7d73e377ac9d950eeee5ea88518a30e73805dbb8c
SSDEEP 1536:l3Hhcg9e+ubyNid1bR6I7D2LbOS5DUHRbPa9b6i+sIk:l3hcgw+ubyNif37gqS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Lmdnbn32.exe

Path C:\Windows\SysWOW64\Lmdnbn32.exe
Size 18KB
SHA256 69fc7f281b3e57242e10e62342eafff0c2e1e9deacb70b8633f3cc1aba4846fe
MD5 bd05fb65b2396a044035998643d6125e
SHA1 b185793f0c675e33212e488bec2f7fa70275ead9
SHA512 1a0da1cbe75eeb2c7072c44e054e7f3d58b5f4828a8820b1a8ef0a486ac2e732af40c1d33a26555ee44e6d6b3e0c020f51159a8071a5df727b12a088a6f530b7
SSDEEP 384:CKeFEUQQxwkdn8ZKr1WfQqUwaJuPUNIGu4yiD+w2CX++3z4JVjg4:CKvUWKJqU3JuKu4haw7O+D4JV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Maodigil.exe

Path C:\Windows\SysWOW64\Maodigil.exe
Size 80KB
SHA256 b8fa43df638c4d6fa132d82a8fecebf9aeb49c7336706756e45760ffee98add1
MD5 55d7031e929ce3e94a47555dfd591311
SHA1 4b4ee76987a17dde65880586267963a879b4093c
SHA512 e384007f85d162ce2e926e34c32e84971ecdd6bc4bc77a76d333838a5c8c1235e0c7156ab0027c99a420720fd1f537be64e6476de8c10c8f525cfab9f42d7e9b
SSDEEP 1536:pdSnpHuLOWfFSpVZQKQiCfprpvVhl+GztJsRPljgGY2LLS5DUHRbPa9b6i+sIk:aBmOWf+VZQKQiCfprpvVhl+GztJsReco
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mblkhq32.exe

Path C:\Windows\SysWOW64\Mblkhq32.exe
Size 80KB
SHA256 4153091aeadedb2ac5c34a7c5bd6d3ba5c47d0fdab9f04e1cc918de6d4c00999
MD5 a21f626657ae09a9fa79d9a1c983d388
SHA1 ce2a819ea3299b1bf01233029780661804d7d99f
SHA512 4901a2b5ce91785ea9c9873c137aedd9513889ae12c421d359f2e457b29c877b77908a0be0c6c0ad9c059861e5d808f133ee2a80d2b84f72d583e42bc9e71008
SSDEEP 1536:IXYqr8RbsfsfvABSLte7n3eJfS2lbl4LZD2LfS5DUHRbPa9b6i+sIk:IXYqQyfevABSLte73wK2lbl4LqfS5DSU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mekgdl32.exe

Path C:\Windows\SysWOW64\Mekgdl32.exe
Size 80KB
SHA256 53e5f32ad344e1a457f63c8c23431dbd8d119c5314670fe78ef73f83364537eb
MD5 b81813323fc4f5b97ea47120dafc672b
SHA1 31149b4294ca31bf0089954bcef4cb0f4830fd4b
SHA512 7521e96c704775fedf0b28d9fc044a37195c89610637662a20784457f43ed66ce077997e577a44281d85c3399009e9907db18a5446ea59127eaf7eae1f2f7f26
SSDEEP 1536:twN0vHJOTdDrknujrREQUTIVC3aV2LQgS5DUHRbPa9b6i+sIk:2NUHJYd/kn/QU4C3aGdS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mgclpkac.exe

Path C:\Windows\SysWOW64\Mgclpkac.exe
Size 54KB
SHA256 57f09610297564c7b953806128c3bf8e0704edec03b0fc9504a0b86c945ba23a
MD5 f42c637bdd316c9da55cc631d8ea6856
SHA1 31eb1dd7f6d7b4042c52f3844159d77a1238eaa4
SHA512 be0d70bdb360794586ed836e373ee0f45396cf10a359468a116f940892f5e07fd387d5ac32a15b2d36f9a07359b794068168e5bef64d2c8dd2d74a8bd7346a48
SSDEEP 1536:gdY2NqP98aHhyas+KKKKKK+wN+alH2LZ:g2v98aHF+bZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjkblhfo.exe

Path C:\Windows\SysWOW64\Mjkblhfo.exe
Size 29KB
SHA256 2f256f1cdac2e75fc26a66d2cb290ce8fcc0b5b40b66fc74d0d77268fdbe788f
MD5 adafe5b3741a51a3330532ae1d3f3eb7
SHA1 d375f076b84a39a3f32e1877c8b637c7d5f9928f
SHA512 7cd2580b78ae170775d342be1ce96f69207de0ce0b8bd901f5f4d2b3d3b68bbbfeda1f130caeefc8f3434edf0920caee576fba5a9f52c3f61198f87cf23bc21d
SSDEEP 768:HjCpgfR5Sf9Lv5SAkOyt/kFoyvitzcQt28f:Dpfes3tMJc3vf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mpqkad32.exe

Path C:\Windows\SysWOW64\Mpqkad32.exe
Size 80KB
SHA256 7e69c6a9eefb2d073178f37dd1fc8714de28d122879b2861673e6c6e82805eba
MD5 8c6ef8b0a34b798c9ee385450a034a8d
SHA1 35fa75ddc8af1435dfd84515f5c294f4dd0a411f
SHA512 c49afd1d6790199307334ce7af6e6b011e8b0e67aea3e3f3a6657ed6f2f30e99466b37f322671c29ff499287e668feaf54c21fcebf4f506d203ce92a1c9c8b27
SSDEEP 1536:7Ozw8cFLfwARTwwZxflh2L9S5DUHRbPa9b6i+sIk:7p8cFLf/RTwkfl69S5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nbadcpbh.exe

Path C:\Windows\SysWOW64\Nbadcpbh.exe
Size 80KB
SHA256 9ccc1bb902c29d79d525cf726f1c86feda2ce331a2a1476602458b9579dd8301
MD5 4f433e0ef9211952f3b9b1b845f8d5a3
SHA1 5ccd55ba4e39ddd7acc342558c61b8b5fff925e5
SHA512 376faa16e333a74e49166ed4d229f475d899346074b267758914cb21ce5bd4dcda6533649693e1e509867d187920c226aaa66c4393867d8340919323d6db7dda
SSDEEP 1536:G9z7f8f3Q3p+v0cAkGRkjXa0EabCHSosmOGckaAIr2L9S5DUHRbPa9b6i+sIk:GdIf3Q3gvXiSHmKkaAII9S5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngaionfl.exe

Path C:\Windows\SysWOW64\Ngaionfl.exe
Size 80KB
SHA256 30e3cbdc832234b36c3c7d7f2b83ffef5a74f2e972377d9f350f013c7ecc2614
MD5 8de01083488554457f378f33aaede9dc
SHA1 95e4aef41849f0e305ef757b34aa8de37c36635b
SHA512 530cb42960fa0f07f4147c0118f9078881089b2b9212911c769c4ff1a0a391ca1440b50b364398c7667f92c33e50bb83ff65b03d6eaa8ffb17562ea6f19b0c51
SSDEEP 1536:z22VTgVl5sx0gruN701qAXP71PoI2LRSS5DUHRbPa9b6i+sIk:rTgVl6ptP7NEwS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngomin32.exe

Path C:\Windows\SysWOW64\Ngomin32.exe
Size 80KB
SHA256 25de697c2797e0f0aee33951d6085fec387cee29ac77e65bf3c9de00276146aa
MD5 7d1b1c914d43d2e4237b65a6ac20aa41
SHA1 e9fd29ba5708cade0042d52e31c382fcc28d6320
SHA512 d9378f39b5945869c922b5f58ce4b77b20f51732102432eab2996b2260cc4f565945785346f66617ea345c5fa0dc31d4bf9962284b4b1aa7c9f805dc2664cfb0
SSDEEP 1536:TgUPIALZMf//iNQkn8kdih2LsS5DUHRbPa9b6i+sIk:TfZACQkn8Ki6sS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nhahaiec.exe

Path C:\Windows\SysWOW64\Nhahaiec.exe
Size 13KB
SHA256 d9191237fc61f6bbc2d82be9261390bc5b837804e5c53c9c1df64e30b21e5ca6
MD5 71d7f3ea2e669e271b7031fd2998331f
SHA1 0f7b3b15297f54f84d6c1295943fb73f0a663225
SHA512 79ce6f64bca95f77423158fc5e1ca61512c4d4ad4551575d966a4f0e934197d51365b3e5ae6b381668e0737e7f373e6135596faafe1ceedb02e9033937298233
SSDEEP 192:T6uDRK3tV4FyBUF80/yeO7oxLqu9knruPQ1WfLyIP2DDaprJBZEgfEEQk/Be4vom:TBY9ZUF80ap76LUu5feIP2DOQSBzAdYB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nijeec32.exe

Path C:\Windows\SysWOW64\Nijeec32.exe
Size 80KB
SHA256 9cafccb81b41a36c2b4f444c0f1af01909d8c74c072293b9600a95b7185a64ae
MD5 2a2f12171cb3cb8fa6c6bcfb49b0f8d4
SHA1 13f3508b3090c0d996f2a546e5f36299c9502e31
SHA512 79cb70083075bf6f924cc51ef09e42465c024d0fcac2db38c2b004d542e4639512425ec099c43d7001627e15cf081fd9bd0ad0431378dd05eeeb46d5ba8b6b75
SSDEEP 1536:ss2+xVlq+w2Dut+h2/Xnb5CxOkp+4hS2LqS5DUHRbPa9b6i+sIk:oqlbNa+M/X9CxOkEAqS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Niklpj32.exe

Path C:\Windows\SysWOW64\Niklpj32.exe
Size 80KB
SHA256 07b2b05ff214f45009d4030d47cddf50b9d98e074034fdb6272d44fbc41720d0
MD5 0023b9df87244736127fcf1751e79fb0
SHA1 9533bd3961f21ead6f02ea6f3b823ff93fbdac7f
SHA512 9884832c06558528197298632ed8852782c5793ea06b21b53ee1189c31bc534130bfd2cf666792bce37095543f763de71d18d177bb966a7874a85c928ee81c47
SSDEEP 1536:Y75NvBZD3ecIdjYHkMWgGC2L/S5DUHRbPa9b6i+sIk:Y75VBZD3ecIdjWvBGP/S5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nlleaeff.exe

Path C:\Windows\SysWOW64\Nlleaeff.exe
Size 80KB
SHA256 0f279b81b9306b8c0a471aa9d7c0aa7622aa728f49a64629c9cae458c04b85f0
MD5 935beb9f9dfc28fc9b41081ec6c311b9
SHA1 ac2fe6c1d51cecb4c9941765258b63fab60bd1f6
SHA512 eb8d9f3918b3c7ee49e5db1b41519e530b286995b9a56e19d918d8062cd8851dde0b6dd964d612902fe6f77960f6efacdd1e5de3292be1bbe221ec4b6ca0f6ee
SSDEEP 1536:GbktwAZDXQqu90LxzVhS2CnsCZd2LtS5DUHRbPa9b6i+sIk:EiwAZDXNuAJ7S2CXutS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Noblkqca.exe

Path C:\Windows\SysWOW64\Noblkqca.exe
Size 75KB
SHA256 d815101ca9cae876b4721c4a176920dd306c0d2f4fbbc3cb25e100bb748fbfc8
MD5 82571941999bd5d1d7ad7cb68d66d3d0
SHA1 17683422e3054ea2eb1d36521d487e9e60b91aae
SHA512 183026a33beef8233594f84f1e90f3536bb08ae2a070ea2daff9cd47aab7e8e17790273b2a04fdaaedc2bca930815ea2938d374ac2c6f257c61a6a26634fe88a
SSDEEP 1536:fdQsiMaK/YSQ9m2/jkaFUj3Fc6lcnqlApw4f3mvJ/PZEe62LFS5DUHRbPa9b6i+e:fOqYSQ9Aj33mqcfWJFS5DSCope
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nookip32.exe

Path C:\Windows\SysWOW64\Nookip32.exe
Size 80KB
SHA256 8593480dc1d165fc3f8ceb3e0d4df7bb878757b369bdacebd6c3127390220091
MD5 9a363a0ffb49f10405c8e5cece0fd44d
SHA1 8ab05bd31c713e975fc5c05275cb4c048adef6f4
SHA512 9097cd011d1ff627b551f28fee3e393b49a0dcf21d3b07c16c74f37c22710f14b563bf1fdd33b85d0a6c68717896da45d1ec571c6125447600da690784e3727f
SSDEEP 1536:W9WZfRIAI86KA2LjiS5DUHRbPa9b6i+sIk:aWU86oGS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Npedmdab.exe

Path C:\Windows\SysWOW64\Npedmdab.exe
Size 80KB
SHA256 38c4494ac5d632b7e7a263091d7225d92834f569647dd2dde471e485730082cc
MD5 10f9adeaf6ec62a40a643ad56859fb60
SHA1 a9120763f89cb6b47dd5bc4e0e29ffdeaf5e6fd6
SHA512 8a523d2562bae86eb04e4f91498720cc3ebd332176220a924d8884ea3ab552b4c8422cfe96d861515702f2954c24c07d20d9d73ea698841126435e3de1ec85a7
SSDEEP 1536:ozCqGaIQvpSlaC5pxzHxRiBxv2LmS5DUHRbPa9b6i+sIk:YP+QwlpJHuBx0mS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Npjnhc32.exe

Path C:\Windows\SysWOW64\Npjnhc32.exe
Size 80KB
SHA256 8611b0dbe5b531cfd5174d8a4244ffbea9550e681b289f81472503381ab7ce50
MD5 2173b5bbb250be23dddfef3ac4e3ddf4
SHA1 fd49a60c61b122e0f466956bbae8dd60c8b2ff50
SHA512 b3e95821e53c44da0b75dea7537a71ae9e82c3c525a5c2c572ab116be22895a8e5fc8cc3d67098a57692f27de36a9fd9d3fd1f98b188ef627366a8d3a6cbfe82
SSDEEP 1536:C4sUs2hPObzFP9D65+rTCcZKmnSCm9yYP2ix2LbS5DUHRbPa9b6i+sIk:3szFPZpznSFfvKbS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ojemig32.exe

Path C:\Windows\SysWOW64\Ojemig32.exe
Size 80KB
SHA256 5897b26d3484468e67b0972fe107b7ceb9bbd78304de5e8d79e6806edadcc192
MD5 5912e8b6f87b717cb374118a3c829816
SHA1 a726a7aab14f066014d9b4ccd96d22fbb293e299
SHA512 9b48410e91d511cb4b4c0313bcdd2df076060026bb3117e89721c14e14c52459c9dfe9fd3ec0b5e7f8d4d308d241512d4a0591a386c605ff3a04680b65dadc8f
SSDEEP 1536:7PXp3Cx0hOAwaFVqDNZ2LaS5DUHRbPa9b6i+sIk:9kPSaS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pffgom32.exe

Path C:\Windows\SysWOW64\Pffgom32.exe
Size 80KB
SHA256 d05fbed8540ad8c99c4837721adee90d04699f3729bc0afc83507d9286ef8c1d
MD5 c6223c7a312f2f22a57e6c49902f7247
SHA1 cc040dcdabd35f8b18ed9b1ef41c2bc52acb04fc
SHA512 9eecf0165273330b0502116ba0928b47ba12f11aa3b82c4cfd935ba55c5dce9f1a6a868d29702bb1eef35ad292d56f163eb41b63fbce97b3aa5637b26dfb2122
SSDEEP 1536:8CE/nKiCnj9X8SPw1R2LkS5DUHRbPa9b6i+sIk:fEVChsIWqkS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pnplfj32.exe

Path C:\Windows\SysWOW64\Pnplfj32.exe
Size 80KB
SHA256 a086e39ba4dabca8e015be91709cf2beca5c1ed69c0db45666fce31fa4cf85ac
MD5 f4890d2b992d2cfafdbb5160528ca073
SHA1 4e36a82e8156efa48bdc9efc615feaab0b5f0645
SHA512 0f658c71011be1bbb62fa1933a9774bbc6818201d29369d2a107e22189a6958a985dd205dd759c723a8c9f5a4823ec715b45803e73d811667260cf5b127a36db
SSDEEP 1536:g4lOMCa56bPIONfKazGxYF2LVS5DUHRbPa9b6i+sIk:Dld56DyZ+2VS5DSCopsIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-282-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/408-138-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/440-276-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/728-82-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/740-264-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/868-21-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1052-292-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1076-342-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1184-242-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1272-56-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1428-230-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1436-394-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1520-377-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1568-217-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1592-336-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1596-422-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1812-413-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1892-90-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1920-257-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1944-149-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1952-122-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2060-198-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2100-114-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2176-306-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2648-378-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2748-74-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2860-162-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2896-98-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2920-65-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2920-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2920-5-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2928-294-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2944-234-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2976-358-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3092-270-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3128-414-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3220-318-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3576-348-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3592-177-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3600-402-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3636-249-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3728-371-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3812-330-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3940-364-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3972-210-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4092-202-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4272-33-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4312-300-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4320-66-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4344-388-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4392-435-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4396-41-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4404-153-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4456-324-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4504-186-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4636-130-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4712-25-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4792-170-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4820-48-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4852-8-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4900-396-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4916-110-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4932-436-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5044-312-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads