8f09213dd3efb86f913be4a23b5ec591c5ab5f55eafe5e9aeb860940461f9f56

Analysis

max time kernel
34s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 20:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fca1ee63b722e43fc2260a6d881b4730.exe
Size

85KB
MD5

fca1ee63b722e43fc2260a6d881b4730
SHA1

4ee92dc8cc9070077139d6bfeba054704d7d1d90
SHA256

8f09213dd3efb86f913be4a23b5ec591c5ab5f55eafe5e9aeb860940461f9f56
SHA512

b0029955283c25ecde8cf2eff2a65b25e35fb0135f0555427ef468652b05e62fbd1abd554dc7fb28710c7666e536fd02b68d2ad4df6c8aa97ed33c2fc2daebaf
SSDEEP

1536:2Dop72qJB5eOl8yrbwEk2LH0MQ262AjCsQ2PCZZrqOlNfVSLUK+:kop9Jvl8cUE9H0MQH2qC7ZQOlzSLUK+

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 48 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgepom32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljfhqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljfhqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqpamb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkeekk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkhapk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnpdegjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dndnpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	fca1ee63b722e43fc2260a6d881b4730.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lqndhcdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkeekk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmgabcge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lenicahg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnhkbfme.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dndnpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nglcjfie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmpkadnm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgepom32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lggldm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcnmin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkhapk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcain32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhicoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmpkadnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lenicahg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Madjhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgobel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmohno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhicoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lggldm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmcain32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	fca1ee63b722e43fc2260a6d881b4730.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqndhcdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmgabcge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmohno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hljnkdnk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbnmke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnohlgep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqpamb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hljnkdnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbnmke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnohlgep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcnmin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Madjhb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgobel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnhkbfme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnpdegjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nglcjfie.exe

Executes dropped EXE 24 IoCs

pid	Process
3936	Lmpkadnm.exe
2580	Lgepom32.exe
2652	Lnohlgep.exe
2860	Lqndhcdc.exe
2344	Lggldm32.exe
3672	Ljfhqh32.exe
3556	Lqpamb32.exe
3100	Lcnmin32.exe
4692	Lkeekk32.exe
3716	Lmgabcge.exe
1192	Lenicahg.exe
2260	Mkhapk32.exe
2676	Madjhb32.exe
224	Mgobel32.exe
4024	Mnhkbfme.exe
4376	Dmohno32.exe
2704	Dnpdegjp.exe
4524	Dfglfdkb.exe
836	Nhicoi32.exe
4528	Dbnmke32.exe
684	Dmcain32.exe
4392	Dndnpf32.exe
2436	Nglcjfie.exe
1400	Deqcbpld.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ljfhqh32.exe	Lggldm32.exe
File created	C:\Windows\SysWOW64\Lcnmin32.exe	Lqpamb32.exe
File created	C:\Windows\SysWOW64\Dcgmfg32.dll	Lcnmin32.exe
File opened for modification	C:\Windows\SysWOW64\Dmcain32.exe	Dbnmke32.exe
File opened for modification	C:\Windows\SysWOW64\Lggldm32.exe	Lqndhcdc.exe
File created	C:\Windows\SysWOW64\Fmjhedep.dll	Lmgabcge.exe
File created	C:\Windows\SysWOW64\Dmcain32.exe	Dbnmke32.exe
File created	C:\Windows\SysWOW64\Ddpapmqq.dll	Dbnmke32.exe
File created	C:\Windows\SysWOW64\Oidalg32.dll	Dmcain32.exe
File opened for modification	C:\Windows\SysWOW64\Dmohno32.exe	Mnhkbfme.exe
File created	C:\Windows\SysWOW64\Pmphblgf.dll	Hljnkdnk.exe
File created	C:\Windows\SysWOW64\Lgepom32.exe	Lmpkadnm.exe
File opened for modification	C:\Windows\SysWOW64\Lnohlgep.exe	Lgepom32.exe
File opened for modification	C:\Windows\SysWOW64\Lqpamb32.exe	Ljfhqh32.exe
File opened for modification	C:\Windows\SysWOW64\Lenicahg.exe	Lmgabcge.exe
File created	C:\Windows\SysWOW64\Dkhkgplb.dll	Mgobel32.exe
File created	C:\Windows\SysWOW64\Dmohno32.exe	Mnhkbfme.exe
File created	C:\Windows\SysWOW64\Dbnmke32.exe	Nhicoi32.exe
File created	C:\Windows\SysWOW64\Lmgabcge.exe	Lkeekk32.exe
File created	C:\Windows\SysWOW64\Mdeodj32.dll	Lkeekk32.exe
File opened for modification	C:\Windows\SysWOW64\Dnpdegjp.exe	Dmohno32.exe
File created	C:\Windows\SysWOW64\Iigkob32.dll	Lggldm32.exe
File opened for modification	C:\Windows\SysWOW64\Lcnmin32.exe	Lqpamb32.exe
File created	C:\Windows\SysWOW64\Madjhb32.exe	Mkhapk32.exe
File opened for modification	C:\Windows\SysWOW64\Madjhb32.exe	Mkhapk32.exe
File created	C:\Windows\SysWOW64\Gkgmdnki.dll	Dmohno32.exe
File created	C:\Windows\SysWOW64\Lqndhcdc.exe	Lnohlgep.exe
File created	C:\Windows\SysWOW64\Lggldm32.exe	Lqndhcdc.exe
File opened for modification	C:\Windows\SysWOW64\Dbnmke32.exe	Nhicoi32.exe
File created	C:\Windows\SysWOW64\Dndnpf32.exe	Dmcain32.exe
File created	C:\Windows\SysWOW64\Deqcbpld.exe	Nglcjfie.exe
File created	C:\Windows\SysWOW64\Lkeekk32.exe	Lcnmin32.exe
File created	C:\Windows\SysWOW64\Fngjep32.dll	Mkhapk32.exe
File created	C:\Windows\SysWOW64\Dooaoj32.exe	Hljnkdnk.exe
File created	C:\Windows\SysWOW64\Lnohlgep.exe	Lgepom32.exe
File opened for modification	C:\Windows\SysWOW64\Lmgabcge.exe	Lkeekk32.exe
File opened for modification	C:\Windows\SysWOW64\Mkhapk32.exe	Lenicahg.exe
File created	C:\Windows\SysWOW64\Dfglfdkb.exe	Dnpdegjp.exe
File opened for modification	C:\Windows\SysWOW64\Dbbffdlq.exe	Dndnpf32.exe
File created	C:\Windows\SysWOW64\Bdpkjpdi.dll	Lgepom32.exe
File opened for modification	C:\Windows\SysWOW64\Lqndhcdc.exe	Lnohlgep.exe
File created	C:\Windows\SysWOW64\Mgobel32.exe	Madjhb32.exe
File created	C:\Windows\SysWOW64\Fimgpahk.dll	Mnhkbfme.exe
File created	C:\Windows\SysWOW64\Ongbqjjf.dll	Nhicoi32.exe
File opened for modification	C:\Windows\SysWOW64\Dndnpf32.exe	Dmcain32.exe
File created	C:\Windows\SysWOW64\Ejlgio32.dll	Lnohlgep.exe
File created	C:\Windows\SysWOW64\Bchign32.dll	Lqpamb32.exe
File opened for modification	C:\Windows\SysWOW64\Lkeekk32.exe	Lcnmin32.exe
File opened for modification	C:\Windows\SysWOW64\Mnhkbfme.exe	Mgobel32.exe
File created	C:\Windows\SysWOW64\Dbbffdlq.exe	Dndnpf32.exe
File created	C:\Windows\SysWOW64\Elkllcbh.dll	Nglcjfie.exe
File opened for modification	C:\Windows\SysWOW64\Lmpkadnm.exe	fca1ee63b722e43fc2260a6d881b4730.exe
File created	C:\Windows\SysWOW64\Mkhapk32.exe	Lenicahg.exe
File created	C:\Windows\SysWOW64\Lmafqb32.dll	Madjhb32.exe
File opened for modification	C:\Windows\SysWOW64\Dooaoj32.exe	Hljnkdnk.exe
File created	C:\Windows\SysWOW64\Lmpkadnm.exe	fca1ee63b722e43fc2260a6d881b4730.exe
File created	C:\Windows\SysWOW64\Ejnocehc.dll	Lenicahg.exe
File created	C:\Windows\SysWOW64\Ehcplf32.dll	Dnpdegjp.exe
File opened for modification	C:\Windows\SysWOW64\Deqcbpld.exe	Nglcjfie.exe
File created	C:\Windows\SysWOW64\Lenicahg.exe	Lmgabcge.exe
File opened for modification	C:\Windows\SysWOW64\Dfglfdkb.exe	Dnpdegjp.exe
File opened for modification	C:\Windows\SysWOW64\Lgepom32.exe	Lmpkadnm.exe
File created	C:\Windows\SysWOW64\Jkiocibf.dll	Lmpkadnm.exe
File created	C:\Windows\SysWOW64\Qfglbe32.dll	Lqndhcdc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejnocehc.dll"	Lenicahg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgobel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkgmdnki.dll"	Dmohno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npjfngdm.dll"	Ljfhqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnhkbfme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhicoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpapmqq.dll"	Dbnmke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	fca1ee63b722e43fc2260a6d881b4730.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnohlgep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqndhcdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcgmfg32.dll"	Lcnmin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkeekk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnpdegjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehcplf32.dll"	Dnpdegjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkhapk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fngjep32.dll"	Mkhapk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmpkadnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkiocibf.dll"	Lmpkadnm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljfhqh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqpamb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnhkbfme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dndnpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nglcjfie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgepom32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lenicahg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oidalg32.dll"	Dmcain32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhjmpfcl.dll"	Dndnpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lggldm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcnmin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmjhedep.dll"	Lmgabcge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lenicahg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Madjhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgobel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dnpdegjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmcain32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elkllcbh.dll"	Nglcjfie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	fca1ee63b722e43fc2260a6d881b4730.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgepom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qfglbe32.dll"	Lqndhcdc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lqpamb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkhkgplb.dll"	Mgobel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hljnkdnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmcain32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nhicoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ongbqjjf.dll"	Nhicoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnohlgep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iigkob32.dll"	Lggldm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljfhqh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcnmin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdeodj32.dll"	Lkeekk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmohno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmohno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hljnkdnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	fca1ee63b722e43fc2260a6d881b4730.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dndnpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmpkadnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdpkjpdi.dll"	Lgepom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmafqb32.dll"	Madjhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fimgpahk.dll"	Mnhkbfme.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	fca1ee63b722e43fc2260a6d881b4730.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkhapk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbnmke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nglcjfie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbdplc32.dll"	fca1ee63b722e43fc2260a6d881b4730.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 3936	376	fca1ee63b722e43fc2260a6d881b4730.exe	90
PID 376 wrote to memory of 3936	376	fca1ee63b722e43fc2260a6d881b4730.exe	90
PID 376 wrote to memory of 3936	376	fca1ee63b722e43fc2260a6d881b4730.exe	90
PID 3936 wrote to memory of 2580	3936	Lmpkadnm.exe	91
PID 3936 wrote to memory of 2580	3936	Lmpkadnm.exe	91
PID 3936 wrote to memory of 2580	3936	Lmpkadnm.exe	91
PID 2580 wrote to memory of 2652	2580	Lgepom32.exe	97
PID 2580 wrote to memory of 2652	2580	Lgepom32.exe	97
PID 2580 wrote to memory of 2652	2580	Lgepom32.exe	97
PID 2652 wrote to memory of 2860	2652	Lnohlgep.exe	96
PID 2652 wrote to memory of 2860	2652	Lnohlgep.exe	96
PID 2652 wrote to memory of 2860	2652	Lnohlgep.exe	96
PID 2860 wrote to memory of 2344	2860	Lqndhcdc.exe	95
PID 2860 wrote to memory of 2344	2860	Lqndhcdc.exe	95
PID 2860 wrote to memory of 2344	2860	Lqndhcdc.exe	95
PID 2344 wrote to memory of 3672	2344	Lggldm32.exe	94
PID 2344 wrote to memory of 3672	2344	Lggldm32.exe	94
PID 2344 wrote to memory of 3672	2344	Lggldm32.exe	94
PID 3672 wrote to memory of 3556	3672	Ljfhqh32.exe	93
PID 3672 wrote to memory of 3556	3672	Ljfhqh32.exe	93
PID 3672 wrote to memory of 3556	3672	Ljfhqh32.exe	93
PID 3556 wrote to memory of 3100	3556	Lqpamb32.exe	92
PID 3556 wrote to memory of 3100	3556	Lqpamb32.exe	92
PID 3556 wrote to memory of 3100	3556	Lqpamb32.exe	92
PID 3100 wrote to memory of 4692	3100	Lcnmin32.exe	98
PID 3100 wrote to memory of 4692	3100	Lcnmin32.exe	98
PID 3100 wrote to memory of 4692	3100	Lcnmin32.exe	98
PID 4692 wrote to memory of 3716	4692	Lkeekk32.exe	99
PID 4692 wrote to memory of 3716	4692	Lkeekk32.exe	99
PID 4692 wrote to memory of 3716	4692	Lkeekk32.exe	99
PID 3716 wrote to memory of 1192	3716	Lmgabcge.exe	100
PID 3716 wrote to memory of 1192	3716	Lmgabcge.exe	100
PID 3716 wrote to memory of 1192	3716	Lmgabcge.exe	100
PID 1192 wrote to memory of 2260	1192	Lenicahg.exe	103
PID 1192 wrote to memory of 2260	1192	Lenicahg.exe	103
PID 1192 wrote to memory of 2260	1192	Lenicahg.exe	103
PID 2260 wrote to memory of 2676	2260	Mkhapk32.exe	102
PID 2260 wrote to memory of 2676	2260	Mkhapk32.exe	102
PID 2260 wrote to memory of 2676	2260	Mkhapk32.exe	102
PID 2676 wrote to memory of 224	2676	Madjhb32.exe	101
PID 2676 wrote to memory of 224	2676	Madjhb32.exe	101
PID 2676 wrote to memory of 224	2676	Madjhb32.exe	101
PID 224 wrote to memory of 4024	224	Mgobel32.exe	106
PID 224 wrote to memory of 4024	224	Mgobel32.exe	106
PID 224 wrote to memory of 4024	224	Mgobel32.exe	106
PID 4024 wrote to memory of 4376	4024	Mnhkbfme.exe	107
PID 4024 wrote to memory of 4376	4024	Mnhkbfme.exe	107
PID 4024 wrote to memory of 4376	4024	Mnhkbfme.exe	107
PID 4376 wrote to memory of 2704	4376	Dmohno32.exe	108
PID 4376 wrote to memory of 2704	4376	Dmohno32.exe	108
PID 4376 wrote to memory of 2704	4376	Dmohno32.exe	108
PID 2704 wrote to memory of 4524	2704	Dnpdegjp.exe	109
PID 2704 wrote to memory of 4524	2704	Dnpdegjp.exe	109
PID 2704 wrote to memory of 4524	2704	Dnpdegjp.exe	109
PID 4524 wrote to memory of 836	4524	Hljnkdnk.exe	233
PID 4524 wrote to memory of 836	4524	Hljnkdnk.exe	233
PID 4524 wrote to memory of 836	4524	Hljnkdnk.exe	233
PID 836 wrote to memory of 4528	836	Nhicoi32.exe	111
PID 836 wrote to memory of 4528	836	Nhicoi32.exe	111
PID 836 wrote to memory of 4528	836	Nhicoi32.exe	111
PID 4528 wrote to memory of 684	4528	Dbnmke32.exe	113
PID 4528 wrote to memory of 684	4528	Dbnmke32.exe	113
PID 4528 wrote to memory of 684	4528	Dbnmke32.exe	113
PID 684 wrote to memory of 4392	684	Dmcain32.exe	129

C:\Users\Admin\AppData\Local\Temp\fca1ee63b722e43fc2260a6d881b4730.exe
"C:\Users\Admin\AppData\Local\Temp\fca1ee63b722e43fc2260a6d881b4730.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:376
- C:\Windows\SysWOW64\Lmpkadnm.exe
  C:\Windows\system32\Lmpkadnm.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\SysWOW64\Lgepom32.exe
    C:\Windows\system32\Lgepom32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Windows\SysWOW64\Lnohlgep.exe
      C:\Windows\system32\Lnohlgep.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2652
  - - C:\Windows\SysWOW64\Cmgjee32.exe
      C:\Windows\system32\Cmgjee32.exe
      4⤵
      PID:5248
    - - C:\Windows\SysWOW64\Dpefaq32.exe
        
        C:\Windows\system32\Dpefaq32.exe
        5⤵
        
        PID:3724
      - C:\Windows\SysWOW64\Namnmp32.exe
        
        C:\Windows\system32\Namnmp32.exe
        6⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Ndkjik32.exe
        
        C:\Windows\system32\Ndkjik32.exe
        7⤵
        
        PID:4084

C:\Windows\SysWOW64\Lcnmin32.exe
C:\Windows\system32\Lcnmin32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\Lkeekk32.exe
  C:\Windows\system32\Lkeekk32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Windows\SysWOW64\Lmgabcge.exe
    C:\Windows\system32\Lmgabcge.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:3716
  - - C:\Windows\SysWOW64\Lenicahg.exe
      C:\Windows\system32\Lenicahg.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:1192
    - - C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2260

C:\Windows\SysWOW64\Lqpamb32.exe
C:\Windows\system32\Lqpamb32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3556

C:\Windows\SysWOW64\Ljfhqh32.exe
C:\Windows\system32\Ljfhqh32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3672

C:\Windows\SysWOW64\Lggldm32.exe
C:\Windows\system32\Lggldm32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\SysWOW64\Lqndhcdc.exe
C:\Windows\system32\Lqndhcdc.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\Cbaehl32.exe
  C:\Windows\system32\Cbaehl32.exe
  2⤵
  PID:3100
- - C:\Windows\SysWOW64\Cepadh32.exe
    C:\Windows\system32\Cepadh32.exe
    3⤵
    PID:2580

C:\Windows\SysWOW64\Mgobel32.exe
C:\Windows\system32\Mgobel32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:224
- C:\Windows\SysWOW64\Mnhkbfme.exe
  C:\Windows\system32\Mnhkbfme.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\SysWOW64\Dmohno32.exe
    C:\Windows\system32\Dmohno32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Windows\SysWOW64\Dnpdegjp.exe
      C:\Windows\system32\Dnpdegjp.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        5⤵
        Executes dropped EXE
        
        PID:4524
      - C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        6⤵
        
        PID:836
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:684
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4392
        
        C:\Windows\SysWOW64\Nglcjfie.exe
        
        C:\Windows\system32\Nglcjfie.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2436

C:\Windows\SysWOW64\Madjhb32.exe
C:\Windows\system32\Madjhb32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2676

C:\Windows\SysWOW64\Deqcbpld.exe
C:\Windows\system32\Deqcbpld.exe
1⤵
- Executes dropped EXE
PID:1400
- C:\Windows\SysWOW64\Ekkkoj32.exe
  C:\Windows\system32\Ekkkoj32.exe
  2⤵
  PID:448

C:\Windows\SysWOW64\Eiahnnph.exe
C:\Windows\system32\Eiahnnph.exe
1⤵
PID:3452
- C:\Windows\SysWOW64\Ekaapi32.exe
  C:\Windows\system32\Ekaapi32.exe
  2⤵
  PID:3800
- - C:\Windows\SysWOW64\Ekdnei32.exe
    C:\Windows\system32\Ekdnei32.exe
    3⤵
    PID:1812
- C:\Windows\SysWOW64\Abipfifn.exe
  C:\Windows\system32\Abipfifn.exe
  2⤵
  PID:1756
- - C:\Windows\SysWOW64\Aeglbeea.exe
    C:\Windows\system32\Aeglbeea.exe
    3⤵
    PID:2488

C:\Windows\SysWOW64\Fmcjpl32.exe
C:\Windows\system32\Fmcjpl32.exe
1⤵
PID:100
- C:\Windows\SysWOW64\Fneggdhg.exe
  C:\Windows\system32\Fneggdhg.exe
  2⤵
  PID:3516

C:\Windows\SysWOW64\Fijkdmhn.exe
C:\Windows\system32\Fijkdmhn.exe
1⤵
PID:1968
- C:\Windows\SysWOW64\Fngcmcfe.exe
  C:\Windows\system32\Fngcmcfe.exe
  2⤵
  PID:2836

C:\Windows\SysWOW64\Fmhdkknd.exe
C:\Windows\system32\Fmhdkknd.exe
1⤵
PID:4864
- C:\Windows\SysWOW64\Fpgpgfmh.exe
  C:\Windows\system32\Fpgpgfmh.exe
  2⤵
  PID:3668
- - C:\Windows\SysWOW64\Oabhfg32.exe
    C:\Windows\system32\Oabhfg32.exe
    3⤵
    PID:1008
  - - C:\Windows\SysWOW64\Ocaebc32.exe
      C:\Windows\system32\Ocaebc32.exe
      4⤵
      PID:3732
- - C:\Windows\SysWOW64\Jmamba32.exe
    C:\Windows\system32\Jmamba32.exe
    3⤵
    PID:5180
  - - C:\Windows\SysWOW64\Jopiom32.exe
      C:\Windows\system32\Jopiom32.exe
      4⤵
      PID:3448

C:\Windows\SysWOW64\Fealin32.exe
C:\Windows\system32\Fealin32.exe
1⤵
PID:1908

C:\Windows\SysWOW64\Fflohaij.exe
C:\Windows\system32\Fflohaij.exe
1⤵
PID:1708

C:\Windows\SysWOW64\Felbnn32.exe
C:\Windows\system32\Felbnn32.exe
1⤵
PID:1756

C:\Windows\SysWOW64\Efblbbqd.exe
C:\Windows\system32\Efblbbqd.exe
1⤵
PID:2396

C:\Windows\SysWOW64\Dbbffdlq.exe
C:\Windows\system32\Dbbffdlq.exe
1⤵
PID:2436
- C:\Windows\SysWOW64\Nockkcjg.exe
  C:\Windows\system32\Nockkcjg.exe
  2⤵
  PID:4284
- - C:\Windows\SysWOW64\Ndpcdjho.exe
    C:\Windows\system32\Ndpcdjho.exe
    3⤵
    PID:3452
- - C:\Windows\SysWOW64\Lfgnkgbf.exe
    C:\Windows\system32\Lfgnkgbf.exe
    3⤵
    PID:392
  - - C:\Windows\SysWOW64\Lejngd32.exe
      C:\Windows\system32\Lejngd32.exe
      4⤵
      PID:6308
    - - C:\Windows\SysWOW64\Ncfmhecp.exe
        
        C:\Windows\system32\Ncfmhecp.exe
        5⤵
        
        PID:4368

C:\Windows\SysWOW64\Pfandnla.exe
C:\Windows\system32\Pfandnla.exe
1⤵
PID:880
- C:\Windows\SysWOW64\Pnifekmd.exe
  C:\Windows\system32\Pnifekmd.exe
  2⤵
  PID:3436

C:\Windows\SysWOW64\Pdenmbkk.exe
C:\Windows\system32\Pdenmbkk.exe
1⤵
PID:4788
- C:\Windows\SysWOW64\Pfdjinjo.exe
  C:\Windows\system32\Pfdjinjo.exe
  2⤵
  PID:1840
- - C:\Windows\SysWOW64\Pnkbkk32.exe
    C:\Windows\system32\Pnkbkk32.exe
    3⤵
    PID:436

C:\Windows\SysWOW64\Paiogf32.exe
C:\Windows\system32\Paiogf32.exe
1⤵
PID:4448
- C:\Windows\SysWOW64\Phcgcqab.exe
  C:\Windows\system32\Phcgcqab.exe
  2⤵
  PID:2064
- - C:\Windows\SysWOW64\Pjbcplpe.exe
    C:\Windows\system32\Pjbcplpe.exe
    3⤵
    PID:4452
  - - C:\Windows\SysWOW64\Palklf32.exe
      C:\Windows\system32\Palklf32.exe
      4⤵
      PID:944
    - - C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        5⤵
        
        PID:324
      - C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        6⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        7⤵
        
        PID:3200
      - C:\Windows\SysWOW64\Icbbimih.exe
        
        C:\Windows\system32\Icbbimih.exe
        6⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Ignnjk32.exe
        
        C:\Windows\system32\Ignnjk32.exe
        7⤵
        
        PID:4784
- - C:\Windows\SysWOW64\Hofmaq32.exe
    C:\Windows\system32\Hofmaq32.exe
    3⤵
    PID:3988
  - - C:\Windows\SysWOW64\Hgmebnpd.exe
      C:\Windows\system32\Hgmebnpd.exe
      4⤵
      PID:5808

C:\Windows\SysWOW64\Pmlfqh32.exe
C:\Windows\system32\Pmlfqh32.exe
1⤵
PID:2664

C:\Windows\SysWOW64\Pccahbmn.exe
C:\Windows\system32\Pccahbmn.exe
1⤵
PID:5068

C:\Windows\SysWOW64\Hbnaeh32.exe
C:\Windows\system32\Hbnaeh32.exe
1⤵
PID:3068
- C:\Windows\SysWOW64\Hihibbjo.exe
  C:\Windows\system32\Hihibbjo.exe
  2⤵
  PID:724
- - C:\Windows\SysWOW64\Ihkjno32.exe
    C:\Windows\system32\Ihkjno32.exe
    3⤵
    PID:544
- - C:\Windows\SysWOW64\Ijngkf32.exe
    C:\Windows\system32\Ijngkf32.exe
    3⤵
    PID:5524
  - - C:\Windows\SysWOW64\Jmmcgbnf.exe
      C:\Windows\system32\Jmmcgbnf.exe
      4⤵
      PID:5152

C:\Windows\SysWOW64\Ibqnkh32.exe
C:\Windows\system32\Ibqnkh32.exe
1⤵
PID:3824
- C:\Windows\SysWOW64\Ieojgc32.exe
  C:\Windows\system32\Ieojgc32.exe
  2⤵
  PID:1504
- - C:\Windows\SysWOW64\Ihmfco32.exe
    C:\Windows\system32\Ihmfco32.exe
    3⤵
    PID:4816
  - - C:\Windows\SysWOW64\Iogopi32.exe
      C:\Windows\system32\Iogopi32.exe
      4⤵
      PID:3108
  - - C:\Windows\SysWOW64\Jncfmgfi.exe
      C:\Windows\system32\Jncfmgfi.exe
      4⤵
      PID:3200
    - - C:\Windows\SysWOW64\Jbobnf32.exe
        
        C:\Windows\system32\Jbobnf32.exe
        5⤵
        
        PID:3568

C:\Windows\SysWOW64\Ibcjqgnm.exe
C:\Windows\system32\Ibcjqgnm.exe
1⤵
PID:1500
- C:\Windows\SysWOW64\Ieagmcmq.exe
  C:\Windows\system32\Ieagmcmq.exe
  2⤵
  PID:636

C:\Windows\SysWOW64\Ilkoim32.exe
C:\Windows\system32\Ilkoim32.exe
1⤵
PID:1484
- C:\Windows\SysWOW64\Iojkeh32.exe
  C:\Windows\system32\Iojkeh32.exe
  2⤵
  PID:5140

C:\Windows\SysWOW64\Ihbponja.exe
C:\Windows\system32\Ihbponja.exe
1⤵
PID:5180
- C:\Windows\SysWOW64\Ipihpkkd.exe
  C:\Windows\system32\Ipihpkkd.exe
  2⤵
  PID:5220
- - C:\Windows\SysWOW64\Ibgdlg32.exe
    C:\Windows\system32\Ibgdlg32.exe
    3⤵
    PID:5260

C:\Windows\SysWOW64\Iefphb32.exe
C:\Windows\system32\Iefphb32.exe
1⤵
PID:5304
- C:\Windows\SysWOW64\Ihdldn32.exe
  C:\Windows\system32\Ihdldn32.exe
  2⤵
  PID:5344
- - C:\Windows\SysWOW64\Ipkdek32.exe
    C:\Windows\system32\Ipkdek32.exe
    3⤵
    PID:5384

C:\Windows\SysWOW64\Ibjqaf32.exe
C:\Windows\system32\Ibjqaf32.exe
1⤵
PID:5428
- C:\Windows\SysWOW64\Jidinqpb.exe
  C:\Windows\system32\Jidinqpb.exe
  2⤵
  PID:5472
- - C:\Windows\SysWOW64\Jpnakk32.exe
    C:\Windows\system32\Jpnakk32.exe
    3⤵
    PID:5548
  - - C:\Windows\SysWOW64\Pmkofa32.exe
      C:\Windows\system32\Pmkofa32.exe
      4⤵
      PID:5596
    - - C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        5⤵
        
        PID:5664
      - C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        6⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        7⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Gbkdod32.exe
        
        C:\Windows\system32\Gbkdod32.exe
        8⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Gclafmej.exe
        
        C:\Windows\system32\Gclafmej.exe
        9⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Gkcigjel.exe
        
        C:\Windows\system32\Gkcigjel.exe
        10⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Gnaecedp.exe
        
        C:\Windows\system32\Gnaecedp.exe
        11⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Gqpapacd.exe
        
        C:\Windows\system32\Gqpapacd.exe
        12⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Kbkaiddd.exe
        
        C:\Windows\system32\Kbkaiddd.exe
        12⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Keinepch.exe
        
        C:\Windows\system32\Keinepch.exe
        13⤵
        
        PID:5484

C:\Windows\SysWOW64\Gbbkocid.exe
C:\Windows\system32\Gbbkocid.exe
1⤵
PID:6116
- C:\Windows\SysWOW64\Hepgkohh.exe
  C:\Windows\system32\Hepgkohh.exe
  2⤵
  PID:5148
- - C:\Windows\SysWOW64\Hgocgjgk.exe
    C:\Windows\system32\Hgocgjgk.exe
    3⤵
    PID:5216
  - - C:\Windows\SysWOW64\Hbdgec32.exe
      C:\Windows\system32\Hbdgec32.exe
      4⤵
      PID:5276
    - - C:\Windows\SysWOW64\Hebcao32.exe
        
        C:\Windows\system32\Hebcao32.exe
        5⤵
        
        PID:5332

C:\Windows\SysWOW64\Hbfdjc32.exe
C:\Windows\system32\Hbfdjc32.exe
1⤵
PID:5480
- C:\Windows\SysWOW64\Haidfpki.exe
  C:\Windows\system32\Haidfpki.exe
  2⤵
  PID:2044
- - C:\Windows\SysWOW64\Hchqbkkm.exe
    C:\Windows\system32\Hchqbkkm.exe
    3⤵
    PID:4848

C:\Windows\SysWOW64\Hkohchko.exe
C:\Windows\system32\Hkohchko.exe
1⤵
PID:5076
- C:\Windows\SysWOW64\Hbiapb32.exe
  C:\Windows\system32\Hbiapb32.exe
  2⤵
  PID:5496
- - C:\Windows\SysWOW64\Hegmlnbp.exe
    C:\Windows\system32\Hegmlnbp.exe
    3⤵
    PID:5616
  - - C:\Windows\SysWOW64\Hkaeih32.exe
      C:\Windows\system32\Hkaeih32.exe
      4⤵
      PID:5640
    - - C:\Windows\SysWOW64\Hnpaec32.exe
        
        C:\Windows\system32\Hnpaec32.exe
        5⤵
        
        PID:4536
      - C:\Windows\SysWOW64\Hejjanpm.exe
        
        C:\Windows\system32\Hejjanpm.exe
        6⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Hghfnioq.exe
        
        C:\Windows\system32\Hghfnioq.exe
        7⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Hnbnjc32.exe
        
        C:\Windows\system32\Hnbnjc32.exe
        8⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Ibpgqa32.exe
        
        C:\Windows\system32\Ibpgqa32.exe
        9⤵
        
        PID:6108

C:\Windows\SysWOW64\Iencmm32.exe
C:\Windows\system32\Iencmm32.exe
1⤵
PID:5160
- C:\Windows\SysWOW64\Igmoih32.exe
  C:\Windows\system32\Igmoih32.exe
  2⤵
  PID:5252
- - C:\Windows\SysWOW64\Ibbcfa32.exe
    C:\Windows\system32\Ibbcfa32.exe
    3⤵
    PID:5376
  - - C:\Windows\SysWOW64\Ieqpbm32.exe
      C:\Windows\system32\Ieqpbm32.exe
      4⤵
      PID:5500

C:\Windows\SysWOW64\Iccpniqp.exe
C:\Windows\system32\Iccpniqp.exe
1⤵
PID:3444
- C:\Windows\SysWOW64\Inidkb32.exe
  C:\Windows\system32\Inidkb32.exe
  2⤵
  PID:1028
- - C:\Windows\SysWOW64\Iecmhlhb.exe
    C:\Windows\system32\Iecmhlhb.exe
    3⤵
    PID:5628

C:\Windows\SysWOW64\Ihaidhgf.exe
C:\Windows\system32\Ihaidhgf.exe
1⤵
PID:5744
- C:\Windows\SysWOW64\Ijpepcfj.exe
  C:\Windows\system32\Ijpepcfj.exe
  2⤵
  PID:5784
- - C:\Windows\SysWOW64\Ibgmaqfl.exe
    C:\Windows\system32\Ibgmaqfl.exe
    3⤵
    PID:5588
  - - C:\Windows\SysWOW64\Ihceigec.exe
      C:\Windows\system32\Ihceigec.exe
      4⤵
      PID:5200
    - - C:\Windows\SysWOW64\Ochamg32.exe
        
        C:\Windows\system32\Ochamg32.exe
        5⤵
        
        PID:5364

C:\Windows\SysWOW64\Hkmlnimb.exe
C:\Windows\system32\Hkmlnimb.exe
1⤵
PID:5412

C:\Windows\SysWOW64\Gjkbnfha.exe
C:\Windows\system32\Gjkbnfha.exe
1⤵
PID:6064

C:\Windows\SysWOW64\Okceaikl.exe
C:\Windows\system32\Okceaikl.exe
1⤵
PID:4484
- C:\Windows\SysWOW64\Obnnnc32.exe
  C:\Windows\system32\Obnnnc32.exe
  2⤵
  PID:4416

C:\Windows\SysWOW64\Ofijnbkb.exe
C:\Windows\system32\Ofijnbkb.exe
1⤵
PID:5696
- C:\Windows\SysWOW64\Ohhfknjf.exe
  C:\Windows\system32\Ohhfknjf.exe
  2⤵
  PID:5948
- - C:\Windows\SysWOW64\Omcbkl32.exe
    C:\Windows\system32\Omcbkl32.exe
    3⤵
    PID:6128
  - - C:\Windows\SysWOW64\Ooangh32.exe
      C:\Windows\system32\Ooangh32.exe
      4⤵
      PID:3148
    - - C:\Windows\SysWOW64\Ciiaogon.exe
        
        C:\Windows\system32\Ciiaogon.exe
        5⤵
        
        PID:4872
      - C:\Windows\SysWOW64\Clgmkbna.exe
        
        C:\Windows\system32\Clgmkbna.exe
        6⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\Cdnelpod.exe
        
        C:\Windows\system32\Cdnelpod.exe
        7⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\Laiaqp32.exe
        
        C:\Windows\system32\Laiaqp32.exe
        7⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Leenanik.exe
        
        C:\Windows\system32\Leenanik.exe
        8⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Lgcjmjho.exe
        
        C:\Windows\system32\Lgcjmjho.exe
        9⤵
        
        PID:1712

C:\Windows\SysWOW64\Ngifef32.exe
C:\Windows\system32\Ngifef32.exe
1⤵
PID:2164
- C:\Windows\SysWOW64\Nkebee32.exe
  C:\Windows\system32\Nkebee32.exe
  2⤵
  PID:2920

C:\Windows\SysWOW64\Noqofdlj.exe
C:\Windows\system32\Noqofdlj.exe
1⤵
PID:1800
- C:\Windows\SysWOW64\Naokbokn.exe
  C:\Windows\system32\Naokbokn.exe
  2⤵
  PID:3780

C:\Windows\SysWOW64\Nejgbn32.exe
C:\Windows\system32\Nejgbn32.exe
1⤵
PID:3520
- C:\Windows\SysWOW64\Nhicoi32.exe
  C:\Windows\system32\Nhicoi32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:836

C:\Windows\SysWOW64\Bichcc32.exe
C:\Windows\system32\Bichcc32.exe
1⤵
PID:5688
- C:\Windows\SysWOW64\Bomppneg.exe
  C:\Windows\system32\Bomppneg.exe
  2⤵
  PID:4208
- - C:\Windows\SysWOW64\Bbklli32.exe
    C:\Windows\system32\Bbklli32.exe
    3⤵
    PID:3592

C:\Windows\SysWOW64\Biedhclh.exe
C:\Windows\system32\Biedhclh.exe
1⤵
PID:3716
- C:\Windows\SysWOW64\Bkdqdokk.exe
  C:\Windows\system32\Bkdqdokk.exe
  2⤵
  PID:1556

C:\Windows\SysWOW64\Bfieagka.exe
C:\Windows\system32\Bfieagka.exe
1⤵
PID:5004
- C:\Windows\SysWOW64\Bihancje.exe
  C:\Windows\system32\Bihancje.exe
  2⤵
  PID:5072
- - C:\Windows\SysWOW64\Bkfmjnii.exe
    C:\Windows\system32\Bkfmjnii.exe
    3⤵
    PID:4928
  - - C:\Windows\SysWOW64\Hjieii32.exe
      C:\Windows\system32\Hjieii32.exe
      4⤵
      PID:2460

C:\Windows\SysWOW64\Bnbmqjjo.exe
C:\Windows\system32\Bnbmqjjo.exe
1⤵
PID:3512

C:\Windows\SysWOW64\Hlhaee32.exe
C:\Windows\system32\Hlhaee32.exe
1⤵
PID:1856
- C:\Windows\SysWOW64\Hpcmfchg.exe
  C:\Windows\system32\Hpcmfchg.exe
  2⤵
  PID:2064

C:\Windows\SysWOW64\Hjlaoioh.exe
C:\Windows\system32\Hjlaoioh.exe
1⤵
PID:4588
- C:\Windows\SysWOW64\Hljnkdnk.exe
  C:\Windows\system32\Hljnkdnk.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\SysWOW64\Hcdfho32.exe
    C:\Windows\system32\Hcdfho32.exe
    3⤵
    PID:464

C:\Windows\SysWOW64\Hgpbhmna.exe
C:\Windows\system32\Hgpbhmna.exe
1⤵
PID:5052
- C:\Windows\SysWOW64\Hfbbdj32.exe
  C:\Windows\system32\Hfbbdj32.exe
  2⤵
  PID:2620

C:\Windows\SysWOW64\Hhaope32.exe
C:\Windows\system32\Hhaope32.exe
1⤵
PID:2376
- C:\Windows\SysWOW64\Hllkqdli.exe
  C:\Windows\system32\Hllkqdli.exe
  2⤵
  PID:880
- - C:\Windows\SysWOW64\Hokgmpkl.exe
    C:\Windows\system32\Hokgmpkl.exe
    3⤵
    PID:436
  - - C:\Windows\SysWOW64\Hgbonm32.exe
      C:\Windows\system32\Hgbonm32.exe
      4⤵
      PID:4480

C:\Windows\SysWOW64\Hlogfd32.exe
C:\Windows\system32\Hlogfd32.exe
1⤵
PID:5720
- C:\Windows\SysWOW64\Homcbo32.exe
  C:\Windows\system32\Homcbo32.exe
  2⤵
  PID:2928
- - C:\Windows\SysWOW64\Hgdlcm32.exe
    C:\Windows\system32\Hgdlcm32.exe
    3⤵
    PID:3588
  - - C:\Windows\SysWOW64\Hjbhph32.exe
      C:\Windows\system32\Hjbhph32.exe
      4⤵
      PID:3892
    - - C:\Windows\SysWOW64\Ioppho32.exe
        
        C:\Windows\system32\Ioppho32.exe
        5⤵
        
        PID:4248
  - - C:\Windows\SysWOW64\Fflobgng.exe
      C:\Windows\system32\Fflobgng.exe
      4⤵
      PID:5060
    - - C:\Windows\SysWOW64\Fijknbmk.exe
        
        C:\Windows\system32\Fijknbmk.exe
        5⤵
        
        PID:5172

C:\Windows\SysWOW64\Icklhnop.exe
C:\Windows\system32\Icklhnop.exe
1⤵
PID:928
- C:\Windows\SysWOW64\Ifihdi32.exe
  C:\Windows\system32\Ifihdi32.exe
  2⤵
  PID:2688
- - C:\Windows\SysWOW64\Imcqacfq.exe
    C:\Windows\system32\Imcqacfq.exe
    3⤵
    PID:5424
  - - C:\Windows\SysWOW64\Iqombb32.exe
      C:\Windows\system32\Iqombb32.exe
      4⤵
      PID:3816

C:\Windows\SysWOW64\Igieoleg.exe
C:\Windows\system32\Igieoleg.exe
1⤵
PID:3192
- C:\Windows\SysWOW64\Ifleji32.exe
  C:\Windows\system32\Ifleji32.exe
  2⤵
  PID:3372
- - C:\Windows\SysWOW64\Ihjafd32.exe
    C:\Windows\system32\Ihjafd32.exe
    3⤵
    PID:868
  - - C:\Windows\SysWOW64\Iqaiga32.exe
      C:\Windows\system32\Iqaiga32.exe
      4⤵
      PID:4352
    - - C:\Windows\SysWOW64\Icpecm32.exe
        
        C:\Windows\system32\Icpecm32.exe
        5⤵
        
        PID:3544

C:\Windows\SysWOW64\Ifnbph32.exe
C:\Windows\system32\Ifnbph32.exe
1⤵
PID:2972
- C:\Windows\SysWOW64\Ihmnldib.exe
  C:\Windows\system32\Ihmnldib.exe
  2⤵
  PID:692

C:\Windows\SysWOW64\Ijlkfg32.exe
C:\Windows\system32\Ijlkfg32.exe
1⤵
PID:3436
- C:\Windows\SysWOW64\Iiokacgp.exe
  C:\Windows\system32\Iiokacgp.exe
  2⤵
  PID:2428

C:\Windows\SysWOW64\Jgbhdkml.exe
C:\Windows\system32\Jgbhdkml.exe
1⤵
PID:4204
- C:\Windows\SysWOW64\Jjqdafmp.exe
  C:\Windows\system32\Jjqdafmp.exe
  2⤵
  PID:5448

C:\Windows\SysWOW64\Jicdlc32.exe
C:\Windows\system32\Jicdlc32.exe
1⤵
PID:636
- C:\Windows\SysWOW64\Jqklnp32.exe
  C:\Windows\system32\Jqklnp32.exe
  2⤵
  PID:5156
- - C:\Windows\SysWOW64\Jcihjl32.exe
    C:\Windows\system32\Jcihjl32.exe
    3⤵
    PID:5356

C:\Windows\SysWOW64\Jfgefg32.exe
C:\Windows\system32\Jfgefg32.exe
1⤵
PID:3516
- C:\Windows\SysWOW64\Jifabb32.exe
  C:\Windows\system32\Jifabb32.exe
  2⤵
  PID:3668

C:\Windows\SysWOW64\Jggapj32.exe
C:\Windows\system32\Jggapj32.exe
1⤵
PID:6152
- C:\Windows\SysWOW64\Jjemle32.exe
  C:\Windows\system32\Jjemle32.exe
  2⤵
  PID:6188

C:\Windows\SysWOW64\Jflnafno.exe
C:\Windows\system32\Jflnafno.exe
1⤵
PID:6364
- C:\Windows\SysWOW64\Jjhjae32.exe
  C:\Windows\system32\Jjhjae32.exe
  2⤵
  PID:6404
- - C:\Windows\SysWOW64\Jmffnq32.exe
    C:\Windows\system32\Jmffnq32.exe
    3⤵
    PID:6452
  - - C:\Windows\SysWOW64\Jpdbjleo.exe
      C:\Windows\system32\Jpdbjleo.exe
      4⤵
      PID:6536
    - - C:\Windows\SysWOW64\Phiekaql.exe
        
        C:\Windows\system32\Phiekaql.exe
        5⤵
        
        PID:6580

C:\Windows\SysWOW64\Jcnbekok.exe
C:\Windows\system32\Jcnbekok.exe
1⤵
PID:6316

C:\Windows\SysWOW64\Jqofippg.exe
C:\Windows\system32\Jqofippg.exe
1⤵
PID:6272

C:\Windows\SysWOW64\Jihngboe.exe
C:\Windows\system32\Jihngboe.exe
1⤵
PID:6232

C:\Windows\SysWOW64\Jokpcmmj.exe
C:\Windows\system32\Jokpcmmj.exe
1⤵
PID:5488

C:\Windows\SysWOW64\Ioicnn32.exe
C:\Windows\system32\Ioicnn32.exe
1⤵
PID:724

C:\Windows\SysWOW64\Imjgbb32.exe
C:\Windows\system32\Imjgbb32.exe
1⤵
PID:1512

C:\Windows\SysWOW64\Iqdfmajd.exe
C:\Windows\system32\Iqdfmajd.exe
1⤵
PID:324

C:\Windows\SysWOW64\Hhckeeam.exe
C:\Windows\system32\Hhckeeam.exe
1⤵
PID:5032

C:\Windows\SysWOW64\Hfpenj32.exe
C:\Windows\system32\Hfpenj32.exe
1⤵
PID:3228

C:\Windows\SysWOW64\Pkgaglpp.exe
C:\Windows\system32\Pkgaglpp.exe
1⤵
PID:6616
- C:\Windows\SysWOW64\Pjjaci32.exe
  C:\Windows\system32\Pjjaci32.exe
  2⤵
  PID:6664
- - C:\Windows\SysWOW64\Paaidf32.exe
    C:\Windows\system32\Paaidf32.exe
    3⤵
    PID:6712
  - - C:\Windows\SysWOW64\Phkaqqoi.exe
      C:\Windows\system32\Phkaqqoi.exe
      4⤵
      PID:6752
    - - C:\Windows\SysWOW64\Pjlnhi32.exe
        
        C:\Windows\system32\Pjlnhi32.exe
        5⤵
        
        PID:6936
      - C:\Windows\SysWOW64\Eaqdpjia.exe
        
        C:\Windows\system32\Eaqdpjia.exe
        6⤵
        
        PID:6980
    - - C:\Windows\SysWOW64\Gpimflqb.exe
        
        C:\Windows\system32\Gpimflqb.exe
        5⤵
        
        PID:2412
  - - C:\Windows\SysWOW64\Jqihjbod.exe
      C:\Windows\system32\Jqihjbod.exe
      4⤵
      PID:5436
    - - C:\Windows\SysWOW64\Jipqkopf.exe
        
        C:\Windows\system32\Jipqkopf.exe
        5⤵
        
        PID:7076

C:\Windows\SysWOW64\Eelpqi32.exe
C:\Windows\system32\Eelpqi32.exe
1⤵
PID:7020
- C:\Windows\SysWOW64\Ehklmd32.exe
  C:\Windows\system32\Ehklmd32.exe
  2⤵
  PID:7064

C:\Windows\SysWOW64\Elfhmc32.exe
C:\Windows\system32\Elfhmc32.exe
1⤵
PID:7100
- C:\Windows\SysWOW64\Enedio32.exe
  C:\Windows\system32\Enedio32.exe
  2⤵
  PID:7144

C:\Windows\SysWOW64\Ebpqjmpd.exe
C:\Windows\system32\Ebpqjmpd.exe
1⤵
PID:5304
- C:\Windows\SysWOW64\Eeomfioh.exe
  C:\Windows\system32\Eeomfioh.exe
  2⤵
  PID:5348

C:\Windows\SysWOW64\Ehmibdol.exe
C:\Windows\system32\Ehmibdol.exe
1⤵
PID:6256
- C:\Windows\SysWOW64\Eliecc32.exe
  C:\Windows\system32\Eliecc32.exe
  2⤵
  PID:6300

C:\Windows\SysWOW64\Ebbmpmnb.exe
C:\Windows\system32\Ebbmpmnb.exe
1⤵
PID:6376
- C:\Windows\SysWOW64\Eeailhme.exe
  C:\Windows\system32\Eeailhme.exe
  2⤵
  PID:6460

C:\Windows\SysWOW64\Ehofhdli.exe
C:\Windows\system32\Ehofhdli.exe
1⤵
PID:3060
- C:\Windows\SysWOW64\Ejnbdp32.exe
  C:\Windows\system32\Ejnbdp32.exe
  2⤵
  PID:6564
- - C:\Windows\SysWOW64\Jhqqlmba.exe
    C:\Windows\system32\Jhqqlmba.exe
    3⤵
    PID:6652
  - - C:\Windows\SysWOW64\Njfafhjf.exe
      C:\Windows\system32\Njfafhjf.exe
      4⤵
      PID:6780
    - - C:\Windows\SysWOW64\Pljcjn32.exe
        
        C:\Windows\system32\Pljcjn32.exe
        5⤵
        
        PID:5548
      - C:\Windows\SysWOW64\Cknbkpif.exe
        
        C:\Windows\system32\Cknbkpif.exe
        6⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Ddnmeejo.exe
        
        C:\Windows\system32\Ddnmeejo.exe
        7⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Hdmojkjg.exe
        
        C:\Windows\system32\Hdmojkjg.exe
        8⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Hdfapjbl.exe
        
        C:\Windows\system32\Hdfapjbl.exe
        9⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Mkadam32.exe
        
        C:\Windows\system32\Mkadam32.exe
        10⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Fnofpqff.exe
        
        C:\Windows\system32\Fnofpqff.exe
        11⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Ghanoeel.exe
        
        C:\Windows\system32\Ghanoeel.exe
        12⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Jggmnmmo.exe
        
        C:\Windows\system32\Jggmnmmo.exe
        13⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Ablahjhj.exe
        
        C:\Windows\system32\Ablahjhj.exe
        14⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Blnhgn32.exe
        
        C:\Windows\system32\Blnhgn32.exe
        15⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Fblldn32.exe
        
        C:\Windows\system32\Fblldn32.exe
        16⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Gqfohdjd.exe
        
        C:\Windows\system32\Gqfohdjd.exe
        17⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Hpnhoqmi.exe
        
        C:\Windows\system32\Hpnhoqmi.exe
        18⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Jfalhgni.exe
        
        C:\Windows\system32\Jfalhgni.exe
        19⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Mjcghm32.exe
        
        C:\Windows\system32\Mjcghm32.exe
        20⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Ocqncp32.exe
        
        C:\Windows\system32\Ocqncp32.exe
        21⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Bjkhme32.exe
        
        C:\Windows\system32\Bjkhme32.exe
        22⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\Bniacddk.exe
        
        C:\Windows\system32\Bniacddk.exe
        23⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Cefolk32.exe
        
        C:\Windows\system32\Cefolk32.exe
        24⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\Cdiohhbm.exe
        
        C:\Windows\system32\Cdiohhbm.exe
        25⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Fcckcl32.exe
        
        C:\Windows\system32\Fcckcl32.exe
        26⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Gfimpfmj.exe
        
        C:\Windows\system32\Gfimpfmj.exe
        27⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Gbgdef32.exe
        
        C:\Windows\system32\Gbgdef32.exe
        28⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Hfemkdbm.exe
        
        C:\Windows\system32\Hfemkdbm.exe
        29⤵
        
        PID:1664

C:\Windows\SysWOW64\Hicihp32.exe
C:\Windows\system32\Hicihp32.exe
1⤵
PID:64
- C:\Windows\SysWOW64\Hkaedk32.exe
  C:\Windows\system32\Hkaedk32.exe
  2⤵
  PID:6908
- - C:\Windows\SysWOW64\Hodgei32.exe
    C:\Windows\system32\Hodgei32.exe
    3⤵
    PID:3964
  - - C:\Windows\SysWOW64\Jfeoip32.exe
      C:\Windows\system32\Jfeoip32.exe
      4⤵
      PID:7044
    - - C:\Windows\SysWOW64\Lgmnqmam.exe
        
        C:\Windows\system32\Lgmnqmam.exe
        5⤵
        
        PID:6060
      - C:\Windows\SysWOW64\Meiabh32.exe
        
        C:\Windows\system32\Meiabh32.exe
        6⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Acnlqe32.exe
        
        C:\Windows\system32\Acnlqe32.exe
        7⤵
        
        PID:628
        
        C:\Windows\SysWOW64\Cfkenogb.exe
        
        C:\Windows\system32\Cfkenogb.exe
        8⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Dmnpah32.exe
        
        C:\Windows\system32\Dmnpah32.exe
        9⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Igoeoe32.exe
        
        C:\Windows\system32\Igoeoe32.exe
        10⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Khpgmqpp.exe
        
        C:\Windows\system32\Khpgmqpp.exe
        11⤵
        
        PID:3088

C:\Windows\SysWOW64\Lehaad32.exe
C:\Windows\system32\Lehaad32.exe
1⤵
PID:1704
- C:\Windows\SysWOW64\Lpneom32.exe
  C:\Windows\system32\Lpneom32.exe
  2⤵
  PID:4284

C:\Windows\SysWOW64\Phhhbi32.exe
C:\Windows\system32\Phhhbi32.exe
1⤵
PID:4688
- C:\Windows\SysWOW64\Poaqocgl.exe
  C:\Windows\system32\Poaqocgl.exe
  2⤵
  PID:5132
- - C:\Windows\SysWOW64\Pgihppgo.exe
    C:\Windows\system32\Pgihppgo.exe
    3⤵
    PID:1008
  - - C:\Windows\SysWOW64\Aopmpq32.exe
      C:\Windows\system32\Aopmpq32.exe
      4⤵
      PID:660
    - - C:\Windows\SysWOW64\Bjodch32.exe
        
        C:\Windows\system32\Bjodch32.exe
        5⤵
        
        PID:2064
      - C:\Windows\SysWOW64\Cjcmognb.exe
        
        C:\Windows\system32\Cjcmognb.exe
        6⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Cpbbln32.exe
        
        C:\Windows\system32\Cpbbln32.exe
        7⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Dfjgjf32.exe
        
        C:\Windows\system32\Dfjgjf32.exe
        8⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\Ehcfkhel.exe
        
        C:\Windows\system32\Ehcfkhel.exe
        9⤵
        
        PID:556
        
        C:\Windows\SysWOW64\Fdcjfg32.exe
        
        C:\Windows\system32\Fdcjfg32.exe
        10⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\Gdhcagnp.exe
        
        C:\Windows\system32\Gdhcagnp.exe
        11⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Hpomme32.exe
        
        C:\Windows\system32\Hpomme32.exe
        12⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\Jhgneqha.exe
        
        C:\Windows\system32\Jhgneqha.exe
        13⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Jkejalge.exe
        
        C:\Windows\system32\Jkejalge.exe
        14⤵
        
        PID:4816

C:\Windows\SysWOW64\Jhijjp32.exe
C:\Windows\system32\Jhijjp32.exe
1⤵
PID:3436
- C:\Windows\SysWOW64\Jglkfmmi.exe
  C:\Windows\system32\Jglkfmmi.exe
  2⤵
  PID:6428

C:\Windows\SysWOW64\Jkggfl32.exe
C:\Windows\system32\Jkggfl32.exe
1⤵
PID:2440
- C:\Windows\SysWOW64\Jnfcbg32.exe
  C:\Windows\system32\Jnfcbg32.exe
  2⤵
  PID:5156
- - C:\Windows\SysWOW64\Jqdoob32.exe
    C:\Windows\system32\Jqdoob32.exe
    3⤵
    PID:5180
  - - C:\Windows\SysWOW64\Jnhphg32.exe
      C:\Windows\system32\Jnhphg32.exe
      4⤵
      PID:6320

C:\Windows\SysWOW64\Jbdliejl.exe
C:\Windows\system32\Jbdliejl.exe
1⤵
PID:5664
- C:\Windows\SysWOW64\Jhndepbi.exe
  C:\Windows\system32\Jhndepbi.exe
  2⤵
  PID:6592

C:\Windows\SysWOW64\Jgqdal32.exe
C:\Windows\system32\Jgqdal32.exe
1⤵
PID:6452
- C:\Windows\SysWOW64\Jnklnfpq.exe
  C:\Windows\system32\Jnklnfpq.exe
  2⤵
  PID:6712

C:\Windows\SysWOW64\Jgcafl32.exe
C:\Windows\system32\Jgcafl32.exe
1⤵
PID:5432
- C:\Windows\SysWOW64\Kjambg32.exe
  C:\Windows\system32\Kjambg32.exe
  2⤵
  PID:4980
- - C:\Windows\SysWOW64\Kdgapp32.exe
    C:\Windows\system32\Kdgapp32.exe
    3⤵
    PID:7104
  - - C:\Windows\SysWOW64\Kkaimj32.exe
      C:\Windows\system32\Kkaimj32.exe
      4⤵
      PID:6300
    - - C:\Windows\SysWOW64\Knofif32.exe
        
        C:\Windows\system32\Knofif32.exe
        5⤵
        
        PID:5968

C:\Windows\SysWOW64\Kkcfbj32.exe
C:\Windows\system32\Kkcfbj32.exe
1⤵
PID:6724
- C:\Windows\SysWOW64\Kjffngap.exe
  C:\Windows\system32\Kjffngap.exe
  2⤵
  PID:6108
- - C:\Windows\SysWOW64\Kbmoodbb.exe
    C:\Windows\system32\Kbmoodbb.exe
    3⤵
    PID:2752
  - - C:\Windows\SysWOW64\Kiggln32.exe
      C:\Windows\system32\Kiggln32.exe
      4⤵
      PID:5676

C:\Windows\SysWOW64\Kkechjib.exe
C:\Windows\system32\Kkechjib.exe
1⤵
PID:1020
- C:\Windows\SysWOW64\Kndodehf.exe
  C:\Windows\system32\Kndodehf.exe
  2⤵
  PID:4028
- - C:\Windows\SysWOW64\Kengqo32.exe
    C:\Windows\system32\Kengqo32.exe
    3⤵
    PID:6740
  - - C:\Windows\SysWOW64\Kglcmk32.exe
      C:\Windows\system32\Kglcmk32.exe
      4⤵
      PID:1176

C:\Windows\SysWOW64\Kjkpif32.exe
C:\Windows\system32\Kjkpif32.exe
1⤵
PID:5636
- C:\Windows\SysWOW64\Knfliefc.exe
  C:\Windows\system32\Knfliefc.exe
  2⤵
  PID:4416
- - C:\Windows\SysWOW64\Kilpgnfi.exe
    C:\Windows\system32\Kilpgnfi.exe
    3⤵
    PID:4744
  - - C:\Windows\SysWOW64\Lkjlciem.exe
      C:\Windows\system32\Lkjlciem.exe
      4⤵
      PID:1912
    - - C:\Windows\SysWOW64\Linmlm32.exe
        
        C:\Windows\system32\Linmlm32.exe
        5⤵
        
        PID:7136

C:\Windows\SysWOW64\Ljpideje.exe
C:\Windows\system32\Ljpideje.exe
1⤵
PID:7008
- C:\Windows\SysWOW64\Lnkedd32.exe
  C:\Windows\system32\Lnkedd32.exe
  2⤵
  PID:3864

C:\Windows\SysWOW64\Ljbfiegb.exe
C:\Windows\system32\Ljbfiegb.exe
1⤵
PID:2828
- C:\Windows\SysWOW64\Lbinkb32.exe
  C:\Windows\system32\Lbinkb32.exe
  2⤵
  PID:1220
- - C:\Windows\SysWOW64\Lalnfooo.exe
    C:\Windows\system32\Lalnfooo.exe
    3⤵
    PID:3984
  - - C:\Windows\SysWOW64\Jdhndlno.exe
      C:\Windows\system32\Jdhndlno.exe
      4⤵
      PID:1668
    - - C:\Windows\SysWOW64\Lcjchd32.exe
        
        C:\Windows\system32\Lcjchd32.exe
        5⤵
        
        PID:2364
      - C:\Windows\SysWOW64\Ljfhjn32.exe
        
        C:\Windows\system32\Ljfhjn32.exe
        6⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Mkeeda32.exe
        
        C:\Windows\system32\Mkeeda32.exe
        7⤵
        
        PID:2008

C:\Windows\SysWOW64\Lgamhjja.exe
C:\Windows\system32\Lgamhjja.exe
1⤵
PID:6964

C:\Windows\SysWOW64\Kghjakbl.exe
C:\Windows\system32\Kghjakbl.exe
1⤵
PID:5328

C:\Windows\SysWOW64\Mmfalimb.exe
C:\Windows\system32\Mmfalimb.exe
1⤵
PID:2504
- C:\Windows\SysWOW64\Menimfnd.exe
  C:\Windows\system32\Menimfnd.exe
  2⤵
  PID:3704

C:\Windows\SysWOW64\Mcqjhc32.exe
C:\Windows\system32\Mcqjhc32.exe
1⤵
PID:764
- C:\Windows\SysWOW64\Mglfibmh.exe
  C:\Windows\system32\Mglfibmh.exe
  2⤵
  PID:5712
- - C:\Windows\SysWOW64\Madjbg32.exe
    C:\Windows\system32\Madjbg32.exe
    3⤵
    PID:6524
  - - C:\Windows\SysWOW64\Meepne32.exe
      C:\Windows\system32\Meepne32.exe
      4⤵
      PID:1856
    - - C:\Windows\SysWOW64\Mlohjpoi.exe
        
        C:\Windows\system32\Mlohjpoi.exe
        5⤵
        
        PID:5808
      - C:\Windows\SysWOW64\Mjahfl32.exe
        
        C:\Windows\system32\Mjahfl32.exe
        6⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\Efbllhfb.exe
        
        C:\Windows\system32\Efbllhfb.exe
        7⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Fpbfem32.exe
        
        C:\Windows\system32\Fpbfem32.exe
        8⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Fnegqjne.exe
        
        C:\Windows\system32\Fnegqjne.exe
        9⤵
        
        PID:3588

C:\Windows\SysWOW64\Mjhepnno.exe
C:\Windows\system32\Mjhepnno.exe
1⤵
PID:1528

C:\Windows\SysWOW64\Fpdckm32.exe
C:\Windows\system32\Fpdckm32.exe
1⤵
PID:6244
- C:\Windows\SysWOW64\Fngcfikb.exe
  C:\Windows\system32\Fngcfikb.exe
  2⤵
  PID:5316

C:\Windows\SysWOW64\Fbbpgh32.exe
C:\Windows\system32\Fbbpgh32.exe
1⤵
PID:4948
- C:\Windows\SysWOW64\Fimhcbkh.exe
  C:\Windows\system32\Fimhcbkh.exe
  2⤵
  PID:3448
- - C:\Windows\SysWOW64\Flkdpnjl.exe
    C:\Windows\system32\Flkdpnjl.exe
    3⤵
    PID:4476
  - - C:\Windows\SysWOW64\Fnipliip.exe
      C:\Windows\system32\Fnipliip.exe
      4⤵
      PID:6596

C:\Windows\SysWOW64\Fbellhbi.exe
C:\Windows\system32\Fbellhbi.exe
1⤵
PID:3668
- C:\Windows\SysWOW64\Fechhcal.exe
  C:\Windows\system32\Fechhcal.exe
  2⤵
  PID:5372

C:\Windows\SysWOW64\Gnlmai32.exe
C:\Windows\system32\Gnlmai32.exe
1⤵
PID:5584

C:\Windows\SysWOW64\Fmjqjqao.exe
C:\Windows\system32\Fmjqjqao.exe
1⤵
PID:6752

C:\Windows\SysWOW64\Fiodib32.exe
C:\Windows\system32\Fiodib32.exe
1⤵
PID:6164

C:\Windows\SysWOW64\Fmfgoa32.exe
C:\Windows\system32\Fmfgoa32.exe
1⤵
PID:5224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ablahjhj.exe

Filesize
1KB

MD5
f92a682759f89aec4cc1d37008890cfb

SHA1
2acf38adebe1226e89416afe73762dfeea8aed1c

SHA256
c1d7aafa894631c156713bc2547e1d44aa626693fb4ef2958597c386d393c0ff

SHA512
f6a36be1ffede3e493c456cc5825dcff6574bc6e1e91dbe83cd56ef1aefaea3b6adbddafc6b98c86586fe95aa43d2e9d50cd78fb2ef57a4c25a9f28ae19e8df0

Download Submit
C:\Windows\SysWOW64\Bkfmjnii.exe

Filesize
11KB

MD5
9345cb83982d6ba814c710c660d6d1ef

SHA1
6d54c25354687c2bd1027b1b8214d29675ba5f0a

SHA256
ea14449720b9e49732a4539a547ad28770f6ace9f4484c5f8948f7dc3ae6964a

SHA512
5f893c3fb5364412b1c69966ef80f3975eccae1e3fb2809f0b4b132d2b529947cbfb9778a34d77cdafdd464a3d140b60c0a335982efb5226d182d483885364a6

Download Submit
C:\Windows\SysWOW64\Bnbmqjjo.exe

Filesize
1KB

MD5
dbc774b376358e2e6620495cb20b889b

SHA1
148c49956797b9a40edd660d1ef2bdac91066a37

SHA256
b8ab6f9150b823c0db33b78a0a7becf1f34edce6fed1c83d2537dacd6a04b9b9

SHA512
d3ce164910e16bfc561a4f6d3905d68379c8470fc8fada5e891425e0d8665e8b6ba4733dbe42750e49936c4ef72a93b492e15e8b69ece8a2a399509b69c24f5b

Download Submit
C:\Windows\SysWOW64\Bniacddk.exe

Filesize
4KB

MD5
abedaaaa04a49909b1c2263d1a769136

SHA1
a5599ddad4b5f5a7df1d375c951d955ee229ef3f

SHA256
8666c908fd62a6d14068302a3fa28fee03680d8561a1abdddeee406be8757f99

SHA512
bc2954b9bb76c57c9c07877b3688288827ee9521fdd6a28b6cf0c5a6171f1028af57aa71a156434c6e053100cd0ccc6928e0cb47d10d0587bd8caad7ae48c52b

Download Submit
C:\Windows\SysWOW64\Dbbffdlq.exe

Filesize
85KB

MD5
8c1b6689b877265f17741ea86aab3e97

SHA1
68ccb621d3841b4428cc96845ab4c87a52079267

SHA256
5edfa531c50508990cb6c7ae848a1609a751d67bdaf0e9e593ff7b3de78731c1

SHA512
6a953e381de01a827d77d204da0321d52e685717a4c177b35d5e00721176b2780de278925383e6fda3ca8972952fd8bbff323bd2534af36b039e8a8da1e44fcf

Download Submit
C:\Windows\SysWOW64\Dbnmke32.exe

Filesize
85KB

MD5
437ef44a90f1b54cac9ff3b9dc44b801

SHA1
f9754fdb63685a28dd9711db9ad1e02e2f1262d7

SHA256
283bb860d0fa8fa46a18139892e0f00bf180b93b023b7877f8789d3235d8046c

SHA512
a91da02748fb2a97669ed61c03c6d11260b6756bb40b44eeaa1fbeebfa1515a2ae44b9cd5608710266448369c9166370a3e5c1320f0ea15d6b04cd587270dbc6

Download Submit
C:\Windows\SysWOW64\Dmcain32.exe

Filesize
85KB

MD5
7e656de258f0d86fc533a1acdab50b4a

SHA1
b0fc369f463dea7cd3125790070f032db3a51c8f

SHA256
6607135539341d7a8abf3a16db15c7fab96d7607326e7ea72d9e8d1ba5c81bda

SHA512
66c0ce1af27a4cfed48597a57da709d75223ce98c81bcf03515fc2320ca55a0237fccf3036bcb4f67db0da50c87f843a43240fb01300316f4118fd88246a1185

Download Submit
C:\Windows\SysWOW64\Dmohno32.exe

Filesize
1KB

MD5
dcd6730433ee5643f17261703794dd0b

SHA1
f39644b2e73440e47e21e9ed7695e5d31325719d

SHA256
da3a641b9762f388532d14b4e3c687745cbb8c372125d4e338966934a14f66f3

SHA512
5dbb83e294b3b472cef78986502d8338bf7ecb2ad390c75440e5627cf31d89b462a94a2f5e54c4167a2ab523bcfc34ea086880b040904c0ae169849e5d382efc

Download Submit
C:\Windows\SysWOW64\Dndnpf32.exe

Filesize
1KB

MD5
38f8f7f24d126e34238efc007046e5ab

SHA1
ed4a9ffa57d9d845bfec66bb2c99edd0cb8ea409

SHA256
b09ba7e67d22271ef79fb29a2ca51a870cd9c9e7c7b1f60f194f8f64e3eb404f

SHA512
34d83f3f50cc495ffc9f853ccf0afeba93fe3d42bcbc7f842f554084a2df3fc3950a8b2fba253de049d9951d99c42122a910559b607dc1aabf84e3e0372b3779

Download Submit
C:\Windows\SysWOW64\Dndnpf32.exe

Filesize
85KB

MD5
2d324af7991d96fccf83ecf54966b90a

SHA1
dd5da8c8391d0601524814d77166c101b8c1a152

SHA256
4f20508cd7d5c07b9bcac9f60295b8605ca066424252650f0090c4b6de227779

SHA512
10cc602b0a15b9b272bfa10317ab3e8b2f4adcbdc2191c08cf0555a84a2846bd345300a8a70d3ba1e4d4afc802d83d0d514b40bb611aeb1279b37f1475d78745

Download Submit
C:\Windows\SysWOW64\Dnpdegjp.exe

Filesize
1KB

MD5
e476c7f8de520ab377a1e6e0f40dbefe

SHA1
c894408b2f3285b0e3559fa590f78139cfbc39fd

SHA256
8fff721c1f8d4293a0a018b72fe07b69c4864d9bcc051d14c5abb378bc51f107

SHA512
9e201ebf5620e2b2dccfe10dd9ae235b6d24f4a42684b52798bb48ed0cce46ea0935161442dae0ea12bfa08f309438cdec372a51311d1ce9a00564abf1b48f1e

Download Submit
C:\Windows\SysWOW64\Efbllhfb.exe

Filesize
1KB

MD5
acb661fe0ee80a7466bb30c507e32fde

SHA1
5cd81ef8fa8b8b62ff126a2c979911acdb9705fe

SHA256
0ddf9616ac893222986c43f10159b19239fd9e3f1b36d26b8533efa875e70660

SHA512
53310f5ecf463658e820978c5ba15d1156013ba70b85dce6c2ddba29f946ee95be33e37b7a7d34871b9ebd8ef68c0b24dacaa8873bf0013e8347016a4ba5f328

Download Submit
C:\Windows\SysWOW64\Ehcfkhel.exe

Filesize
1KB

MD5
6d596071292d9edfb4e0b4390c9ea9a7

SHA1
013d273119bdbe45174e402c322a0d03e41581ee

SHA256
fefb2efa620030abbcee5e2dd3a40e4fc5b79153e0da2d6e83b4f10f2385e03c

SHA512
cbaa8e1692bf143c0755dc23d051f757af95fd1718c1db51c6b65df53f7769a91fdbb0e857498edfd1b58bf23a038a74038316de57b6256d176bc44a6c0394fd

Download Submit
C:\Windows\SysWOW64\Ekaapi32.exe

Filesize
8KB

MD5
74a146a0f5f5c85c61ca0ae0359bee00

SHA1
5a4f15c56e8ee2224ae9e26db8d275861d623481

SHA256
6c006f5adb7cc1d7247cceedfa24fd7b10ac134cbcd147e9d517926a9e22f2cd

SHA512
c2f6d938b424e2f342e991375008abcdaa94503be98b177f7f7af38ca1f6a09f60786ce180803f08c12dd8299301f86b71742dadf7e3ca2406917e04db0e3b0e

Download Submit
C:\Windows\SysWOW64\Fbbpgh32.exe

Filesize
9KB

MD5
1b3deafe923b1f89ad12061a5458a975

SHA1
bc1eb1d95976a01f6530a91fcf623a47b5810ff6

SHA256
ce5bb9b40abe1ce05cdc7da30c7c60adf3263c5ac059879cf37bdee858cd6fe8

SHA512
89b4d0aca63fcc830083246132d141b80a0db65891e70893cbe6175cca65f1128f2585640ca7c8051dda34f05750cac5335db6fd760e213bbb8fc3891ca89eca

Download Submit
C:\Windows\SysWOW64\Fimhcbkh.exe

Filesize
1KB

MD5
834d58a03d2c32327dea65ed095a295e

SHA1
57772fc1be6c6001c8fe6a93a3ced2addadab9b4

SHA256
607e69d398f140517ba87ef764127744700cfe631409663fc6288ebe1ab53278

SHA512
e0fb096c8f4a436547edfaa77d6797cc5783d6be5abf915ebb6f87c68ca453a9f49f5c3530538988d3eeaff39dc1fea7c2440b0f6065e18eb35052ce354de51e

Download Submit
C:\Windows\SysWOW64\Fmfgoa32.exe

Filesize
11KB

MD5
d7590b06803cc082927c1ef70c916302

SHA1
5bfc46870e16608b307df0e88c76ebb940a1f86e

SHA256
e1058c983f749e9e39e9a2d95857fc4173a5ceabb114ee8faf3491af7b6abd4b

SHA512
24fdaf2578a7805b2d1b3348d9528c2d30e25e8bed5e0b284be6e6b2c93c10bdf3ec5b20ea66561f9bd72579f8710a7348d83e0b6e95b1e0a0ad54a72f6e079b

Download Submit
C:\Windows\SysWOW64\Fmjqjqao.exe

Filesize
1KB

MD5
8f204360d53d23f87c1b3f8102967ec2

SHA1
de38e36be55481d6b086c1b713f1fe5008638b46

SHA256
10efb37684c199cc1158df94b30db9f5260fe70b0c415544ab34dcaead15c832

SHA512
e1d4cf9c454f46419fceb46ae3ad3caa615e59917bc28f9b72d1c8051a977f9b6ec038d5f8406c09d12f1e7c5f5f0741834177f6dee939bdec3d3160e7bd035b

Download Submit
C:\Windows\SysWOW64\Gjkbnfha.exe

Filesize
9KB

MD5
1a176d29e148e5229aaa70acda44ef2b

SHA1
c97feaefb59170b64b5a923faa3c9d1d146a1940

SHA256
b9c07b7ec5b4e371fdc1c7eb564964f76eaf9638e512c2b5515e3055ac06a2a9

SHA512
26bcae713cc6f02193a796ad66e005756945cd4784e260f8d8dc722386d35e6de83eef8b189759c564dfc4e74968c0069c8dcc733c869a0528e069d6778b63f3

Download Submit
C:\Windows\SysWOW64\Hfbbdj32.exe

Filesize
17KB

MD5
828296471c277839a35c6cae67c169fe

SHA1
b2476328da711bb51df6a08791ebd974a06f25cc

SHA256
6ac3a926ef8d03683d6e2d1a0f8166583431de4e43f17e7758b34bf3894f8474

SHA512
90fc8c066a6ce41d3a94200315fe05a7e08181af793ea4f28aca5ccd4df31f581683ae3f93fff8940e60ac9278d714e2f4d908d7c47e4b9bd6ccff6bd60868dd

Download Submit
C:\Windows\SysWOW64\Hjlaoioh.exe

Filesize
9KB

MD5
a97107f13cc2806e5ddfc482e170427c

SHA1
2c392055922aff9471b0c3fea43bbd49e29197c5

SHA256
f05cde422f32f08dbe908658db7d5d9be3e58edb9baee1112f90b5f675e76d2b

SHA512
7af2112794bc99b9b70bf9524b07723647ace20755b3e9ccaf626afce61139ac8862e62ba2e695a96892a86c27114e8ccf25b439e6919da89f26d2c616c3dc13

Download Submit
C:\Windows\SysWOW64\Hkmlnimb.exe

Filesize
1KB

MD5
7bdc52f8f60c27732e6627dd1da87dd7

SHA1
be65c7d913801e0c6e96a7e49727b6a33ec13a9b

SHA256
e669f7398546f2f73130faa472f2fb597aa999012b127f7a14e1a0a975bf6fb1

SHA512
490cb1056982da0bc95f37a834ecbbdcd61d10f94823bacb9c2d4c4038a64cee2d9c265ea74d766e8e209c428676d0ef4fc82f58bc9e7badf3ec9d6103d4a459

Download Submit
C:\Windows\SysWOW64\Hnbnjc32.exe

Filesize
1KB

MD5
5f0fca06716ff23777027a221a6ddbed

SHA1
3d6980b2f319a69c772882e270c31092263ffcaa

SHA256
264cbdfd0fd57a9867ad8e0ebda33123adf822645dbf4bd1703d86260ba4ba89

SHA512
97348cc10e921c1e15bc314df8d082fed7c3750e5d805e90144303e8bfc60ed57bbcddb0bd909c00cbc0ddb497318d3204d500a624b41c0dadd79fb192c28327

Download Submit
C:\Windows\SysWOW64\Hofmaq32.exe

Filesize
1KB

MD5
63ec1220cefa04ff23c7169be5ec2123

SHA1
097f9e3dcdc002928391c6a66bafc8f32066b8e3

SHA256
3a097ae557a2b122ad1d8dbbf08ab79d7bba03f97678400a15f8b7cbedd9bf24

SHA512
fbcfd626e3425465176a2b1db38b5c65471d9f11d19106669a7dc91011b10252fb5ce5a9ffca9e633c307e6f0bbc810cb1d7aa645734d71cc102916feae4cb41

Download Submit
C:\Windows\SysWOW64\Hokgmpkl.exe

Filesize
1KB

MD5
4d4c69f952fcb23e93df3e9726905e84

SHA1
c20da26e6b60b580ab015531ed4ab27101bb1119

SHA256
eefa1fd7b9859dd00dd0bc1ff41acb88f2776592d81aa01ff067db4c029b8b01

SHA512
dc01bc58ceccaafe668031e21c007facf89a4dd62788381456bafb0ff4b7062b43543c85e1a011539c80f36ed790770f3fc0097b5e75a36f99f1a808994e8f36

Download Submit
C:\Windows\SysWOW64\Hpnhoqmi.exe

Filesize
28KB

MD5
3e85fcce99282401d0fd377e3d8cbfc8

SHA1
4ec4e114151343ca53b8911fc58148171bdbc49f

SHA256
379ef8df5e80e150335ab6af3973396e4a0c3230a1931b89f89515f20184377a

SHA512
9453a868580ed152766b62d27a630e8bc4afd111e612b88741b9dca2b7f5080b2454da1f8ef3a03b4e545a0589dc4c689fc9d0f53b8d956ec755df44bc692266

Download Submit
C:\Windows\SysWOW64\Ibbcfa32.exe

Filesize
1KB

MD5
3dec3903c4198de3fd3af21b99012fbd

SHA1
0d962c84cc7be74d82c7b709185606b05903692c

SHA256
8e8210b0f6b76dd8167e4dee3264bb681c436b6998481218fe3585c215d38783

SHA512
65f7cf468c2ce9ada58df6090528f3c28516e91f2c2e28624950af84ab76a8dd47a9f1ab69bd28ddc575d5fc203d5f4b71216c5af144350da07badefbdc7ab8f

Download Submit
C:\Windows\SysWOW64\Ibgmaqfl.exe

Filesize
5KB

MD5
3d9a8dce5940f11aafb00fb779ca6602

SHA1
048a98695f0352cfc0c84be72fab81eb428bec0a

SHA256
1c711695ff8ebd10b9ad68a27e7a8d1bdc954dd8a9126aa3d2c256c9456dd2e4

SHA512
aa2f38eed931bc4be163ba833f243256b1da9e1db40b382a4a84eb9e9d8d3e273bc74bfa583a9c27ed50d1ed7861146ddf5e171d348d7bdd325555c36f164db6

Download Submit
C:\Windows\SysWOW64\Iccpniqp.exe

Filesize
9KB

MD5
41d82f4c10c6ab32f07c99580bd57e31

SHA1
56db1b17961406cac18d2c2dfeff35543c5ccb37

SHA256
b402da49da757bb0779bc88d4566cc256aa748d6d9bd192c0852600fa96c8a0c

SHA512
cbe3c117f01eae5cd298ad66eadbce12eafbef08068772b3079e6ab3de72ee1fadb7f8f358cec672e269bce870826102258491cb4acd05ddd864bb49bb6fd8a4

Download Submit
C:\Windows\SysWOW64\Ieagmcmq.exe

Filesize
911B

MD5
f3196591f4296dd3ff7071df155bdbb8

SHA1
adcd8b10cb6493801f22b4be8d5798eb5e1593b9

SHA256
5162e65df32de075224980f45621b232e8ebed3e84f66882ea38309f2c0c64b2

SHA512
110cf6f45c42609ec2e400456377e445191f0ff949a498ca0b047029499f8dec14ecfb9a5d65d62b9bf0d2471881dddfe91c2d36afb87f6badb92bb582791eb9

Download Submit
C:\Windows\SysWOW64\Imjgbb32.exe

Filesize
1KB

MD5
e4cd3f13ecf106ec51f93b0c976bca7b

SHA1
524b3b4f7b758de91ecce1e4feaec74b62ad6e1e

SHA256
295f0a2ce312748f05fc7287844f5b97b1e4007fdab99577c5b8408ccbbac0b1

SHA512
d37d086ab3c78ae5cfd01a57705655df24ae952ed91f2c40afbba67a3f40c26ccc7a2d56654cc32afe2dfafaa5ff3a7aa0ba3132497f505701571aa34028159d

Download Submit
C:\Windows\SysWOW64\Jgqdal32.exe

Filesize
68KB

MD5
b9539e0bb17cae7d60c9e21855ccd2f9

SHA1
85508e8fc5b6c3bc7aa47eaff6c725b0e1a33ca7

SHA256
b2307b041338505f1d18c0846a689e2c2ebc9a2ef2e5f774d34e5d94ad1c8d60

SHA512
8129a8e5bd87734dc0c212503f7096e5360f0b5f03f75e748e3076628dc73d59def34e9b5fb5c5a42a546bf12350d7510b301836d5c89cf58aa781e9e25c98d1

Download Submit
C:\Windows\SysWOW64\Jkggfl32.exe

Filesize
1KB

MD5
15312b7c0684966a6365f4bcd438c450

SHA1
1f13cf7b442da82aee350c4d5cf49c040f1b9fae

SHA256
8c47398e489d336da547979ec418b687657c6d734ef4721bec4d49e3ec3a1a7f

SHA512
83c602624426114926e3f818b377b9faa6ff352de418a55547c9fb2f2bc6a25b53fa04245871a6f01d34b090e505e147607250cbe019e030d83e21282869099f

Download Submit
C:\Windows\SysWOW64\Jpdbjleo.exe

Filesize
85KB

MD5
518f8b912b18f13aceeb5ea809b56437

SHA1
813177f19204622d94bb8f26f0c21b1cb37559e0

SHA256
5319afe09c2a88190c72b2cc62ecaa22c3970b0aac02e6e3b4ba71f45e6e865c

SHA512
4fbfe2a45555b7bff65cdd94fe5dd48521386c3e2f0fdbe8212764a0706cd63ff6398fa775cf41cd1283cd6f706a2cca3c8a1d06de984caf7aecc7801c572f12

Download Submit
C:\Windows\SysWOW64\Jqdoob32.exe

Filesize
1KB

MD5
34b956706d787cad4e2dec0efccfb28d

SHA1
918159d254b3e584c3811bb0bf47a6de6d15f860

SHA256
aac27bee2c02f3d2420a94b73d06bbcd0c529ba03997ec1d5be2a26a057c59a8

SHA512
0c98c15ba2ce6bff356e85a0fb5c887b79260428e4c30eb12795639281c7b0d6032b162895fb6f26966de29131bde76d8f5e60c90ee4deeea193c97a18f2d10a

Download Submit
C:\Windows\SysWOW64\Kbkaiddd.exe

Filesize
85KB

MD5
1111e08fbffe2c2a60684269e1a1cc64

SHA1
b224c7c644a15a545e63b4a5aa35091b1c34919b

SHA256
64a846946fcd4dae39358eb2b246a2341c34f917413aade3ca527a5170bf694a

SHA512
c5c3293e9442102a5f7f8af747ce49e27580b08c6e50443fbcab0c3bc5434f1f4eaf6926c95e904bee889cf22c713acec722e067cfb6d6145519eda8c509dbcc

Download Submit
C:\Windows\SysWOW64\Kbmoodbb.exe

Filesize
33KB

MD5
60241cbaba0d8b8d9e1fba3d64fc51da

SHA1
bbcd58f8cb316f93010aa7254a30dc6af3118f87

SHA256
d25c3dca24915331703d11928b9dff9082d12c628c79b1c8f04f9d3b5cc92f6e

SHA512
28f57486533f03c470746f087153bd52fea84d02bcc3b6beb2fc3c7f79914b2e4db20f0d0fc9d7d7e379623b7525907627a66e4f468560df4954fe552e34a7fe

Download Submit
C:\Windows\SysWOW64\Kengqo32.exe

Filesize
52KB

MD5
735b41d3669a87a95a78c3db48734184

SHA1
3ef50b81eb28bfa894a9b10b06322742995aa042

SHA256
25b822308f39795179224ef4c73989d78f64c08bd7aa2a354ba645b1e32a3eb3

SHA512
ef42204646eed581417e9282fd6dd186b5fe311f4f5f639bcef8f88d79eb614f8f4e2b032ee96f476206afc9eefb9e372b8f4e0a2f1ceec0c3d7dfcd83620a21

Download Submit
C:\Windows\SysWOW64\Lejngd32.exe

Filesize
17KB

MD5
60143d552f653fa8331b6f0238fecc2d

SHA1
02221f6e5f907d9f585d1566ae47b163a1da080d

SHA256
4624d0b4710130b5e839e4f00801e13d28ddf02ad02fd7303414c9746ab5d2a2

SHA512
56a678b1996bc87563380099bb6e6b845ab7e8616c5875596ea39b7a66c17f8fcf5ec75a430c321ad438d6665ea5a0e04eea95377aa7fc68653ed554a0c8f59e

Download Submit
C:\Windows\SysWOW64\Lenicahg.exe

Filesize
85KB

MD5
d8eb9353a73c92b0cf150d2ed7fe105b

SHA1
ca02d0be057fa9116b1ca46c73972bf33f30243e

SHA256
cd2390963c7262f1e8a6e6e2287ea134c5b65b4b2897103b7f9ff7f6b582f2e2

SHA512
9d75be81102e79a0cc5784ab21e007650acaadfa259e24ca3aaf8e207de52e40da6f64a0b193689621c64febdf5adb0eaf003b258119d42a88159a50616398b5

Download Submit
C:\Windows\SysWOW64\Lkeekk32.exe

Filesize
85KB

MD5
a128741b2da48e9944553bcd40d8cebb

SHA1
ed41b055f7f4bfaadfd7e5538a2ef1914e1149f4

SHA256
ca44e9840433630530b68f3930bb0a3d84565f741f177f3e6afc4e554e482a85

SHA512
9ed241fc6e3a7248199226244f6bcc4c71a8811a93def43eb25aad5916a80132ad0898ab38831931d950c6b632b27e5d713f35815c5f3025d4470531728ae54c

Download Submit
C:\Windows\SysWOW64\Lmgabcge.exe

Filesize
85KB

MD5
0cb2bda1e5f644b193f52bc2f7bd2972

SHA1
c3403839f24ba083268a3a2fe679c25cf0e567ca

SHA256
dbb6ec590ef779ae8b7ae10572fec5323a1cca67031e53830b7c1840d02f4b81

SHA512
4ae6f7d017b79a00d3e8a7ebfc8da6381a41d45acfa4ce5a2a01e6226317cce787d7fd05dc9774f58c8d318c1e3681c99702bf52a3293832e94be316167ac418

Download Submit
C:\Windows\SysWOW64\Lnkedd32.exe

Filesize
7KB

MD5
939074f60a71326323b7011dc34b141d

SHA1
0b196d45214e15ada1aef5b33435d50a91a60163

SHA256
5c1ce0350fab5ddf7185c47c9af79c11be17c6587ac90a9af54394647e9364f2

SHA512
8f76f35668ca26aa6b4d16885c62c944fa8bdf3b8fb23117480b0920f7f4130cfed7c0cd9e4e73572fe7d44bb23fed754d33840091ee4da87d760f1fc12f8d98

Download Submit
C:\Windows\SysWOW64\Madjbg32.exe

Filesize
1KB

MD5
2b897e497a6b2a270a0992edeec76540

SHA1
cd03901c7cdfb92c8ddda874628415345eddad1a

SHA256
d9c6bb288e6def32378097d38a675854156d128c6ff4d30e78270cc835bc227b

SHA512
4350d8fb5bfc234a2790728519df5ed9b91ef310fe885a29f0440a103606658c4baa41493ea790056e409bfe3b326db613fdb20e99cb222a19353ad91d72d28e

Download Submit
C:\Windows\SysWOW64\Madjhb32.exe

Filesize
85KB

MD5
cfa6f6ea164351c730d9f433b393944a

SHA1
fd96e24a52f85693e78a4a5790ced75ab4ee789b

SHA256
75daca6f6f6d2744f8d9419a0090a605eabd25a27abf86d221b3547e5562ff44

SHA512
21d44a832733bbcc849181e934c4faf7762db69633908f99b27202f4d9e939af72acfb9525b001e49ed5e559cc0ab1f31f1fe18f83e8a0a28a8a3ccc932aebd7

Download Submit
C:\Windows\SysWOW64\Mcqjhc32.exe

Filesize
7KB

MD5
d903d0e05f3084ee551bf317b6ee54f7

SHA1
7dc5988c5c9361840d990346be273d015b01e0f6

SHA256
f910f61375fef3f8d407ac1721670991eeca5883c16b9e66b58890b0372d0260

SHA512
3ee8f528b85657ddced59691f9aa824c1c28be7e80756948f6d43870775deec940d5a1c13e12ba0c7d6dcd78289768d3a875430a01f98a88faddccd60970e65e

Download Submit
C:\Windows\SysWOW64\Mjhepnno.exe

Filesize
13KB

MD5
bd9dacf740420148ead936e45b6ddb8f

SHA1
952faf5526ef514ee085b1db7ba0c2b86cf70186

SHA256
49cf5482cb58b3824d220fb8ae18e2772037ef36d8dc3f0b436fe7dfeb819ac6

SHA512
87b8c24a810550792e90611d929a6fffd6e5802428e408e7b059f6a852533b21ef8e0f23ec75dc0c3f61ad568d18ed67c1e0aa79a3440189691078ead841ac99

Download Submit
C:\Windows\SysWOW64\Mkhapk32.exe

Filesize
85KB

MD5
35547a6c3f3e2ac43485928e5d281380

SHA1
f1e65d67bce15d2ce236e988c5cf5bdfab227e1c

SHA256
def7649e42aac0ea0d9e832639c96f58499a9a2ecbe3dfee4f6f08e4cc65806f

SHA512
cd610e5ded3a2a5aaa18873c3a589dabb78e38d3db4d2feee98b0331d80550dd042f4c2787533019df7e86face2e98317d49d002f83794c928fcbf6bebd0476a

Download Submit
C:\Windows\SysWOW64\Mnhkbfme.exe

Filesize
16KB

MD5
e209f8d83e26d6d3ab331a014e1f3c76

SHA1
33d3a622111208b02a400a44618eb6eda7433b67

SHA256
f4b3e31077d0b4ea69128bc1c05004451a4d7a98aea77ded2ece0a0e2d6699de

SHA512
2fd1af783d32df1c79db0e650cf4fc5aa9ba88b859204ce37c5274a9e305e232bddb49df4d3acd515fb2f2d8c921863f51d9c36a8cf2c2a8b8239050c42a39a6

Download Submit
C:\Windows\SysWOW64\Mnhkbfme.exe

Filesize
1KB

MD5
3e48a885978999224479dc243fcca299

SHA1
e33980ff5de45ebe03d4578816a46ec095372f85

SHA256
b00cd09d5bb77d030b804fc9e126a7cd6f7a5e5fbf43b07037be3d363b870185

SHA512
0bfd0ca70f887914a6bc6790343eb07964dea7ba1c5da627ef9564d1e14f72232360ccdf166a05d53c8121a8109bfbea677c02761f885270d329a50131412259

Download Submit
C:\Windows\SysWOW64\Ndpcdjho.exe

Filesize
1KB

MD5
d731b7c35677508e554dd64eebc3ac8b

SHA1
f7426fe3665e4829ca04970223d3b89a74ca58ae

SHA256
c8ca69cf6695bbb6cb8b9218a88ff41aefd5e76ff972306f8c6091ef29f5bc5e

SHA512
b8658e1b3f13edbb2c17ec33136b4532cce8f4b1db1d7cc2b7bf6fe7c7b3bb1a9606643fc6919d6fc66c46b99b4c3bbb7e67a692a4169fc06207c045e21b4d46

Download Submit
C:\Windows\SysWOW64\Ofijnbkb.exe

Filesize
42KB

MD5
2d8bebc42689b8d746298b4f8b6804f9

SHA1
a4b8afc00ae256e8f81ea16a449ceda33a6e0628

SHA256
ab5f9a3bb245ae9d5daba3c97050c871e7c0745381784cdcceabf5c053d74c9a

SHA512
bcc3818cd501072b2de64ec5574825ab051f1c3a33b6cfdff3e5367fda9f77c62027815d0a63ff31b06469bd972dea8f558a628ec3f1473886f349d05f4ff479

Download Submit
C:\Windows\SysWOW64\Ooangh32.exe

Filesize
1KB

MD5
16374dc2f982b03da667444857d0c09e

SHA1
60c73135747ca4a6de329acb517a8108db6b0b19

SHA256
290d36591da21cfb73a9c11909420bcb680ee2212a5c9f51f906871d4930aaa7

SHA512
b7019c0fdaf598964f1f17f968520a7ad97a4853be9dd5171527f31d62bae4b39a2e21f29ca8838c16a1412e9afa698e70d6a68ebafb139493ae7366c620e41c

Download Submit
C:\Windows\SysWOW64\Pfdjinjo.exe

Filesize
1KB

MD5
aed06c03fb31280c59c0f9ed78a0e523

SHA1
9b0cbcc4dde7ee23c5c4e6304da25784ba26fe94

SHA256
c0dedbcdf4a1198b49b7d45a2a178ec026bf9fc5c6cbe07da23616f5f07fd293

SHA512
89337230410ef5010df0ef6d18c7d7674ce2a15c6dab382b8d2b42c0269180ad6262dd3b835f22313a73173f13b0ea04a7bac88d84345d079714ae703bb06079

Download Submit
C:\Windows\SysWOW64\Phkaqqoi.exe

Filesize
85KB

MD5
1fb64ec53d4c5298e5fd786b2abf3222

SHA1
55d6c9f657726c94e3ce278a23ec3d760f50d4d8

SHA256
9d7b127ecacacd44062233c372b85e0730ed678d2430334b30200f1151483736

SHA512
3b7ef1caf94291f348bf018aaa042d3253f674b89a4564e489921da838b6eadcba4068dbbf576ada2f455bc93e7ec65cea2a01b5e238621e60050ed07a861ae7

Download Submit
memory/100-266-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/224-116-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/224-198-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/376-5-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/376-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/448-289-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/448-211-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/684-181-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/836-164-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/880-337-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1008-317-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1192-94-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1400-282-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1400-203-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1708-276-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1708-330-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1756-258-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1812-309-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1812-244-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1908-296-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1968-287-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2260-98-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2260-176-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2344-45-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2396-226-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2436-201-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2580-21-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2652-105-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2652-25-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2676-184-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2676-106-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2704-147-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2836-293-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2860-33-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2860-115-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3100-141-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3100-65-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3452-302-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3452-227-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3516-323-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3516-270-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3556-61-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3668-315-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3672-49-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3672-128-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3716-159-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3716-81-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3732-324-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3800-307-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3800-237-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3936-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3936-13-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4024-130-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4376-133-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4376-220-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4392-190-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4524-151-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4524-235-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4528-253-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4528-168-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4692-72-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4692-149-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4864-306-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5068-335-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads