961e9e23dbc775641b70567a04d840e8e060b4bcccb3683c867ad2f5605e4965

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b17e90f01e2631a1b5ded49b876c315a.exe
Size

276KB
MD5

b17e90f01e2631a1b5ded49b876c315a
SHA1

c260f2678fce452b779fcdf69e028f4a0f8ad0d6
SHA256

961e9e23dbc775641b70567a04d840e8e060b4bcccb3683c867ad2f5605e4965
SHA512

02d3e21aec4f386f75be09499c322f8cfd0137ef899f04846e91ebcea52824848a0093e997c142dd887b1c527a54291277b81f66bb889094dc6b427b72c7012d
SSDEEP

6144:oSdvORLSdn7MUZst5qXsunbLwMddjPXmF6EC1LlzxAKN+xTU5AX/KXWZCKl/j:oScR+pMUQunbpd/mF6ECJlzxAKN2X/Ws

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfoiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oanfen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qeodhjmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcpmen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efafgifc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onnmdcjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpoalo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nncccnol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flqdlnde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgclpkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnpabe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojdnid32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igdgglfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kncaec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kqmkae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omgcpokp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Popbpqjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aogiap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aonoao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjeplijj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahcajk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gldglf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bipecnkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjmcnbdm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oeaoab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idahjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inlihl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jokkgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aleckinj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhcjqinf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpbmfn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efgemb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahcajk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gikkfqmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omegjomb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clchbqoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpgpgfmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqbncb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhpfqcln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhclmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akamff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnfaohbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gojiiafp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfoiaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oeokal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgibpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgopidgf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afkknogn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkbocbog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjhacf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icknfcol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnbakghm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gblbca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igfclkdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmbhoeid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jngbjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Niojoeel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfodeohd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcclld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmdhcddh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knalji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmnhcb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cljobphg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gncchb32.exe

Malware Dropper & Backdoor - Berbew 39 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x000600000002323f-95.dat	family_berbew
behavioral2/files/0x0006000000023241-104.dat	family_berbew
behavioral2/files/0x0006000000023243-110.dat	family_berbew
behavioral2/files/0x0006000000023245-119.dat	family_berbew
behavioral2/files/0x0006000000023245-118.dat	family_berbew
behavioral2/files/0x0006000000023247-127.dat	family_berbew
behavioral2/files/0x000600000002324d-151.dat	family_berbew
behavioral2/files/0x000600000002324d-150.dat	family_berbew
behavioral2/files/0x000600000002324b-143.dat	family_berbew
behavioral2/files/0x000600000002324b-142.dat	family_berbew
behavioral2/files/0x0006000000023252-174.dat	family_berbew
behavioral2/files/0x0006000000023254-182.dat	family_berbew
behavioral2/files/0x0006000000023254-184.dat	family_berbew
behavioral2/files/0x0006000000023258-198.dat	family_berbew
behavioral2/files/0x000600000002325a-201.dat	family_berbew
behavioral2/files/0x000600000002325a-207.dat	family_berbew
behavioral2/files/0x0006000000023262-239.dat	family_berbew
behavioral2/files/0x000b000000023125-255.dat	family_berbew
behavioral2/files/0x0007000000023266-263.dat	family_berbew
behavioral2/files/0x0006000000023295-389.dat	family_berbew
behavioral2/files/0x000600000002329b-407.dat	family_berbew
behavioral2/files/0x00060000000232ad-461.dat	family_berbew
behavioral2/files/0x00060000000232b3-479.dat	family_berbew
behavioral2/files/0x00060000000232bd-509.dat	family_berbew
behavioral2/files/0x0006000000023302-748.dat	family_berbew
behavioral2/files/0x000600000002337c-1167.dat	family_berbew
behavioral2/files/0x0006000000023372-1136.dat	family_berbew
behavioral2/files/0x0006000000023350-1021.dat	family_berbew
behavioral2/files/0x0006000000023340-965.dat	family_berbew
behavioral2/files/0x000b000000023125-254.dat	family_berbew
behavioral2/files/0x0006000000023263-247.dat	family_berbew
behavioral2/files/0x0006000000023262-238.dat	family_berbew
behavioral2/files/0x0006000000023260-231.dat	family_berbew
behavioral2/files/0x000600000002325e-223.dat	family_berbew
behavioral2/files/0x000600000002325e-217.dat	family_berbew
behavioral2/files/0x000600000002325a-206.dat	family_berbew
behavioral2/files/0x0006000000023258-199.dat	family_berbew
behavioral2/files/0x000a000000023129-167.dat	family_berbew
behavioral2/files/0x000600000002324f-159.dat	family_berbew

Executes dropped EXE 64 IoCs

pid	Process
3372	Hkbdki32.exe
4292	Ihphkl32.exe
1392	Ijadbdoj.exe
4448	Iakiia32.exe
4900	Iggaah32.exe
2188	Inainbcn.exe
3540	Idkbkl32.exe
1760	Ijhjcchb.exe
2724	Jhijqj32.exe
2912	Jhlgfj32.exe
3460	Jjmcnbdm.exe
1992	Jqiipljg.exe
2388	Jgcamf32.exe
2032	Jqlefl32.exe
3800	Jkaicd32.exe
1168	Jbkbpoog.exe
3028	Kiejmi32.exe
1648	Kjffdalb.exe
3952	Kqpoakco.exe
4004	Kjhcjq32.exe
1368	Kgopidgf.exe
3812	Kniieo32.exe
540	Kageaj32.exe
4408	Lbgalmej.exe
4884	Liqihglg.exe
4976	Ljbfpo32.exe
4628	Licfngjd.exe
5004	Lbkkgl32.exe
900	Lieccf32.exe
2824	Lnbklm32.exe
3388	Lelchgne.exe
4512	Leopnglc.exe
660	Llhikacp.exe
2580	Maeachag.exe
1076	Mjneln32.exe
2136	Mahnhhod.exe
3648	Miofjepg.exe
1544	Mjpbam32.exe
4692	Miaboe32.exe
1744	Mnnkgl32.exe
3548	Micoed32.exe
2832	Mjellmbp.exe
4924	Mblcnj32.exe
3832	Mhilfa32.exe
2544	Nbnpcj32.exe
3140	Nihipdhl.exe
856	Noeahkfc.exe
4060	Neoieenp.exe
2236	Nliaao32.exe
4992	Nafjjf32.exe
4064	Nlkngo32.exe
3232	Nbefdijg.exe
4876	Neccpd32.exe
2280	Nolgijpk.exe
3860	Nefped32.exe
460	Olbdhn32.exe
4604	Ooqqdi32.exe
5160	Oekiqccc.exe
5200	Oocmii32.exe
5240	Oemefcap.exe
5280	Ooejohhq.exe
5320	Oeoblb32.exe
5360	Oohgdhfn.exe
5400	Oeaoab32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ncpeaoih.exe	Nfldgk32.exe
File created	C:\Windows\SysWOW64\Bphqji32.exe	Bkkhbb32.exe
File created	C:\Windows\SysWOW64\Oohgdhfn.exe	Oeoblb32.exe
File opened for modification	C:\Windows\SysWOW64\Codhnb32.exe	Cijpahho.exe
File opened for modification	C:\Windows\SysWOW64\Eehicoel.exe	Ebimgcfi.exe
File opened for modification	C:\Windows\SysWOW64\Gejopl32.exe	Gblbca32.exe
File opened for modification	C:\Windows\SysWOW64\Lfeljd32.exe	Lgbloglj.exe
File created	C:\Windows\SysWOW64\Ejoaandc.dll	Aaohcj32.exe
File created	C:\Windows\SysWOW64\Ekmhejao.exe	Eecphp32.exe
File opened for modification	C:\Windows\SysWOW64\Liqihglg.exe	Lbgalmej.exe
File created	C:\Windows\SysWOW64\Qhlkilba.exe	Pcobaedj.exe
File created	C:\Windows\SysWOW64\Gncchb32.exe	Gldglf32.exe
File created	C:\Windows\SysWOW64\Iidphgcn.exe	Igfclkdj.exe
File created	C:\Windows\SysWOW64\Bbhildae.exe	Bpjmph32.exe
File created	C:\Windows\SysWOW64\Pefhlaie.exe	Plndcl32.exe
File created	C:\Windows\SysWOW64\Fbfcmhpg.exe	Fmikeaap.exe
File created	C:\Windows\SysWOW64\Ghoqak32.dll	Omgcpokp.exe
File created	C:\Windows\SysWOW64\Kniieo32.exe	Kgopidgf.exe
File created	C:\Windows\SysWOW64\Faimhjhp.dll	Eclmamod.exe
File created	C:\Windows\SysWOW64\Njinmf32.exe	Ngjbaj32.exe
File opened for modification	C:\Windows\SysWOW64\Onnmdcjm.exe	Ohcegi32.exe
File created	C:\Windows\SysWOW64\Jbhfhgch.dll	Kjjbjd32.exe
File created	C:\Windows\SysWOW64\Cohkokgj.exe	Cljobphg.exe
File created	C:\Windows\SysWOW64\Bgaclkia.dll	Hlepcdoa.exe
File created	C:\Windows\SysWOW64\Hkbdki32.exe	b17e90f01e2631a1b5ded49b876c315a.exe
File created	C:\Windows\SysWOW64\Akcoajfm.dll	Hefnkkkj.exe
File opened for modification	C:\Windows\SysWOW64\Nnhmnn32.exe	Ngndaccj.exe
File opened for modification	C:\Windows\SysWOW64\Nihipdhl.exe	Nbnpcj32.exe
File opened for modification	C:\Windows\SysWOW64\Bhpfqcln.exe	Bafndi32.exe
File created	C:\Windows\SysWOW64\Nflkbanj.exe	Npbceggm.exe
File opened for modification	C:\Windows\SysWOW64\Cgfbbb32.exe	Cdhffg32.exe
File created	C:\Windows\SysWOW64\Fnffhgon.exe	Fkgillpj.exe
File created	C:\Windows\SysWOW64\Cikamapb.dll	Hekgfj32.exe
File created	C:\Windows\SysWOW64\Nneilmna.dll	Gnmlhf32.exe
File opened for modification	C:\Windows\SysWOW64\Ckpbnb32.exe	Ciafbg32.exe
File created	C:\Windows\SysWOW64\Hkjefc32.dll	Aafemk32.exe
File created	C:\Windows\SysWOW64\Ohofdmkm.dll	Efjbcakl.exe
File created	C:\Windows\SysWOW64\Cdjblf32.exe	Calfpk32.exe
File created	C:\Windows\SysWOW64\Ejljgqdp.dll	Jdfjld32.exe
File created	C:\Windows\SysWOW64\Bjdbkbbn.dll	Kcmmhj32.exe
File opened for modification	C:\Windows\SysWOW64\Cienon32.exe	Cgfbbb32.exe
File opened for modification	C:\Windows\SysWOW64\Inainbcn.exe	Iggaah32.exe
File created	C:\Windows\SysWOW64\Hoeieolb.exe	Hlglidlo.exe
File created	C:\Windows\SysWOW64\Akamff32.exe	Ahcajk32.exe
File created	C:\Windows\SysWOW64\Mdkgabfn.dll	Efgemb32.exe
File created	C:\Windows\SysWOW64\Afeknhab.dll	Hmpcbhji.exe
File created	C:\Windows\SysWOW64\Bcominjm.dll	Bpjmph32.exe
File created	C:\Windows\SysWOW64\Ijadbdoj.exe	Ihphkl32.exe
File created	C:\Windows\SysWOW64\Mgobel32.exe	Mepfiq32.exe
File created	C:\Windows\SysWOW64\Jjjojj32.dll	Nflkbanj.exe
File created	C:\Windows\SysWOW64\Cancekeo.exe	Cigkdmel.exe
File created	C:\Windows\SysWOW64\Hjmgbm32.dll	Gbkdod32.exe
File created	C:\Windows\SysWOW64\Lbekag32.dll	Bcahmb32.exe
File opened for modification	C:\Windows\SysWOW64\Gdobnj32.exe	Gmdjapgb.exe
File created	C:\Windows\SysWOW64\Aonoao32.exe	Alpbecod.exe
File created	C:\Windows\SysWOW64\Efblbbqd.exe	Ekmhejao.exe
File opened for modification	C:\Windows\SysWOW64\Lnoaaaad.exe	Lgdidgjg.exe
File created	C:\Windows\SysWOW64\Legokici.dll	Nihipdhl.exe
File opened for modification	C:\Windows\SysWOW64\Gdjibj32.exe	Fjadje32.exe
File opened for modification	C:\Windows\SysWOW64\Ahippdbe.exe	Aaohcj32.exe
File opened for modification	C:\Windows\SysWOW64\Jgmjmjnb.exe	Jpcapp32.exe
File created	C:\Windows\SysWOW64\Ggamph32.dll	Dikihe32.exe
File created	C:\Windows\SysWOW64\Apddkmko.dll	Lbkkgl32.exe
File opened for modification	C:\Windows\SysWOW64\Bfngdn32.exe	Aodogdmn.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3512	5456	WerFault.exe	641

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Knfeeimj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fihnomjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jokkgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmnnimak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbfcmhpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pojcjh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjmfjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajlgckkf.dll"	Oeaoab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdepgkgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiplni32.dll"	Cdmoafdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojdnid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hknkchkd.dll"	Glgcbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ambahc32.dll"	Cijpahho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dblgpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdafpj32.dll"	Kgninn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aphblj32.dll"	Bkaobnio.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lggejg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjhkmbho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efafgifc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ememkjeq.dll"	Knooej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhffmd32.dll"	Njkkbehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olfghg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcobaedj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfkbde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcgmfg32.dll"	Lgjijmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njkkbehl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aednci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iidphgcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcpjnjii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bphqji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qcclld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfldelik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmfnpa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqkgbcff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdpjlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Feoodn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Flqdlnde.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbpchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fboqkn32.dll"	Lgibpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmkgkapm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmpcbhji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npgmpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Manmoq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phodcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajgqdaoi.dll"	Famhmfkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Idcepgmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fimhbfpl.dll"	Fngcmcfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iojbpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eafhkhce.dll"	Ejoomhmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odjjif32.dll"	Bhpfqcln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebjcajjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfabjq32.dll"	Gfjkjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cajdjn32.dll"	Knqepc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ikdcmpnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elcfgpga.dll"	Kageaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhcjqinf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhbcfbjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcdjbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbcfhibj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Codhnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flnqig32.dll"	Qepkbpak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hefnkkkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Plmmif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iohejo32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 3372	3756	b17e90f01e2631a1b5ded49b876c315a.exe	91
PID 3756 wrote to memory of 3372	3756	b17e90f01e2631a1b5ded49b876c315a.exe	91
PID 3756 wrote to memory of 3372	3756	b17e90f01e2631a1b5ded49b876c315a.exe	91
PID 3372 wrote to memory of 4292	3372	Hkbdki32.exe	92
PID 3372 wrote to memory of 4292	3372	Hkbdki32.exe	92
PID 3372 wrote to memory of 4292	3372	Hkbdki32.exe	92
PID 4292 wrote to memory of 1392	4292	Ihphkl32.exe	93
PID 4292 wrote to memory of 1392	4292	Ihphkl32.exe	93
PID 4292 wrote to memory of 1392	4292	Ihphkl32.exe	93
PID 1392 wrote to memory of 4448	1392	Ijadbdoj.exe	94
PID 1392 wrote to memory of 4448	1392	Ijadbdoj.exe	94
PID 1392 wrote to memory of 4448	1392	Ijadbdoj.exe	94
PID 4448 wrote to memory of 4900	4448	Iakiia32.exe	95
PID 4448 wrote to memory of 4900	4448	Iakiia32.exe	95
PID 4448 wrote to memory of 4900	4448	Iakiia32.exe	95
PID 4900 wrote to memory of 2188	4900	Iggaah32.exe	96
PID 4900 wrote to memory of 2188	4900	Iggaah32.exe	96
PID 4900 wrote to memory of 2188	4900	Iggaah32.exe	96
PID 2188 wrote to memory of 3540	2188	Inainbcn.exe	97
PID 2188 wrote to memory of 3540	2188	Inainbcn.exe	97
PID 2188 wrote to memory of 3540	2188	Inainbcn.exe	97
PID 3540 wrote to memory of 1760	3540	Idkbkl32.exe	98
PID 3540 wrote to memory of 1760	3540	Idkbkl32.exe	98
PID 3540 wrote to memory of 1760	3540	Idkbkl32.exe	98
PID 1760 wrote to memory of 2724	1760	Ijhjcchb.exe	99
PID 1760 wrote to memory of 2724	1760	Ijhjcchb.exe	99
PID 1760 wrote to memory of 2724	1760	Ijhjcchb.exe	99
PID 2724 wrote to memory of 2912	2724	Jhijqj32.exe	100
PID 2724 wrote to memory of 2912	2724	Jhijqj32.exe	100
PID 2724 wrote to memory of 2912	2724	Jhijqj32.exe	100
PID 2912 wrote to memory of 3460	2912	Jhlgfj32.exe	101
PID 2912 wrote to memory of 3460	2912	Jhlgfj32.exe	101
PID 2912 wrote to memory of 3460	2912	Jhlgfj32.exe	101
PID 3460 wrote to memory of 1992	3460	Jjmcnbdm.exe	102
PID 3460 wrote to memory of 1992	3460	Jjmcnbdm.exe	102
PID 3460 wrote to memory of 1992	3460	Jjmcnbdm.exe	102
PID 1992 wrote to memory of 2388	1992	Jqiipljg.exe	103
PID 1992 wrote to memory of 2388	1992	Jqiipljg.exe	103
PID 1992 wrote to memory of 2388	1992	Jqiipljg.exe	103
PID 2388 wrote to memory of 2032	2388	Jgcamf32.exe	104
PID 2388 wrote to memory of 2032	2388	Jgcamf32.exe	104
PID 2388 wrote to memory of 2032	2388	Jgcamf32.exe	104
PID 2032 wrote to memory of 3800	2032	Jqlefl32.exe	105
PID 2032 wrote to memory of 3800	2032	Jqlefl32.exe	105
PID 2032 wrote to memory of 3800	2032	Jqlefl32.exe	105
PID 3800 wrote to memory of 1168	3800	Jkaicd32.exe	106
PID 3800 wrote to memory of 1168	3800	Jkaicd32.exe	106
PID 3800 wrote to memory of 1168	3800	Jkaicd32.exe	106
PID 1168 wrote to memory of 3028	1168	Jbkbpoog.exe	588
PID 1168 wrote to memory of 3028	1168	Jbkbpoog.exe	588
PID 1168 wrote to memory of 3028	1168	Jbkbpoog.exe	588
PID 3028 wrote to memory of 1648	3028	Kiejmi32.exe	107
PID 3028 wrote to memory of 1648	3028	Kiejmi32.exe	107
PID 3028 wrote to memory of 1648	3028	Kiejmi32.exe	107
PID 1648 wrote to memory of 3952	1648	Kjffdalb.exe	108
PID 1648 wrote to memory of 3952	1648	Kjffdalb.exe	108
PID 1648 wrote to memory of 3952	1648	Kjffdalb.exe	108
PID 3952 wrote to memory of 4004	3952	Kqpoakco.exe	587
PID 3952 wrote to memory of 4004	3952	Kqpoakco.exe	587
PID 3952 wrote to memory of 4004	3952	Kqpoakco.exe	587
PID 4004 wrote to memory of 1368	4004	Kjhcjq32.exe	109
PID 4004 wrote to memory of 1368	4004	Kjhcjq32.exe	109
PID 4004 wrote to memory of 1368	4004	Kjhcjq32.exe	109
PID 1368 wrote to memory of 3812	1368	Kgopidgf.exe	586

C:\Users\Admin\AppData\Local\Temp\b17e90f01e2631a1b5ded49b876c315a.exe
"C:\Users\Admin\AppData\Local\Temp\b17e90f01e2631a1b5ded49b876c315a.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Windows\SysWOW64\Hkbdki32.exe
  C:\Windows\system32\Hkbdki32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\SysWOW64\Ihphkl32.exe
    C:\Windows\system32\Ihphkl32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Windows\SysWOW64\Ijadbdoj.exe
      C:\Windows\system32\Ijadbdoj.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1392
    - - C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4448
      - C:\Windows\SysWOW64\Iggaah32.exe
        
        C:\Windows\system32\Iggaah32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4900
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3540
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1760
        
        C:\Windows\SysWOW64\Jhijqj32.exe
        
        C:\Windows\system32\Jhijqj32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\SysWOW64\Jjmcnbdm.exe
        
        C:\Windows\system32\Jjmcnbdm.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3460
        
        C:\Windows\SysWOW64\Jqiipljg.exe
        
        C:\Windows\system32\Jqiipljg.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1992
        
        C:\Windows\SysWOW64\Jgcamf32.exe
        
        C:\Windows\system32\Jgcamf32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3800
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3028

C:\Windows\SysWOW64\Kjffdalb.exe
C:\Windows\system32\Kjffdalb.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\SysWOW64\Kqpoakco.exe
  C:\Windows\system32\Kqpoakco.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\SysWOW64\Kjhcjq32.exe
    C:\Windows\system32\Kjhcjq32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4004

C:\Windows\SysWOW64\Kgopidgf.exe
C:\Windows\system32\Kgopidgf.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\Kniieo32.exe
  C:\Windows\system32\Kniieo32.exe
  2⤵
  - Executes dropped EXE
  PID:3812

C:\Windows\SysWOW64\Lbkkgl32.exe
C:\Windows\system32\Lbkkgl32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5004
- C:\Windows\SysWOW64\Lieccf32.exe
  C:\Windows\system32\Lieccf32.exe
  2⤵
  - Executes dropped EXE
  PID:900
- - C:\Windows\SysWOW64\Lnbklm32.exe
    C:\Windows\system32\Lnbklm32.exe
    3⤵
    - Executes dropped EXE
    PID:2824
  - - C:\Windows\SysWOW64\Lelchgne.exe
      C:\Windows\system32\Lelchgne.exe
      4⤵
      Executes dropped EXE
      PID:3388

C:\Windows\SysWOW64\Mjneln32.exe
C:\Windows\system32\Mjneln32.exe
1⤵
- Executes dropped EXE
PID:1076
- C:\Windows\SysWOW64\Mahnhhod.exe
  C:\Windows\system32\Mahnhhod.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- - C:\Windows\SysWOW64\Miofjepg.exe
    C:\Windows\system32\Miofjepg.exe
    3⤵
    - Executes dropped EXE
    PID:3648
  - - C:\Windows\SysWOW64\Mjpbam32.exe
      C:\Windows\system32\Mjpbam32.exe
      4⤵
      Executes dropped EXE
      PID:1544
    - - C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        5⤵
        Executes dropped EXE
        
        PID:4692
      - C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        6⤵
        Executes dropped EXE
        
        PID:1744
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        7⤵
        Executes dropped EXE
        
        PID:3548
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        8⤵
        Executes dropped EXE
        
        PID:2832
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        9⤵
        Executes dropped EXE
        
        PID:4924
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        10⤵
        Executes dropped EXE
        
        PID:3832
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2544

C:\Windows\SysWOW64\Nihipdhl.exe
C:\Windows\system32\Nihipdhl.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3140
- C:\Windows\SysWOW64\Noeahkfc.exe
  C:\Windows\system32\Noeahkfc.exe
  2⤵
  - Executes dropped EXE
  PID:856
- - C:\Windows\SysWOW64\Neoieenp.exe
    C:\Windows\system32\Neoieenp.exe
    3⤵
    - Executes dropped EXE
    PID:4060
  - - C:\Windows\SysWOW64\Nliaao32.exe
      C:\Windows\system32\Nliaao32.exe
      4⤵
      Executes dropped EXE
      PID:2236

C:\Windows\SysWOW64\Nafjjf32.exe
C:\Windows\system32\Nafjjf32.exe
1⤵
- Executes dropped EXE
PID:4992
- C:\Windows\SysWOW64\Nlkngo32.exe
  C:\Windows\system32\Nlkngo32.exe
  2⤵
  - Executes dropped EXE
  PID:4064

C:\Windows\SysWOW64\Nbefdijg.exe
C:\Windows\system32\Nbefdijg.exe
1⤵
- Executes dropped EXE
PID:3232
- C:\Windows\SysWOW64\Neccpd32.exe
  C:\Windows\system32\Neccpd32.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- - C:\Windows\SysWOW64\Nolgijpk.exe
    C:\Windows\system32\Nolgijpk.exe
    3⤵
    - Executes dropped EXE
    PID:2280
  - - C:\Windows\SysWOW64\Nefped32.exe
      C:\Windows\system32\Nefped32.exe
      4⤵
      Executes dropped EXE
      PID:3860

C:\Windows\SysWOW64\Ooqqdi32.exe
C:\Windows\system32\Ooqqdi32.exe
1⤵
- Executes dropped EXE
PID:4604
- C:\Windows\SysWOW64\Oekiqccc.exe
  C:\Windows\system32\Oekiqccc.exe
  2⤵
  - Executes dropped EXE
  PID:5160

C:\Windows\SysWOW64\Oocmii32.exe
C:\Windows\system32\Oocmii32.exe
1⤵
- Executes dropped EXE
PID:5200
- C:\Windows\SysWOW64\Oemefcap.exe
  C:\Windows\system32\Oemefcap.exe
  2⤵
  - Executes dropped EXE
  PID:5240
- - C:\Windows\SysWOW64\Ooejohhq.exe
    C:\Windows\system32\Ooejohhq.exe
    3⤵
    - Executes dropped EXE
    PID:5280
  - - C:\Windows\SysWOW64\Oeoblb32.exe
      C:\Windows\system32\Oeoblb32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:5320
    - - C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        5⤵
        Executes dropped EXE
        
        PID:5360
      - C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        7⤵
        
        PID:5440

C:\Windows\SysWOW64\Pojcjh32.exe
C:\Windows\system32\Pojcjh32.exe
1⤵
- Modifies registry class
PID:5480
- C:\Windows\SysWOW64\Pedlgbkh.exe
  C:\Windows\system32\Pedlgbkh.exe
  2⤵
  PID:5520
- - C:\Windows\SysWOW64\Plndcl32.exe
    C:\Windows\system32\Plndcl32.exe
    3⤵
    - Drops file in System32 directory
    PID:5560
  - - C:\Windows\SysWOW64\Pefhlaie.exe
      C:\Windows\system32\Pefhlaie.exe
      4⤵
      PID:5600
    - - C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        5⤵
        
        PID:5644
      - C:\Windows\SysWOW64\Peieba32.exe
        
        C:\Windows\system32\Peieba32.exe
        6⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        7⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        8⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        9⤵
        
        PID:5808

C:\Windows\SysWOW64\Pcobaedj.exe
C:\Windows\system32\Pcobaedj.exe
1⤵
- Drops file in System32 directory
- Modifies registry class
PID:5848
- C:\Windows\SysWOW64\Qhlkilba.exe
  C:\Windows\system32\Qhlkilba.exe
  2⤵
  PID:5892
- - C:\Windows\SysWOW64\Qcaofebg.exe
    C:\Windows\system32\Qcaofebg.exe
    3⤵
    PID:5932
  - - C:\Windows\SysWOW64\Qepkbpak.exe
      C:\Windows\system32\Qepkbpak.exe
      4⤵
      Modifies registry class
      PID:5972
    - - C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        5⤵
        
        PID:6012

C:\Windows\SysWOW64\Qcclld32.exe
C:\Windows\system32\Qcclld32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6052
- C:\Windows\SysWOW64\Ahqddk32.exe
  C:\Windows\system32\Ahqddk32.exe
  2⤵
  PID:6092
- - C:\Windows\SysWOW64\Aojlaeei.exe
    C:\Windows\system32\Aojlaeei.exe
    3⤵
    PID:6136
  - - C:\Windows\SysWOW64\Aeddnp32.exe
      C:\Windows\system32\Aeddnp32.exe
      4⤵
      PID:5184

C:\Windows\SysWOW64\Ahcajk32.exe
C:\Windows\system32\Ahcajk32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5228
- C:\Windows\SysWOW64\Akamff32.exe
  C:\Windows\system32\Akamff32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:5308
- - C:\Windows\SysWOW64\Ajbmdn32.exe
    C:\Windows\system32\Ajbmdn32.exe
    3⤵
    PID:5388
  - - C:\Windows\SysWOW64\Alqjpi32.exe
      C:\Windows\system32\Alqjpi32.exe
      4⤵
      PID:5428
    - - C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        5⤵
        
        PID:5508
      - C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        6⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Alcfei32.exe
        
        C:\Windows\system32\Alcfei32.exe
        7⤵
        
        PID:5636

C:\Windows\SysWOW64\Aoabad32.exe
C:\Windows\system32\Aoabad32.exe
1⤵
PID:5696
- C:\Windows\SysWOW64\Afkknogn.exe
  C:\Windows\system32\Afkknogn.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:5756
- - C:\Windows\SysWOW64\Aleckinj.exe
    C:\Windows\system32\Aleckinj.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:5836
  - - C:\Windows\SysWOW64\Aodogdmn.exe
      C:\Windows\system32\Aodogdmn.exe
      4⤵
      Drops file in System32 directory
      PID:5900
    - - C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        5⤵
        
        PID:5980
      - C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        6⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        7⤵
        Drops file in System32 directory
        
        PID:6116
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        8⤵
        
        PID:2860

C:\Windows\SysWOW64\Bljlfh32.exe
C:\Windows\system32\Bljlfh32.exe
1⤵
PID:5316
- C:\Windows\SysWOW64\Bohibc32.exe
  C:\Windows\system32\Bohibc32.exe
  2⤵
  PID:3532
- - C:\Windows\SysWOW64\Bhcjqinf.exe
    C:\Windows\system32\Bhcjqinf.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Modifies registry class
    PID:5540
  - - C:\Windows\SysWOW64\Cmcolgbj.exe
      C:\Windows\system32\Cmcolgbj.exe
      4⤵
      PID:5624
    - - C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        5⤵
        
        PID:5668
      - C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        6⤵
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        7⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5928

C:\Windows\SysWOW64\Codhnb32.exe
C:\Windows\system32\Codhnb32.exe
1⤵
- Modifies registry class
PID:6040
- C:\Windows\SysWOW64\Cfnqklgh.exe
  C:\Windows\system32\Cfnqklgh.exe
  2⤵
  PID:5832
- - C:\Windows\SysWOW64\Ckkiccep.exe
    C:\Windows\system32\Ckkiccep.exe
    3⤵
    PID:5288

C:\Windows\SysWOW64\Ccbadp32.exe
C:\Windows\system32\Ccbadp32.exe
1⤵
PID:5448
- C:\Windows\SysWOW64\Cfqmpl32.exe
  C:\Windows\system32\Cfqmpl32.exe
  2⤵
  PID:5596

C:\Windows\SysWOW64\Ckmehb32.exe
C:\Windows\system32\Ckmehb32.exe
1⤵
PID:5736
- C:\Windows\SysWOW64\Ccdnjp32.exe
  C:\Windows\system32\Ccdnjp32.exe
  2⤵
  PID:5884
- - C:\Windows\SysWOW64\Ciafbg32.exe
    C:\Windows\system32\Ciafbg32.exe
    3⤵
    - Drops file in System32 directory
    PID:6084

C:\Windows\SysWOW64\Ckpbnb32.exe
C:\Windows\system32\Ckpbnb32.exe
1⤵
PID:5132
- C:\Windows\SysWOW64\Dbjkkl32.exe
  C:\Windows\system32\Dbjkkl32.exe
  2⤵
  PID:5476
- - C:\Windows\SysWOW64\Djqblj32.exe
    C:\Windows\system32\Djqblj32.exe
    3⤵
    PID:2788
  - - C:\Windows\SysWOW64\Dkbocbog.exe
      C:\Windows\system32\Dkbocbog.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:6076
    - - C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        5⤵
        Modifies registry class
        
        PID:5408
      - C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        6⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        7⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        8⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        9⤵
        
        PID:6112

C:\Windows\SysWOW64\Dmdhcddh.exe
C:\Windows\system32\Dmdhcddh.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6188
- C:\Windows\SysWOW64\Dcnqpo32.exe
  C:\Windows\system32\Dcnqpo32.exe
  2⤵
  PID:6228
- - C:\Windows\SysWOW64\Dflmlj32.exe
    C:\Windows\system32\Dflmlj32.exe
    3⤵
    PID:6272

C:\Windows\SysWOW64\Dikihe32.exe
C:\Windows\system32\Dikihe32.exe
1⤵
- Drops file in System32 directory
PID:6316
- C:\Windows\SysWOW64\Dlieda32.exe
  C:\Windows\system32\Dlieda32.exe
  2⤵
  PID:6356
- - C:\Windows\SysWOW64\Dcpmen32.exe
    C:\Windows\system32\Dcpmen32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:6400

C:\Windows\SysWOW64\Dfoiaj32.exe
C:\Windows\system32\Dfoiaj32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6448
- C:\Windows\SysWOW64\Dimenegi.exe
  C:\Windows\system32\Dimenegi.exe
  2⤵
  PID:6496

C:\Windows\SysWOW64\Dlkbjqgm.exe
C:\Windows\system32\Dlkbjqgm.exe
1⤵
PID:6540
- C:\Windows\SysWOW64\Ecbjkngo.exe
  C:\Windows\system32\Ecbjkngo.exe
  2⤵
  PID:6576

C:\Windows\SysWOW64\Efafgifc.exe
C:\Windows\system32\Efafgifc.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6616
- C:\Windows\SysWOW64\Emkndc32.exe
  C:\Windows\system32\Emkndc32.exe
  2⤵
  PID:6664
- - C:\Windows\SysWOW64\Epikpo32.exe
    C:\Windows\system32\Epikpo32.exe
    3⤵
    PID:6716

C:\Windows\SysWOW64\Ebhglj32.exe
C:\Windows\system32\Ebhglj32.exe
1⤵
PID:6768
- C:\Windows\SysWOW64\Ejoomhmi.exe
  C:\Windows\system32\Ejoomhmi.exe
  2⤵
  - Modifies registry class
  PID:6820
- - C:\Windows\SysWOW64\Emmkiclm.exe
    C:\Windows\system32\Emmkiclm.exe
    3⤵
    PID:6860
  - - C:\Windows\SysWOW64\Eplgeokq.exe
      C:\Windows\system32\Eplgeokq.exe
      4⤵
      PID:6908
    - - C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        5⤵
        Modifies registry class
        
        PID:6952
      - C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        6⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        7⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        8⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        9⤵
        Drops file in System32 directory
        
        PID:7132

C:\Windows\SysWOW64\Ejfeng32.exe
C:\Windows\system32\Ejfeng32.exe
1⤵
PID:5684
- C:\Windows\SysWOW64\Emdajb32.exe
  C:\Windows\system32\Emdajb32.exe
  2⤵
  PID:6180

C:\Windows\SysWOW64\Fpbmfn32.exe
C:\Windows\system32\Fpbmfn32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6280
- C:\Windows\SysWOW64\Fbajbi32.exe
  C:\Windows\system32\Fbajbi32.exe
  2⤵
  PID:6324
- - C:\Windows\SysWOW64\Fjhacf32.exe
    C:\Windows\system32\Fjhacf32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:6372

C:\Windows\SysWOW64\Fmfnpa32.exe
C:\Windows\system32\Fmfnpa32.exe
1⤵
- Modifies registry class
PID:6460
- C:\Windows\SysWOW64\Fpejlmcf.exe
  C:\Windows\system32\Fpejlmcf.exe
  2⤵
  PID:6528

C:\Windows\SysWOW64\Fbcfhibj.exe
C:\Windows\system32\Fbcfhibj.exe
1⤵
- Modifies registry class
PID:6600
- C:\Windows\SysWOW64\Fjjnifbl.exe
  C:\Windows\system32\Fjjnifbl.exe
  2⤵
  PID:6708

C:\Windows\SysWOW64\Fmikeaap.exe
C:\Windows\system32\Fmikeaap.exe
1⤵
- Drops file in System32 directory
PID:6812
- C:\Windows\SysWOW64\Fbfcmhpg.exe
  C:\Windows\system32\Fbfcmhpg.exe
  2⤵
  - Modifies registry class
  PID:6916
- - C:\Windows\SysWOW64\Fmkgkapm.exe
    C:\Windows\system32\Fmkgkapm.exe
    3⤵
    - Modifies registry class
    PID:6984
  - - C:\Windows\SysWOW64\Fdepgkgj.exe
      C:\Windows\system32\Fdepgkgj.exe
      4⤵
      Modifies registry class
      PID:7076
    - - C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        5⤵
        
        PID:7108

C:\Windows\SysWOW64\Fibhpbea.exe
C:\Windows\system32\Fibhpbea.exe
1⤵
PID:5816
- C:\Windows\SysWOW64\Flqdlnde.exe
  C:\Windows\system32\Flqdlnde.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Modifies registry class
  PID:6264
- - C:\Windows\SysWOW64\Fbjmhh32.exe
    C:\Windows\system32\Fbjmhh32.exe
    3⤵
    PID:6380
  - - C:\Windows\SysWOW64\Fjadje32.exe
      C:\Windows\system32\Fjadje32.exe
      4⤵
      Drops file in System32 directory
      PID:6436
    - - C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        5⤵
        
        PID:6572
      - C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        6⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        7⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        8⤵
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        9⤵
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        10⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        11⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6444

C:\Windows\SysWOW64\Gpecbk32.exe
C:\Windows\system32\Gpecbk32.exe
1⤵
PID:6548
- C:\Windows\SysWOW64\Gfokoelp.exe
  C:\Windows\system32\Gfokoelp.exe
  2⤵
  PID:6756
- - C:\Windows\SysWOW64\Gingkqkd.exe
    C:\Windows\system32\Gingkqkd.exe
    3⤵
    PID:7020
  - - C:\Windows\SysWOW64\Glldgljg.exe
      C:\Windows\system32\Glldgljg.exe
      4⤵
      PID:6020
    - - C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        5⤵
        
        PID:6656
      - C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        6⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        7⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6928
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        9⤵
        
        PID:6840

C:\Windows\SysWOW64\Idcepgmg.exe
C:\Windows\system32\Idcepgmg.exe
1⤵
- Modifies registry class
PID:2484
- C:\Windows\SysWOW64\Iknmla32.exe
  C:\Windows\system32\Iknmla32.exe
  2⤵
  PID:7128
- - C:\Windows\SysWOW64\Inlihl32.exe
    C:\Windows\system32\Inlihl32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:2112
  - - C:\Windows\SysWOW64\Iciaqc32.exe
      C:\Windows\system32\Iciaqc32.exe
      4⤵
      PID:7184
    - - C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        5⤵
        
        PID:7252

C:\Windows\SysWOW64\Ilafiihp.exe
C:\Windows\system32\Ilafiihp.exe
1⤵
PID:7308
- C:\Windows\SysWOW64\Icknfcol.exe
  C:\Windows\system32\Icknfcol.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:7356
- - C:\Windows\SysWOW64\Ijegcm32.exe
    C:\Windows\system32\Ijegcm32.exe
    3⤵
    PID:7404
  - - C:\Windows\SysWOW64\Idkkpf32.exe
      C:\Windows\system32\Idkkpf32.exe
      4⤵
      PID:7448
    - - C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        5⤵
        Modifies registry class
        
        PID:7500

C:\Windows\SysWOW64\Jncoikmp.exe
C:\Windows\system32\Jncoikmp.exe
1⤵
PID:7536
- C:\Windows\SysWOW64\Jpaleglc.exe
  C:\Windows\system32\Jpaleglc.exe
  2⤵
  PID:7584
- - C:\Windows\SysWOW64\Jcphab32.exe
    C:\Windows\system32\Jcphab32.exe
    3⤵
    PID:7632

C:\Windows\SysWOW64\Jkgpbp32.exe
C:\Windows\system32\Jkgpbp32.exe
1⤵
PID:7676
- C:\Windows\SysWOW64\Jnelok32.exe
  C:\Windows\system32\Jnelok32.exe
  2⤵
  PID:7724
- - C:\Windows\SysWOW64\Jpdhkf32.exe
    C:\Windows\system32\Jpdhkf32.exe
    3⤵
    PID:7768
  - - C:\Windows\SysWOW64\Jpfepf32.exe
      C:\Windows\system32\Jpfepf32.exe
      4⤵
      PID:7816
    - - C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        5⤵
        
        PID:7872
      - C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        6⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        7⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        8⤵
        
        PID:8000

C:\Windows\SysWOW64\Jdfjld32.exe
C:\Windows\system32\Jdfjld32.exe
1⤵
- Drops file in System32 directory
PID:8040
- C:\Windows\SysWOW64\Jgeghp32.exe
  C:\Windows\system32\Jgeghp32.exe
  2⤵
  PID:8084
- - C:\Windows\SysWOW64\Kjccdkki.exe
    C:\Windows\system32\Kjccdkki.exe
    3⤵
    PID:8132

C:\Windows\SysWOW64\Knooej32.exe
C:\Windows\system32\Knooej32.exe
1⤵
- Modifies registry class
PID:8176
- C:\Windows\SysWOW64\Kqmkae32.exe
  C:\Windows\system32\Kqmkae32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:7228
- - C:\Windows\SysWOW64\Kggcnoic.exe
    C:\Windows\system32\Kggcnoic.exe
    3⤵
    PID:7336
  - - C:\Windows\SysWOW64\Knalji32.exe
      C:\Windows\system32\Knalji32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:7380

C:\Windows\SysWOW64\Kqphfe32.exe
C:\Windows\system32\Kqphfe32.exe
1⤵
PID:7440
- C:\Windows\SysWOW64\Kgipcogp.exe
  C:\Windows\system32\Kgipcogp.exe
  2⤵
  PID:7524
- - C:\Windows\SysWOW64\Knchpiom.exe
    C:\Windows\system32\Knchpiom.exe
    3⤵
    PID:7576

C:\Windows\SysWOW64\Kdmqmc32.exe
C:\Windows\system32\Kdmqmc32.exe
1⤵
PID:7660
- C:\Windows\SysWOW64\Kkgiimng.exe
  C:\Windows\system32\Kkgiimng.exe
  2⤵
  PID:7732
- - C:\Windows\SysWOW64\Knfeeimj.exe
    C:\Windows\system32\Knfeeimj.exe
    3⤵
    - Modifies registry class
    PID:7804
  - - C:\Windows\SysWOW64\Kqdaadln.exe
      C:\Windows\system32\Kqdaadln.exe
      4⤵
      PID:7880

C:\Windows\SysWOW64\Kgninn32.exe
C:\Windows\system32\Kgninn32.exe
1⤵
- Modifies registry class
PID:7944
- C:\Windows\SysWOW64\Kjmfjj32.exe
  C:\Windows\system32\Kjmfjj32.exe
  2⤵
  - Modifies registry class
  PID:8020
- - C:\Windows\SysWOW64\Kqfngd32.exe
    C:\Windows\system32\Kqfngd32.exe
    3⤵
    PID:8092
  - - C:\Windows\SysWOW64\Lqkgbcff.exe
      C:\Windows\system32\Lqkgbcff.exe
      4⤵
      Modifies registry class
      PID:8172
    - - C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        5⤵
        
        PID:7244
      - C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        6⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        7⤵
        
        PID:7552

C:\Windows\SysWOW64\Lclpdncg.exe
C:\Windows\system32\Lclpdncg.exe
1⤵
PID:7648
- C:\Windows\SysWOW64\Lkchelci.exe
  C:\Windows\system32\Lkchelci.exe
  2⤵
  PID:7760
- - C:\Windows\SysWOW64\Lmdemd32.exe
    C:\Windows\system32\Lmdemd32.exe
    3⤵
    PID:7848
  - - C:\Windows\SysWOW64\Lgjijmin.exe
      C:\Windows\system32\Lgjijmin.exe
      4⤵
      Modifies registry class
      PID:7936

C:\Windows\SysWOW64\Lmgabcge.exe
C:\Windows\system32\Lmgabcge.exe
1⤵
PID:7192
- C:\Windows\SysWOW64\Lqbncb32.exe
  C:\Windows\system32\Lqbncb32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:7396
- - C:\Windows\SysWOW64\Mkhapk32.exe
    C:\Windows\system32\Mkhapk32.exe
    3⤵
    PID:7628
  - - C:\Windows\SysWOW64\Mnfnlf32.exe
      C:\Windows\system32\Mnfnlf32.exe
      4⤵
      PID:212
    - - C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        5⤵
        Drops file in System32 directory
        
        PID:7924
      - C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        6⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        7⤵
        
        PID:7480

C:\Windows\SysWOW64\Mjokgg32.exe
C:\Windows\system32\Mjokgg32.exe
1⤵
PID:7704
- C:\Windows\SysWOW64\Mmnhcb32.exe
  C:\Windows\system32\Mmnhcb32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:7808
- - C:\Windows\SysWOW64\Meepdp32.exe
    C:\Windows\system32\Meepdp32.exe
    3⤵
    PID:7512

C:\Windows\SysWOW64\Mgclpkac.exe
C:\Windows\system32\Mgclpkac.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7908
- C:\Windows\SysWOW64\Mjahlgpf.exe
  C:\Windows\system32\Mjahlgpf.exe
  2⤵
  PID:8072

C:\Windows\SysWOW64\Malpia32.exe
C:\Windows\system32\Malpia32.exe
1⤵
PID:7920
- C:\Windows\SysWOW64\Megljppl.exe
  C:\Windows\system32\Megljppl.exe
  2⤵
  PID:8232
- - C:\Windows\SysWOW64\Mkadfj32.exe
    C:\Windows\system32\Mkadfj32.exe
    3⤵
    PID:8272
  - - C:\Windows\SysWOW64\Mnpabe32.exe
      C:\Windows\system32\Mnpabe32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:8316

C:\Windows\SysWOW64\Manmoq32.exe
C:\Windows\system32\Manmoq32.exe
1⤵
- Modifies registry class
PID:8364
- C:\Windows\SysWOW64\Nclikl32.exe
  C:\Windows\system32\Nclikl32.exe
  2⤵
  PID:8404

C:\Windows\SysWOW64\Nlcalieg.exe
C:\Windows\system32\Nlcalieg.exe
1⤵
PID:8448
- C:\Windows\SysWOW64\Nnbnhedj.exe
  C:\Windows\system32\Nnbnhedj.exe
  2⤵
  PID:8488
- - C:\Windows\SysWOW64\Napjdpcn.exe
    C:\Windows\system32\Napjdpcn.exe
    3⤵
    PID:8536
  - - C:\Windows\SysWOW64\Ngjbaj32.exe
      C:\Windows\system32\Ngjbaj32.exe
      4⤵
      Drops file in System32 directory
      PID:8576

C:\Windows\SysWOW64\Njinmf32.exe
C:\Windows\system32\Njinmf32.exe
1⤵
PID:8644
- C:\Windows\SysWOW64\Nabfjpak.exe
  C:\Windows\system32\Nabfjpak.exe
  2⤵
  PID:8704

C:\Windows\SysWOW64\Nenbjo32.exe
C:\Windows\system32\Nenbjo32.exe
1⤵
PID:8752
- C:\Windows\SysWOW64\Nhmofj32.exe
  C:\Windows\system32\Nhmofj32.exe
  2⤵
  PID:8796

C:\Windows\SysWOW64\Njkkbehl.exe
C:\Windows\system32\Njkkbehl.exe
1⤵
- Modifies registry class
PID:8832
- C:\Windows\SysWOW64\Nmigoagp.exe
  C:\Windows\system32\Nmigoagp.exe
  2⤵
  PID:8872
- - C:\Windows\SysWOW64\Nccokk32.exe
    C:\Windows\system32\Nccokk32.exe
    3⤵
    PID:8924
  - - C:\Windows\SysWOW64\Nhokljge.exe
      C:\Windows\system32\Nhokljge.exe
      4⤵
      PID:8964

C:\Windows\SysWOW64\Njmhhefi.exe
C:\Windows\system32\Njmhhefi.exe
1⤵
PID:9008
- C:\Windows\SysWOW64\Nmlddqem.exe
  C:\Windows\system32\Nmlddqem.exe
  2⤵
  PID:9056
- - C:\Windows\SysWOW64\Neclenfo.exe
    C:\Windows\system32\Neclenfo.exe
    3⤵
    PID:9096
  - - C:\Windows\SysWOW64\Nhahaiec.exe
      C:\Windows\system32\Nhahaiec.exe
      4⤵
      PID:9136

C:\Windows\SysWOW64\Najmjokc.exe
C:\Windows\system32\Najmjokc.exe
1⤵
PID:1844
- C:\Windows\SysWOW64\Ohcegi32.exe
  C:\Windows\system32\Ohcegi32.exe
  2⤵
  - Drops file in System32 directory
  PID:8264
- - C:\Windows\SysWOW64\Onnmdcjm.exe
    C:\Windows\system32\Onnmdcjm.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:8312
  - - C:\Windows\SysWOW64\Oalipoiq.exe
      C:\Windows\system32\Oalipoiq.exe
      4⤵
      PID:3100

C:\Windows\SysWOW64\Odjeljhd.exe
C:\Windows\system32\Odjeljhd.exe
1⤵
PID:8440
- C:\Windows\SysWOW64\Ojdnid32.exe
  C:\Windows\system32\Ojdnid32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Modifies registry class
  PID:8512
- - C:\Windows\SysWOW64\Oanfen32.exe
    C:\Windows\system32\Oanfen32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:8564
  - - C:\Windows\SysWOW64\Odmbaj32.exe
      C:\Windows\system32\Odmbaj32.exe
      4⤵
      PID:8652
    - - C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        5⤵
        
        PID:8732
      - C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8804
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        7⤵
        Modifies registry class
        
        PID:8856
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8920
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9016
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        10⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        11⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        12⤵
        Modifies registry class
        
        PID:7864
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        13⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        14⤵
        
        PID:8456

C:\Windows\SysWOW64\Plmmif32.exe
C:\Windows\system32\Plmmif32.exe
1⤵
- Modifies registry class
PID:8520
- C:\Windows\SysWOW64\Pmoiqneg.exe
  C:\Windows\system32\Pmoiqneg.exe
  2⤵
  PID:8688
- - C:\Windows\SysWOW64\Pefabkej.exe
    C:\Windows\system32\Pefabkej.exe
    3⤵
    PID:8788
  - - C:\Windows\SysWOW64\Phdnngdn.exe
      C:\Windows\system32\Phdnngdn.exe
      4⤵
      PID:8908

C:\Windows\SysWOW64\Ponfka32.exe
C:\Windows\system32\Ponfka32.exe
1⤵
PID:8984
- C:\Windows\SysWOW64\Palbgl32.exe
  C:\Windows\system32\Palbgl32.exe
  2⤵
  PID:9144

C:\Windows\SysWOW64\Phfjcf32.exe
C:\Windows\system32\Phfjcf32.exe
1⤵
PID:8228
- C:\Windows\SysWOW64\Popbpqjh.exe
  C:\Windows\system32\Popbpqjh.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:8388

C:\Windows\SysWOW64\Pdmkhgho.exe
C:\Windows\system32\Pdmkhgho.exe
1⤵
PID:8632
- C:\Windows\SysWOW64\Pldcjeia.exe
  C:\Windows\system32\Pldcjeia.exe
  2⤵
  PID:8864
- - C:\Windows\SysWOW64\Qmepam32.exe
    C:\Windows\system32\Qmepam32.exe
    3⤵
    PID:9048
  - - C:\Windows\SysWOW64\Qdphngfl.exe
      C:\Windows\system32\Qdphngfl.exe
      4⤵
      PID:9212
    - - C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        5⤵
        
        PID:8444

C:\Windows\SysWOW64\Qeodhjmo.exe
C:\Windows\system32\Qeodhjmo.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8792
- C:\Windows\SysWOW64\Qhmqdemc.exe
  C:\Windows\system32\Qhmqdemc.exe
  2⤵
  PID:9044
- - C:\Windows\SysWOW64\Aogiap32.exe
    C:\Windows\system32\Aogiap32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:8308
  - - C:\Windows\SysWOW64\Aafemk32.exe
      C:\Windows\system32\Aafemk32.exe
      4⤵
      Drops file in System32 directory
      PID:8780
    - - C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        5⤵
        
        PID:1856
      - C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        6⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        7⤵
        Modifies registry class
        
        PID:8996
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        8⤵
        
        PID:9228

C:\Windows\SysWOW64\Anobgl32.exe
C:\Windows\system32\Anobgl32.exe
1⤵
PID:9268
- C:\Windows\SysWOW64\Adikdfna.exe
  C:\Windows\system32\Adikdfna.exe
  2⤵
  PID:9308

C:\Windows\SysWOW64\Alpbecod.exe
C:\Windows\system32\Alpbecod.exe
1⤵
- Drops file in System32 directory
PID:9348
- C:\Windows\SysWOW64\Aonoao32.exe
  C:\Windows\system32\Aonoao32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:9392

C:\Windows\SysWOW64\Aamknj32.exe
C:\Windows\system32\Aamknj32.exe
1⤵
PID:9440
- C:\Windows\SysWOW64\Ahgcjddh.exe
  C:\Windows\system32\Ahgcjddh.exe
  2⤵
  PID:9484
- - C:\Windows\SysWOW64\Akepfpcl.exe
    C:\Windows\system32\Akepfpcl.exe
    3⤵
    PID:9528
  - - C:\Windows\SysWOW64\Aaohcj32.exe
      C:\Windows\system32\Aaohcj32.exe
      4⤵
      Drops file in System32 directory
      PID:9576
    - - C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        5⤵
        
        PID:9616
      - C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        6⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        7⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        8⤵
        
        PID:9744

C:\Windows\SysWOW64\Bhkmec32.exe
C:\Windows\system32\Bhkmec32.exe
1⤵
PID:9792
- C:\Windows\SysWOW64\Bkjiao32.exe
  C:\Windows\system32\Bkjiao32.exe
  2⤵
  PID:9832
- - C:\Windows\SysWOW64\Bnhenj32.exe
    C:\Windows\system32\Bnhenj32.exe
    3⤵
    PID:9880

C:\Windows\SysWOW64\Bepmoh32.exe
C:\Windows\system32\Bepmoh32.exe
1⤵
PID:9920
- C:\Windows\SysWOW64\Bhnikc32.exe
  C:\Windows\system32\Bhnikc32.exe
  2⤵
  PID:9960
- - C:\Windows\SysWOW64\Bklfgo32.exe
    C:\Windows\system32\Bklfgo32.exe
    3⤵
    PID:10000

C:\Windows\SysWOW64\Bafndi32.exe
C:\Windows\system32\Bafndi32.exe
1⤵
- Drops file in System32 directory
PID:10044
- C:\Windows\SysWOW64\Bhpfqcln.exe
  C:\Windows\system32\Bhpfqcln.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Modifies registry class
  PID:10080
- - C:\Windows\SysWOW64\Bkobmnka.exe
    C:\Windows\system32\Bkobmnka.exe
    3⤵
    PID:10128
  - - C:\Windows\SysWOW64\Bedgjgkg.exe
      C:\Windows\system32\Bedgjgkg.exe
      4⤵
      PID:10168
    - - C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        5⤵
        Modifies registry class
        
        PID:10208
      - C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        6⤵
        Modifies registry class
        
        PID:8904

C:\Windows\SysWOW64\Bakgoh32.exe
C:\Windows\system32\Bakgoh32.exe
1⤵
PID:9328
- C:\Windows\SysWOW64\Bheplb32.exe
  C:\Windows\system32\Bheplb32.exe
  2⤵
  PID:9404
- - C:\Windows\SysWOW64\Ckclhn32.exe
    C:\Windows\system32\Ckclhn32.exe
    3⤵
    PID:9508

C:\Windows\SysWOW64\Camddhoi.exe
C:\Windows\system32\Camddhoi.exe
1⤵
PID:9568
- C:\Windows\SysWOW64\Cdlqqcnl.exe
  C:\Windows\system32\Cdlqqcnl.exe
  2⤵
  PID:9676

C:\Windows\SysWOW64\Clchbqoo.exe
C:\Windows\system32\Clchbqoo.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:9780
- C:\Windows\SysWOW64\Coadnlnb.exe
  C:\Windows\system32\Coadnlnb.exe
  2⤵
  PID:9872

C:\Windows\SysWOW64\Cbpajgmf.exe
C:\Windows\system32\Cbpajgmf.exe
1⤵
PID:9900
- C:\Windows\SysWOW64\Cdnmfclj.exe
  C:\Windows\system32\Cdnmfclj.exe
  2⤵
  PID:10008
- - C:\Windows\SysWOW64\Ckhecmcf.exe
    C:\Windows\system32\Ckhecmcf.exe
    3⤵
    PID:10088
  - - C:\Windows\SysWOW64\Cnfaohbj.exe
      C:\Windows\system32\Cnfaohbj.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:10164

C:\Windows\SysWOW64\Cdpjlb32.exe
C:\Windows\system32\Cdpjlb32.exe
1⤵
- Modifies registry class
PID:10220
- C:\Windows\SysWOW64\Cbdjeg32.exe
  C:\Windows\system32\Cbdjeg32.exe
  2⤵
  PID:9376

C:\Windows\SysWOW64\Cdbfab32.exe
C:\Windows\system32\Cdbfab32.exe
1⤵
PID:9492
- C:\Windows\SysWOW64\Cljobphg.exe
  C:\Windows\system32\Cljobphg.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  PID:9696
- - C:\Windows\SysWOW64\Cohkokgj.exe
    C:\Windows\system32\Cohkokgj.exe
    3⤵
    PID:9824
  - - C:\Windows\SysWOW64\Cfbcke32.exe
      C:\Windows\system32\Cfbcke32.exe
      4⤵
      PID:9988

C:\Windows\SysWOW64\Chqogq32.exe
C:\Windows\system32\Chqogq32.exe
1⤵
PID:10064
- C:\Windows\SysWOW64\Dkokcl32.exe
  C:\Windows\system32\Dkokcl32.exe
  2⤵
  PID:10200
- - C:\Windows\SysWOW64\Dnmhpg32.exe
    C:\Windows\system32\Dnmhpg32.exe
    3⤵
    PID:9644

C:\Windows\SysWOW64\Dfdpad32.exe
C:\Windows\system32\Dfdpad32.exe
1⤵
PID:9660
- C:\Windows\SysWOW64\Dhclmp32.exe
  C:\Windows\system32\Dhclmp32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:9904
- - C:\Windows\SysWOW64\Domdjj32.exe
    C:\Windows\system32\Domdjj32.exe
    3⤵
    PID:10072
  - - C:\Windows\SysWOW64\Dfglfdkb.exe
      C:\Windows\system32\Dfglfdkb.exe
      4⤵
      PID:9316
    - - C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        5⤵
        
        PID:9772
      - C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10076
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        7⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        8⤵
        Drops file in System32 directory
        
        PID:9948
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        9⤵
        Drops file in System32 directory
        
        PID:10040
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        10⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        11⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        12⤵
        
        PID:10328

C:\Windows\SysWOW64\Ebimgcfi.exe
C:\Windows\system32\Ebimgcfi.exe
1⤵
- Drops file in System32 directory
PID:10372
- C:\Windows\SysWOW64\Eehicoel.exe
  C:\Windows\system32\Eehicoel.exe
  2⤵
  PID:10416
- - C:\Windows\SysWOW64\Ekaapi32.exe
    C:\Windows\system32\Ekaapi32.exe
    3⤵
    PID:10460
  - - C:\Windows\SysWOW64\Enpmld32.exe
      C:\Windows\system32\Enpmld32.exe
      4⤵
      PID:10504

C:\Windows\SysWOW64\Efgemb32.exe
C:\Windows\system32\Efgemb32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:10544
- C:\Windows\SysWOW64\Emanjldl.exe
  C:\Windows\system32\Emanjldl.exe
  2⤵
  PID:10580
- - C:\Windows\SysWOW64\Eppjfgcp.exe
    C:\Windows\system32\Eppjfgcp.exe
    3⤵
    PID:10632

C:\Windows\SysWOW64\Efjbcakl.exe
C:\Windows\system32\Efjbcakl.exe
1⤵
- Drops file in System32 directory
PID:10668
- C:\Windows\SysWOW64\Fihnomjp.exe
  C:\Windows\system32\Fihnomjp.exe
  2⤵
  - Modifies registry class
  PID:10720

C:\Windows\SysWOW64\Fbpchb32.exe
C:\Windows\system32\Fbpchb32.exe
1⤵
- Modifies registry class
PID:10764
- C:\Windows\SysWOW64\Feoodn32.exe
  C:\Windows\system32\Feoodn32.exe
  2⤵
  - Modifies registry class
  PID:10812

C:\Windows\SysWOW64\Fmfgek32.exe
C:\Windows\system32\Fmfgek32.exe
1⤵
PID:10848
- C:\Windows\SysWOW64\Fngcmcfe.exe
  C:\Windows\system32\Fngcmcfe.exe
  2⤵
  - Modifies registry class
  PID:10896
- - C:\Windows\SysWOW64\Fealin32.exe
    C:\Windows\system32\Fealin32.exe
    3⤵
    PID:10936

C:\Windows\SysWOW64\Fmhdkknd.exe
C:\Windows\system32\Fmhdkknd.exe
1⤵
PID:10976
- C:\Windows\SysWOW64\Fpgpgfmh.exe
  C:\Windows\system32\Fpgpgfmh.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:11020
- - C:\Windows\SysWOW64\Ffqhcq32.exe
    C:\Windows\system32\Ffqhcq32.exe
    3⤵
    PID:11060
  - - C:\Windows\SysWOW64\Fiodpl32.exe
      C:\Windows\system32\Fiodpl32.exe
      4⤵
      PID:11100
    - - C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        5⤵
        
        PID:11144
      - C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        6⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11228

C:\Windows\SysWOW64\Gejopl32.exe
C:\Windows\system32\Gejopl32.exe
1⤵
PID:10032
- C:\Windows\SysWOW64\Gldglf32.exe
  C:\Windows\system32\Gldglf32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  PID:10324
- - C:\Windows\SysWOW64\Gncchb32.exe
    C:\Windows\system32\Gncchb32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:10368

C:\Windows\SysWOW64\Gfjkjo32.exe
C:\Windows\system32\Gfjkjo32.exe
1⤵
- Modifies registry class
PID:10428
- C:\Windows\SysWOW64\Gihgfk32.exe
  C:\Windows\system32\Gihgfk32.exe
  2⤵
  PID:10496
- - C:\Windows\SysWOW64\Glgcbf32.exe
    C:\Windows\system32\Glgcbf32.exe
    3⤵
    - Modifies registry class
    PID:10568

C:\Windows\SysWOW64\Gnepna32.exe
C:\Windows\system32\Gnepna32.exe
1⤵
PID:10640
- C:\Windows\SysWOW64\Gflhoo32.exe
  C:\Windows\system32\Gflhoo32.exe
  2⤵
  PID:10704
- - C:\Windows\SysWOW64\Gikdkj32.exe
    C:\Windows\system32\Gikdkj32.exe
    3⤵
    PID:10808
  - - C:\Windows\SysWOW64\Goglcahb.exe
      C:\Windows\system32\Goglcahb.exe
      4⤵
      PID:10860
    - - C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10932
      - C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        6⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11084
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        8⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        9⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        10⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        11⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10384
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        12⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        13⤵
        
        PID:10620

C:\Windows\SysWOW64\Hmpcbhji.exe
C:\Windows\system32\Hmpcbhji.exe
1⤵
- Drops file in System32 directory
- Modifies registry class
PID:10716
- C:\Windows\SysWOW64\Hpnoncim.exe
  C:\Windows\system32\Hpnoncim.exe
  2⤵
  PID:10836

C:\Windows\SysWOW64\Hblkjo32.exe
C:\Windows\system32\Hblkjo32.exe
1⤵
PID:10924
- C:\Windows\SysWOW64\Hekgfj32.exe
  C:\Windows\system32\Hekgfj32.exe
  2⤵
  - Drops file in System32 directory
  PID:11092
- - C:\Windows\SysWOW64\Hlepcdoa.exe
    C:\Windows\system32\Hlepcdoa.exe
    3⤵
    - Drops file in System32 directory
    PID:11192
  - - C:\Windows\SysWOW64\Hbohpn32.exe
      C:\Windows\system32\Hbohpn32.exe
      4⤵
      PID:11256
    - - C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        5⤵
        
        PID:10452
      - C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        6⤵
        Drops file in System32 directory
        
        PID:6900

C:\Windows\SysWOW64\Hoeieolb.exe
C:\Windows\system32\Hoeieolb.exe
1⤵
PID:10588
- C:\Windows\SysWOW64\Ifmqfm32.exe
  C:\Windows\system32\Ifmqfm32.exe
  2⤵
  PID:10696
- - C:\Windows\SysWOW64\Imgicgca.exe
    C:\Windows\system32\Imgicgca.exe
    3⤵
    PID:10904
  - - C:\Windows\SysWOW64\Iohejo32.exe
      C:\Windows\system32\Iohejo32.exe
      4⤵
      Modifies registry class
      PID:10988
    - - C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        5⤵
        
        PID:11220
      - C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        6⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        7⤵
        Modifies registry class
        
        PID:6796
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        8⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        9⤵
        
        PID:10972

C:\Windows\SysWOW64\Iomoenej.exe
C:\Windows\system32\Iomoenej.exe
1⤵
PID:2168
- C:\Windows\SysWOW64\Igdgglfl.exe
  C:\Windows\system32\Igdgglfl.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:10216
- - C:\Windows\SysWOW64\Ilqoobdd.exe
    C:\Windows\system32\Ilqoobdd.exe
    3⤵
    PID:10884

C:\Windows\SysWOW64\Ioolkncg.exe
C:\Windows\system32\Ioolkncg.exe
1⤵
PID:11212
- C:\Windows\SysWOW64\Igfclkdj.exe
  C:\Windows\system32\Igfclkdj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  PID:6828
- - C:\Windows\SysWOW64\Iidphgcn.exe
    C:\Windows\system32\Iidphgcn.exe
    3⤵
    - Modifies registry class
    PID:10756
  - - C:\Windows\SysWOW64\Joahqn32.exe
      C:\Windows\system32\Joahqn32.exe
      4⤵
      PID:10424
    - - C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        5⤵
        
        PID:11280
      - C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11324

C:\Windows\SysWOW64\Jocefm32.exe
C:\Windows\system32\Jocefm32.exe
1⤵
PID:11364
- C:\Windows\SysWOW64\Jgkmgk32.exe
  C:\Windows\system32\Jgkmgk32.exe
  2⤵
  PID:11408
- - C:\Windows\SysWOW64\Jmeede32.exe
    C:\Windows\system32\Jmeede32.exe
    3⤵
    PID:11452
  - - C:\Windows\SysWOW64\Jpcapp32.exe
      C:\Windows\system32\Jpcapp32.exe
      4⤵
      Drops file in System32 directory
      PID:11492
    - - C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        5⤵
        
        PID:11528

C:\Windows\SysWOW64\Jngbjd32.exe
C:\Windows\system32\Jngbjd32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11572
- C:\Windows\SysWOW64\Jpenfp32.exe
  C:\Windows\system32\Jpenfp32.exe
  2⤵
  PID:11612
- - C:\Windows\SysWOW64\Jcdjbk32.exe
    C:\Windows\system32\Jcdjbk32.exe
    3⤵
    - Modifies registry class
    PID:11652

C:\Windows\SysWOW64\Jebfng32.exe
C:\Windows\system32\Jebfng32.exe
1⤵
PID:11700
- C:\Windows\SysWOW64\Jinboekc.exe
  C:\Windows\system32\Jinboekc.exe
  2⤵
  PID:11744

C:\Windows\SysWOW64\Jllokajf.exe
C:\Windows\system32\Jllokajf.exe
1⤵
PID:11784
- C:\Windows\SysWOW64\Jokkgl32.exe
  C:\Windows\system32\Jokkgl32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Modifies registry class
  PID:11828

C:\Windows\SysWOW64\Jedccfqg.exe
C:\Windows\system32\Jedccfqg.exe
1⤵
PID:11872
- C:\Windows\SysWOW64\Jnlkedai.exe
  C:\Windows\system32\Jnlkedai.exe
  2⤵
  PID:11908
- - C:\Windows\SysWOW64\Kpjgaoqm.exe
    C:\Windows\system32\Kpjgaoqm.exe
    3⤵
    PID:11956
  - - C:\Windows\SysWOW64\Kgdpni32.exe
      C:\Windows\system32\Kgdpni32.exe
      4⤵
      PID:12000
    - - C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        5⤵
        
        PID:12052
      - C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        6⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        7⤵
        Modifies registry class
        
        PID:12132
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12176

C:\Windows\SysWOW64\Kcmmhj32.exe
C:\Windows\system32\Kcmmhj32.exe
1⤵
- Drops file in System32 directory
PID:12216
- C:\Windows\SysWOW64\Kflide32.exe
  C:\Windows\system32\Kflide32.exe
  2⤵
  PID:12256

C:\Windows\SysWOW64\Kncaec32.exe
C:\Windows\system32\Kncaec32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11272
- C:\Windows\SysWOW64\Kcpjnjii.exe
  C:\Windows\system32\Kcpjnjii.exe
  2⤵
  - Modifies registry class
  PID:11352
- - C:\Windows\SysWOW64\Kjjbjd32.exe
    C:\Windows\system32\Kjjbjd32.exe
    3⤵
    - Drops file in System32 directory
    PID:11416

C:\Windows\SysWOW64\Klhnfo32.exe
C:\Windows\system32\Klhnfo32.exe
1⤵
PID:11488
- C:\Windows\SysWOW64\Kcbfcigf.exe
  C:\Windows\system32\Kcbfcigf.exe
  2⤵
  PID:11552
- - C:\Windows\SysWOW64\Lpfgmnfp.exe
    C:\Windows\system32\Lpfgmnfp.exe
    3⤵
    PID:11640
  - - C:\Windows\SysWOW64\Lcdciiec.exe
      C:\Windows\system32\Lcdciiec.exe
      4⤵
      PID:11684
    - - C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        5⤵
        
        PID:11780
      - C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        6⤵
        
        PID:11856

C:\Windows\SysWOW64\Lokdnjkg.exe
C:\Windows\system32\Lokdnjkg.exe
1⤵
PID:11916
- C:\Windows\SysWOW64\Lgbloglj.exe
  C:\Windows\system32\Lgbloglj.exe
  2⤵
  - Drops file in System32 directory
  PID:11992

C:\Windows\SysWOW64\Lfeljd32.exe
C:\Windows\system32\Lfeljd32.exe
1⤵
PID:12032
- C:\Windows\SysWOW64\Lnldla32.exe
  C:\Windows\system32\Lnldla32.exe
  2⤵
  PID:12140

C:\Windows\SysWOW64\Lqkqhm32.exe
C:\Windows\system32\Lqkqhm32.exe
1⤵
PID:12184
- C:\Windows\SysWOW64\Lgdidgjg.exe
  C:\Windows\system32\Lgdidgjg.exe
  2⤵
  - Drops file in System32 directory
  PID:12248
- - C:\Windows\SysWOW64\Lnoaaaad.exe
    C:\Windows\system32\Lnoaaaad.exe
    3⤵
    PID:12272
  - - C:\Windows\SysWOW64\Lqmmmmph.exe
      C:\Windows\system32\Lqmmmmph.exe
      4⤵
      PID:11400

C:\Windows\SysWOW64\Lopmii32.exe
C:\Windows\system32\Lopmii32.exe
1⤵
PID:11448
- C:\Windows\SysWOW64\Lggejg32.exe
  C:\Windows\system32\Lggejg32.exe
  2⤵
  - Modifies registry class
  PID:11520
- - C:\Windows\SysWOW64\Lnangaoa.exe
    C:\Windows\system32\Lnangaoa.exe
    3⤵
    PID:11696

C:\Windows\SysWOW64\Lmdnbn32.exe
C:\Windows\system32\Lmdnbn32.exe
1⤵
PID:11752
- C:\Windows\SysWOW64\Lobjni32.exe
  C:\Windows\system32\Lobjni32.exe
  2⤵
  PID:11792
- - C:\Windows\SysWOW64\Lgibpf32.exe
    C:\Windows\system32\Lgibpf32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Modifies registry class
    PID:11896

C:\Windows\SysWOW64\Ljhnlb32.exe
C:\Windows\system32\Ljhnlb32.exe
1⤵
PID:11980
- C:\Windows\SysWOW64\Mmfkhmdi.exe
  C:\Windows\system32\Mmfkhmdi.exe
  2⤵
  PID:12088
- - C:\Windows\SysWOW64\Modgdicm.exe
    C:\Windows\system32\Modgdicm.exe
    3⤵
    PID:12224
  - - C:\Windows\SysWOW64\Mfnoqc32.exe
      C:\Windows\system32\Mfnoqc32.exe
      4⤵
      PID:11336

C:\Windows\SysWOW64\Mnegbp32.exe
C:\Windows\system32\Mnegbp32.exe
1⤵
PID:11432
- C:\Windows\SysWOW64\Mqdcnl32.exe
  C:\Windows\system32\Mqdcnl32.exe
  2⤵
  PID:11660
- - C:\Windows\SysWOW64\Mcbpjg32.exe
    C:\Windows\system32\Mcbpjg32.exe
    3⤵
    PID:8108

C:\Windows\SysWOW64\Nmdgikhi.exe
C:\Windows\system32\Nmdgikhi.exe
1⤵
PID:12084
- C:\Windows\SysWOW64\Npbceggm.exe
  C:\Windows\system32\Npbceggm.exe
  2⤵
  - Drops file in System32 directory
  PID:11152
- - C:\Windows\SysWOW64\Nflkbanj.exe
    C:\Windows\system32\Nflkbanj.exe
    3⤵
    - Drops file in System32 directory
    PID:4020

C:\Windows\SysWOW64\Nncccnol.exe
C:\Windows\system32\Nncccnol.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11680
- C:\Windows\SysWOW64\Npepkf32.exe
  C:\Windows\system32\Npepkf32.exe
  2⤵
  PID:11880

C:\Windows\SysWOW64\Nglhld32.exe
C:\Windows\system32\Nglhld32.exe
1⤵
PID:12144
- C:\Windows\SysWOW64\Njjdho32.exe
  C:\Windows\system32\Njjdho32.exe
  2⤵
  PID:4704

C:\Windows\SysWOW64\Nmipdk32.exe
C:\Windows\system32\Nmipdk32.exe
1⤵
PID:11772
- C:\Windows\SysWOW64\Npgmpf32.exe
  C:\Windows\system32\Npgmpf32.exe
  2⤵
  - Modifies registry class
  PID:12204
- - C:\Windows\SysWOW64\Ngndaccj.exe
    C:\Windows\system32\Ngndaccj.exe
    3⤵
    - Drops file in System32 directory
    PID:11724
  - - C:\Windows\SysWOW64\Nnhmnn32.exe
      C:\Windows\system32\Nnhmnn32.exe
      4⤵
      PID:11268
    - - C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        5⤵
        
        PID:11836

C:\Windows\SysWOW64\Njfkmphe.exe
C:\Windows\system32\Njfkmphe.exe
1⤵
PID:11952

C:\Windows\SysWOW64\Omnjojpo.exe
C:\Windows\system32\Omnjojpo.exe
1⤵
PID:12300
- C:\Windows\SysWOW64\Oplfkeob.exe
  C:\Windows\system32\Oplfkeob.exe
  2⤵
  PID:12340
- - C:\Windows\SysWOW64\Ogcnmc32.exe
    C:\Windows\system32\Ogcnmc32.exe
    3⤵
    PID:12440
  - - C:\Windows\SysWOW64\Mljmhflh.exe
      C:\Windows\system32\Mljmhflh.exe
      4⤵
      PID:12476
    - - C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        5⤵
        
        PID:12516
      - C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        6⤵
        
        PID:12552
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        7⤵
        Drops file in System32 directory
        
        PID:12584
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        8⤵
        
        PID:12636
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        9⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        10⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        11⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        12⤵
        
        PID:12808
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12864
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        14⤵
        
        PID:12920

C:\Windows\SysWOW64\Nnkpnclp.exe
C:\Windows\system32\Nnkpnclp.exe
1⤵
PID:9176

C:\Windows\SysWOW64\Lkeekk32.exe
C:\Windows\system32\Lkeekk32.exe
1⤵
PID:8076

C:\Windows\SysWOW64\Iinqbn32.exe
C:\Windows\system32\Iinqbn32.exe
1⤵
PID:3304

C:\Windows\SysWOW64\Olbdhn32.exe
C:\Windows\system32\Olbdhn32.exe
1⤵
- Executes dropped EXE
PID:460

C:\Windows\SysWOW64\Maeachag.exe
C:\Windows\system32\Maeachag.exe
1⤵
- Executes dropped EXE
PID:2580

C:\Windows\SysWOW64\Llhikacp.exe
C:\Windows\system32\Llhikacp.exe
1⤵
- Executes dropped EXE
PID:660

C:\Windows\SysWOW64\Leopnglc.exe
C:\Windows\system32\Leopnglc.exe
1⤵
- Executes dropped EXE
PID:4512

C:\Windows\SysWOW64\Licfngjd.exe
C:\Windows\system32\Licfngjd.exe
1⤵
- Executes dropped EXE
PID:4628

C:\Windows\SysWOW64\Ljbfpo32.exe
C:\Windows\system32\Ljbfpo32.exe
1⤵
- Executes dropped EXE
PID:4976

C:\Windows\SysWOW64\Liqihglg.exe
C:\Windows\system32\Liqihglg.exe
1⤵
- Executes dropped EXE
PID:4884

C:\Windows\SysWOW64\Lbgalmej.exe
C:\Windows\system32\Lbgalmej.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4408

C:\Windows\SysWOW64\Kageaj32.exe
C:\Windows\system32\Kageaj32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:540

C:\Windows\SysWOW64\Bmdkcnie.exe
C:\Windows\system32\Bmdkcnie.exe
1⤵
PID:12952
- C:\Windows\SysWOW64\Bjhkmbho.exe
  C:\Windows\system32\Bjhkmbho.exe
  2⤵
  - Modifies registry class
  PID:12988
- - C:\Windows\SysWOW64\Bmggingc.exe
    C:\Windows\system32\Bmggingc.exe
    3⤵
    PID:13024
  - - C:\Windows\SysWOW64\Bdapehop.exe
      C:\Windows\system32\Bdapehop.exe
      4⤵
      PID:13060
    - - C:\Windows\SysWOW64\Bkkhbb32.exe
        
        C:\Windows\system32\Bkkhbb32.exe
        5⤵
        Drops file in System32 directory
        
        PID:13104
      - C:\Windows\SysWOW64\Bphqji32.exe
        
        C:\Windows\system32\Bphqji32.exe
        6⤵
        Modifies registry class
        
        PID:13144
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        7⤵
        
        PID:13184
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13228
        
        C:\Windows\SysWOW64\Bpjmph32.exe
        
        C:\Windows\system32\Bpjmph32.exe
        9⤵
        Drops file in System32 directory
        
        PID:13272
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        10⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        11⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        12⤵
        Modifies registry class
        
        PID:12392
        
        C:\Windows\SysWOW64\Cdhffg32.exe
        
        C:\Windows\system32\Cdhffg32.exe
        13⤵
        Drops file in System32 directory
        
        PID:1148
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        14⤵
        Drops file in System32 directory
        
        PID:4612
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        15⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Calfpk32.exe
        
        C:\Windows\system32\Calfpk32.exe
        16⤵
        Drops file in System32 directory
        
        PID:4948
        
        C:\Windows\SysWOW64\Cdjblf32.exe
        
        C:\Windows\system32\Cdjblf32.exe
        17⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Cgiohbfi.exe
        
        C:\Windows\system32\Cgiohbfi.exe
        18⤵
        
        PID:12368
        
        C:\Windows\SysWOW64\Cigkdmel.exe
        
        C:\Windows\system32\Cigkdmel.exe
        19⤵
        Drops file in System32 directory
        
        PID:12472
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        20⤵
        
        PID:12496
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        21⤵
        Modifies registry class
        
        PID:1288
        
        C:\Windows\SysWOW64\Ciihjmcj.exe
        
        C:\Windows\system32\Ciihjmcj.exe
        22⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        23⤵
        
        PID:904
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        24⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\Fjeplijj.exe
        
        C:\Windows\system32\Fjeplijj.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4556
        
        C:\Windows\SysWOW64\Famhmfkl.exe
        
        C:\Windows\system32\Famhmfkl.exe
        26⤵
        Modifies registry class
        
        PID:2912
        
        C:\Windows\SysWOW64\Fcneeo32.exe
        
        C:\Windows\system32\Fcneeo32.exe
        27⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\Fboecfii.exe
        
        C:\Windows\system32\Fboecfii.exe
        28⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\Fdmaoahm.exe
        
        C:\Windows\system32\Fdmaoahm.exe
        29⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\Fkgillpj.exe
        
        C:\Windows\system32\Fkgillpj.exe
        30⤵
        Drops file in System32 directory
        
        PID:3560
        
        C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        31⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\Fqdbdbna.exe
        
        C:\Windows\system32\Fqdbdbna.exe
        32⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        33⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        34⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Fqfojblo.exe
        
        C:\Windows\system32\Fqfojblo.exe
        35⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Fcekfnkb.exe
        
        C:\Windows\system32\Fcekfnkb.exe
        36⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\Fjocbhbo.exe
        
        C:\Windows\system32\Fjocbhbo.exe
        37⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\Gnmlhf32.exe
        
        C:\Windows\system32\Gnmlhf32.exe
        38⤵
        Drops file in System32 directory
        
        PID:3140
        
        C:\Windows\SysWOW64\Gbkdod32.exe
        
        C:\Windows\system32\Gbkdod32.exe
        39⤵
        Drops file in System32 directory
        
        PID:5296
        
        C:\Windows\SysWOW64\Gbmadd32.exe
        
        C:\Windows\system32\Gbmadd32.exe
        40⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5456 -s 400
        41⤵
        Program crash
        
        PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5456 -ip 5456
1⤵
PID:5464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Cfqmpl32.exe

Filesize
43KB

MD5
ac4a22b2e3ae3be42e01a194bb104046

SHA1
0d78578bd3929f426c694cfdf11c842dbbb06d43

SHA256
b4c056eb56cc97fa4565a9bfc1db44ce89b42f8ca165ccee65517f6a438ca1e8

SHA512
7745520509c91abededa186bde07dc523c5ad63ca59491b5cd1cbdf5543504ccde46f884c992602c32fb1d738d7c328754788fa0320edc0f65b1d443c8818b02

Download Submit
C:\Windows\SysWOW64\Efhlhh32.exe

Filesize
276KB

MD5
9799b2d3ab41f2b5910a16ed75c10f42

SHA1
82ad1a9f6a66e61bc229e1666566e41d328b6ca0

SHA256
b6c65d312731818f418a1defb69606e7f62a4a31fab94b029e62b66eb9f3efee

SHA512
e9f816d13851eb0c091cd72f9ef04715288886257ed3070908f94ca3c61022da3d40589494a5f87e666bdeb7a3e9a6326240ecb3047d3e87543b41391688e88c

Download Submit
C:\Windows\SysWOW64\Fjhacf32.exe

Filesize
65KB

MD5
c9d4084faf2dde7a3523fde3c11fdd53

SHA1
80b326498a9e40c444a6df713637f10b047abb2f

SHA256
eeca68e34fc836d2ee2e69d83a04deb3965177b0e518577e953a551859b3f711

SHA512
b34968f5b42cc296982e5d08cac726c096009fbebfacf6cad6f9ce91f43fca4ea0ecae762980dd59f6bca5edd73fc063adccc68db9ab1e710745d4b18c59794f

Download Submit
C:\Windows\SysWOW64\Gfkbde32.exe

Filesize
33KB

MD5
68448d928ae3a432994fcb3c0951d76d

SHA1
e61b1beab680271415a408db5c2e76f2a2d4f864

SHA256
094e10ed4772661af39aeaef857dcb87da8f5a651cddc95d2f64a5d26e89a85d

SHA512
34af8ce7d7a1b5dee23faf15dac74c04432eaf6a91c487b461b8b7773527852037af0f8652bff9901a01cb4c4af70d2078e494e6a1b9a2bdc5b49a6763ec706a

Download Submit
C:\Windows\SysWOW64\Gpecbk32.exe

Filesize
39KB

MD5
b2937c7192df9e4fe668393a1e8a80ee

SHA1
52005111760f6f86a8fd93476166f21a595d2c0d

SHA256
d046f21941280916a6700e1cd7e71d09cc36730f2c9ec6b6b4d5967c97d8aaa6

SHA512
a33c4c521148d3605b6b3ca4903da8c13e9e267827cee9067f83ac513bc7f5370e451691772aab434d8105425b8b28e1d71364b14ad4eb6315727712db155c19

Download Submit
C:\Windows\SysWOW64\Jbkbpoog.exe

Filesize
9KB

MD5
99eb2f5b1a50cd7aabd9f812c84198ac

SHA1
e3581a56812a66e0f7990f6cd10395d23023ac49

SHA256
214c65be426e5753eb620dd4800e704a70fc82e7649fcfdf32534b322256e415

SHA512
bcff0ad49d79038b2c0ddff2b9b1e15130bf6b2d7321df109fe96f2c09539f69d5ed972936ed9621981289857d21566a780618fc765b43e9c56772a2015c9c70

Download Submit
C:\Windows\SysWOW64\Jgcamf32.exe

Filesize
55KB

MD5
2345f955ca3919da372edc58c187ae72

SHA1
70b27931dd04a330a8ac1aef773a26ef24697a4c

SHA256
5c63071c7856868a83d3e1d128f293ed28bc9a5ee1f8d7f5d84f31bf4971334f

SHA512
1ca90e658ffb20ceac5b885eabc8601ced82cbbd3e1675b91a2927d4e8c3231eb51a5bd2c5aa8d890f5ec4fe917818896845188b583b1c9a205efd629766e510

Download Submit
C:\Windows\SysWOW64\Jkaicd32.exe

Filesize
19KB

MD5
edbe259e4dd055d4c9a782400fb72abd

SHA1
954e496fb350df690be5d32aac087bb6a1c7e15f

SHA256
490d51fcab8179527c4681de85a24908d09aea7529470ef9230158367939321e

SHA512
148f2452250e4954be5541b3b32b437a2b74cd041234be492618df89fb1ba1fdb851618604a5f9399999bc4773a602bf378fb8165a5fdb4bd3795d19937e17a3

Download Submit
C:\Windows\SysWOW64\Jkaicd32.exe

Filesize
25KB

MD5
2dc07b33c6195431365cd1d9c31da8c4

SHA1
d8d729c9bf9333e8bbba2e1d5a383643f9516d6b

SHA256
3f36b05d63c13cbec768c908fc48c6deda551e40368826c27c4b841f4141bedb

SHA512
9d8e2b19ccd25c00df897eac41e3fdffdf3e5aa5b47ab79c62fcdbcb4889d96c20fa9b3bd022a52ece0b8f3a544057cae2a5cbf6128a44998091bcf83c37be86

Download Submit
C:\Windows\SysWOW64\Jqiipljg.exe

Filesize
276KB

MD5
b236284bb8158c76ac6a1db996f47c7c

SHA1
55a4d1da993518a1785f32c00b44cc8831495ef1

SHA256
cd4990867bcfef33fa824cd9f690ae80362f5df3c8f9b8bd1cff2cb2bff77913

SHA512
7cbd0106508e977605552a93a482df1d19d1a62de6501ca71aba702f0bed35336340e4d78eeee4458c8ff8f3ad7bbb0849d20344c64d2f5ebeed115016a3a228

Download Submit
C:\Windows\SysWOW64\Jqlefl32.exe

Filesize
43KB

MD5
6d773344201529463b9d5bca7f97da16

SHA1
9e7ed1656ae13ac609c82d7a0e76f01f39a6f02b

SHA256
dcec9694f52c3f26caaafff4e35e49e535da320bdd5eb01320b6c0a6b56a7816

SHA512
460c3a7d78624918e832c54ec05464d438215f3e09682327e809295697ad597439df2df243a80583cb8df953a7cd26871b3a6789cfba42b1d090e4207ee9be0f

Download Submit
C:\Windows\SysWOW64\Kageaj32.exe

Filesize
21KB

MD5
fa1edbf73c13ba13928bd9563e02725a

SHA1
ec2966872addf6ab7b644ac4d192dabf4ec51213

SHA256
e70aecf4b751fdfc4a56aca18e50d8267b661da189c261787975617c1513f59d

SHA512
edaf11f8d998ecc9d8a5905a7370e32b76e063c32520961c2c0a4c0c8f7d1c6548ded5a058dc400d6b254fdbddf435e5f9c8fc2cbcde7cc88acf52a1cb06f947

Download Submit
C:\Windows\SysWOW64\Kageaj32.exe

Filesize
25KB

MD5
71b3a2cb7cbca9b6db16699bc40c36e1

SHA1
0e35556a912a24d2ab656ce76d810000e9939be3

SHA256
a32b355630208ee76b66b606db6676a5be730216ef26843f0c1ac43053059208

SHA512
289a9c4df501c18c06a4f1cbe29c9b2ab4b51d9f6e20ad2d3d38591c8a6c9973a2b5c22b9b9180dcb0c89f59faf4ecf3e102712484c03256a2736c7625457102

Download Submit
C:\Windows\SysWOW64\Kgopidgf.exe

Filesize
276KB

MD5
6f3b1d5119117ed1a5a039e44b078615

SHA1
9b9c97618f7f7eae63cb9679215059b3549d91e3

SHA256
f4fbd5617f6f6552cf4ce68ee507d5222d2b5d538549e9c42c78610cedb2db7b

SHA512
2468fb05cad9f4ffb51fa9c4d520d94081f724a5da1a38fdd3cd8eb9737eb4f364aed89ecdf9fe9529893bc96a19bf48b948e045185b3dad7d60b7fe5ac9b761

Download Submit
C:\Windows\SysWOW64\Kjffdalb.exe

Filesize
69KB

MD5
d448fbfbfb5421ec870fb386f6b1a981

SHA1
673637c70a021258b67a40d5bd4cc270747c28a7

SHA256
be22760ef5e9a704e5cbf04267f12f647b77ac038a6df45047eb8c93d4b97e83

SHA512
65fd142f9a8f1bae82842619b6b9d9f219070727058cea1decd8489d6c436bec1246dd8a01172ee076442f3bbef54d5ffe5a39565a6bdfd847172234ec0f8b96

Download Submit
C:\Windows\SysWOW64\Kjffdalb.exe

Filesize
61KB

MD5
86a59724510dc0d2f14c7077788f64bc

SHA1
032737cb721f89bf7cfb2e6a0ecb5a0f8b2652dd

SHA256
6bbe9be3ea2115bc39c4c581588034a3a703f56a40e520cfa4d9b90343541323

SHA512
ec489f32eff568e82804d97dd6ef8b6ae86c5f8fc64ec21d4d957006d02fe99b9dbe470ce450bcd63d9d539a772b04ed3abfbf51926839d73db5e67ea7e366b7

Download Submit
C:\Windows\SysWOW64\Kjhcjq32.exe

Filesize
276KB

MD5
85d447c820ac95c7e1dc44247293b368

SHA1
3b25fcd8595cc7c045e8cafd5217d8d4fcc88062

SHA256
957bae7e9dea5ba8e6b856960215d3acbc42f465e3308b8013e541fdf96a110b

SHA512
273aa1af56a1e142345e39b9f88464aa2d5c3e6078c07adcfe41713d618b621b6d9ece22b219ca89665c1846d8d1f8b3265d52180518fa3ce59b1f704e011088

Download Submit
C:\Windows\SysWOW64\Kniieo32.exe

Filesize
77KB

MD5
83b74cf126562e05f5f2be2ddd9915d9

SHA1
c6f0d3bc023a3196c6de7427058341364c4424f0

SHA256
a7c7e0ffdd63a46554c7771188897c7a06a4f1775057a1f31758190816801025

SHA512
58c8ea7c6c6f4ae79ccbcd1b4863769d010a618c7c724f1c4fbe4c191a162cc9db46f57d42a7c95c36a08e154c004e9ba40d33235deed9d908f2f336f4df0af1

Download Submit
C:\Windows\SysWOW64\Kqpoakco.exe

Filesize
4KB

MD5
1af536477a7a964fec70b7474e1f9da1

SHA1
ef2d84dd43b5a753627fdf7294b7e49d74b6ed24

SHA256
b5b9fab3d1d8022610b420379685a3fd6240ef1c90f53ba50d0e5845d6bf23cb

SHA512
0e2407c19b11596c67db8a0863df422f5890a53151f281f2e67dd03c3f253537e9ea30b147038ef98d94e975b66b91d5b274b92f514e873ed0ecf88c556b110e

Download Submit
C:\Windows\SysWOW64\Kqpoakco.exe

Filesize
2KB

MD5
25aabd6cf321a4f6474d3989285a071c

SHA1
ec1df2fdeec5e7bb6f2cb8b66ccaad22d7563654

SHA256
a2e621867d84469b2080862db3f476834782b53146c9639f82bee543c98e4d84

SHA512
97e6ee421405934d30c2eb2f4443582bd15e8d46447a797eacc1c3873017ab4ad188b603362b12cc9a248ed4e0c1240f29eae669b6001f51bcc13d58727d6dd8

Download Submit
C:\Windows\SysWOW64\Lbkkgl32.exe

Filesize
276KB

MD5
d5af2a8912423a9a989a5b7d82550e57

SHA1
0772d1b6b73172a68e48f1048f33c25e43a360d8

SHA256
6829b30a8dbee964f8323fca7e0d1b9733c0a0b8f55ab6c6362097f324291532

SHA512
07acfa7e96e78ea082f0da18b9c7d01de3ddb7c0d3bde5380270749ccb9724ca33db6c2fd15b1713086d4086b95040eadd1f9ce8a382b85482ba297c41727ebc

Download Submit
C:\Windows\SysWOW64\Lbkkgl32.exe

Filesize
276KB

MD5
96310719d283a0e09d926ab9b83aec88

SHA1
297dc615ba0369390350b1b5083baeae6b4d8099

SHA256
8e8fd808c0e64b0031324f70f2f789d5a61db3b0734e8228581af6d3f88e4da1

SHA512
57bca09bb4a70ead16d80e7662a4a9e079a57c0987876fc01ce3fdaaa78f5051180c930f6e4a7aa2f2cbe254ded9687e548bd4201875e57f923ed6b15d2d3908

Download Submit
C:\Windows\SysWOW64\Lelchgne.exe

Filesize
276KB

MD5
e18cae163e1ef964b459d1851380418a

SHA1
7d4afc48a518fcab6ab258588a23cd633cec4403

SHA256
e37ed363c076664bef1c4641e0e7efb42636b399d8f34980a8ff3e209493b8cf

SHA512
c722ed7ec1bd189568f04012ae350367fea8b8157ed3f00b2868190d9705fb15e45aae21f04e617a25dae9aea6194ea5cf641f80445735cce0f9ab899841f3f7

Download Submit
C:\Windows\SysWOW64\Leopnglc.exe

Filesize
276KB

MD5
9db68e5c0c74e827603ef5c85306926a

SHA1
f33b7d67eadea926f45c5ff8a5a687e578457203

SHA256
c43ce53285f8ac06aac29a21b1c643ea6c656f571731098fa58642084643eb40

SHA512
8902594e8dd9c3d17e029914f9b767e0096f9fb8cec8954d56beab355fb3d98c6e4445a7a80066fc9e31ed930045e9a29012211a826b84da3c80dbf8d4d79a8d

Download Submit
C:\Windows\SysWOW64\Leopnglc.exe

Filesize
5KB

MD5
82116b0135d30721e98974100457f93c

SHA1
6d68dc8b6e462a49c690e2e663c3ebb62b9f6d7d

SHA256
6e77c5d6e812479d449fa41fb029a1f13915fc439be3454bf1a29c4daf7914bf

SHA512
6a60d11a698950b65bf0d22f61976b475bd95b4abaa83adc641d6c72e98ad1a0dcb7ac47525d6fee74571eed02608c6ebee23e782005dfe6d4869b5c3d1e4130

Download Submit
C:\Windows\SysWOW64\Lieccf32.exe

Filesize
276KB

MD5
7a5b50a9e697f5495547c33d7e255945

SHA1
5d18586ffc42c7355e1f20d71703266d4195634e

SHA256
8d6c9c5bcbc84aa1eea80fed7cba5c49a58c1825d5bbd642c566938ddec9dd49

SHA512
7964becd5002f15f4a5ae4736cc42f2590b45ec611202e79ef9c8b54cd7566aad76f79f34a1e61f1899a0fea2889e86a31a5b333d64113800dc960f22c45758f

Download Submit
C:\Windows\SysWOW64\Liqihglg.exe

Filesize
15KB

MD5
76421c25fbd0c57a5af77585cd963cb9

SHA1
85e113876b3f3edbce96835d91b0193974b5c502

SHA256
3e9b4d810df164170aeaef8f8a20b8a6a59a1d28ba616a6f53a4bf3f969f756e

SHA512
01f4712b3bc75f61eb90e571af0fe82fdfbbb929c22b6127c171da89dbb19f7a6e84ac060250b3030c6cfb141935a2bd243696266bd1b8282451e1f9794323f5

Download Submit
C:\Windows\SysWOW64\Liqihglg.exe

Filesize
276KB

MD5
d2d715fdcf57d45daa900783809e91f7

SHA1
bc640adc03d7fcf76a01703e1e23a6cd7dc8fdd0

SHA256
6685e71e2cac4cac1954acaaf95eb34f40c8fc4fe5290e9a3e1e1f317ae6703e

SHA512
bae51fdc24a34e5228f6d60921c7e10afbf9e3e304890bd73194cfd878f7e85588192663a6999992bbf3e82038c7e2d2a5828edceec7a728673860a0483bbcb6

Download Submit
C:\Windows\SysWOW64\Ljbfpo32.exe

Filesize
29KB

MD5
1dce8b084fef4beff8a06522c7eb4c5b

SHA1
1a96b90baf733db18317dd361a50bcfe3483bcac

SHA256
b69c2d4adc5d0c5256d843f34ad301ceb9c78f6b42d7e4754064324652c7526c

SHA512
813e683a0a5ffe496880f6ba3cf2f6450fad8e4fde92e22bd8cea6256b87621868ca9782204aee88a401db9e0b668ea624c61b1b31b6be882f06bf1d377c0596

Download Submit
C:\Windows\SysWOW64\Ljbfpo32.exe

Filesize
276KB

MD5
b4d9fcb6eff468a9a1d74598dee51957

SHA1
95e0d438b0626d427ebd28192175258cb0fa7a3a

SHA256
93fed6357fdf44008acc8e749a3c3de22da152d33a41ed3817a2e277eda995c3

SHA512
7efb89f930760ebef509121d0d6bf6ffd67126e19c4495ae073b87e32833bdd886ef50d0b24d356cd4458e30da15c099b2f890e5e876e70dc0693907e242bdc0

Download Submit
C:\Windows\SysWOW64\Ljbfpo32.exe

Filesize
18KB

MD5
6911abd56b8d6b669f1f971ae777a154

SHA1
7e10edad88996891093bcf79ec57fe84b07e5441

SHA256
961e15d75ffcf5da8e70deb747c7f39fb698d03e4c1b7a106a42994bb9658cb7

SHA512
6aebffbd3dbd9f73a365226ba66d945c3c0eb9b4dfbc77d4b6d073265e68c5020800441fd97ec20e829f7254bc047451ad7711582c8339f1775eec9226dab9be

Download Submit
C:\Windows\SysWOW64\Lnbklm32.exe

Filesize
276KB

MD5
6d3d6f3f202f1549dffb86ca132da464

SHA1
dceecd6dfcf190afa557aed41d81bc23c0cf8566

SHA256
f059fa9c98b495205cac1d3a30ee8b8a613effe34cca82843d834ce29323bdf1

SHA512
0f71d082c98bfcf304a458695e3e049e26d2d94c40cde562f2d799ccaeaff826a4b59b09129ac9b6a1e5c3de187e4b36fd8853e6efdb33e6af2df6db7883182d

Download Submit
C:\Windows\SysWOW64\Lnbklm32.exe

Filesize
17KB

MD5
a353a9326d352508d5914de11729736e

SHA1
092583a72ad39922763e79d4777cca31fa1e1c34

SHA256
d1637770e571e7792a7f2596d43e50bef8dc573982c485d4261337219802dec6

SHA512
afa8b3e8ed963e39b5d13713b75c0d196b0875454957c69be5cd93025ea3242220baee48a84a148118d1bf4a8ca4611915ec8d6a41c857ef5f072bb889b1a2c0

Download Submit
C:\Windows\SysWOW64\Maeachag.exe

Filesize
35KB

MD5
151c40da4b250643ed2a47446f9c35b1

SHA1
0635c74067d0ff4457a55cb7cc901c23f4cd280d

SHA256
4e9ac8ca236f7e360d4a52c1b924daae92b405f6f7842478f15151fcc3d1e433

SHA512
145fbda5eed8cf9df05c3734551d4fe1aacc71f0b44918dbcb121711b26636abbf7c2181fcdde3bee08997934d4a7989f92c4ae117e649b4f0b5f2c9d6bdc60c

Download Submit
C:\Windows\SysWOW64\Nefped32.exe

Filesize
17KB

MD5
bd909a235e701a90c27f485b7d84730b

SHA1
edaed0f1680c416e2c72151d47d0dd01e2561b5c

SHA256
3c9153459721a85a14c6391f99c593142d19a94ed21d247bff30243504116316

SHA512
93d5c4ae0522bdab3c97f5946d85e00a5e74afa615ebf25f5c37e484e1111f839a1539d182bd7112e6bff62bfb5589e7a4494e862f9efe1c88277cc42451328d

Download Submit
C:\Windows\SysWOW64\Oekiqccc.exe

Filesize
3KB

MD5
0934e72b15079724d7fde71a3870a28d

SHA1
2c8bcf2284476a9a01c8afacda3fccbabee8c82b

SHA256
2b6394f1b207496504f1c685c7a0deaeb55daf3b31a47309304709f7dc62f427

SHA512
abe7fd0861e3a9b4ee02d4f7bac0d1772389b09f77d9d3a790d71ff1e010767e4bf595ed5fc63efbc0c5032eee31ca23edee1fa07280db7bec5cf472bf09d6d2

Download Submit
C:\Windows\SysWOW64\Pcobaedj.exe

Filesize
3KB

MD5
40ff9454461b15afbd56e10361ab7372

SHA1
cfa76341ab5e92fc7a87ff2c341e19e8489ced22

SHA256
d5a12083e2929b6c1e7944120111c739d0b508e8e9863b7e17e35b2ea41503b5

SHA512
e2cd38920947eb6dbbba13e77fd4955587e45fe101c8141c5b4a1754b0cb79dfbb98ccc7c5fb9776a7deda0bd153525ee3905ef20e9767bb0ea99336e185b65d

Download Submit
C:\Windows\SysWOW64\Pedlgbkh.exe

Filesize
1KB

MD5
b7dc7b5016e8712e68ab6465abf3c97c

SHA1
4bd7d9965a88fa2544a6e847d8ef1185ace47531

SHA256
5b96518f0d54d5c396737765eba0fe7d28a6b145bae829aefdb416315760ee8e

SHA512
1a0ecedd861ab6612e4b594e516eef3588f6ae695323cbd1d5d1e1b821589425d609c88c1d3fb9bdaf7e5e381f7c1a2fe436c7cc617277a1bf49937054594151

Download Submit
C:\Windows\SysWOW64\Phedhmhi.exe

Filesize
2KB

MD5
5522abfec1b6e7f3e7c426187327965e

SHA1
d49b4f30efeed085ff42c93ecd24f4c9c255d667

SHA256
d8e080ebf3b0aaa1558f7d0c166eb86ce88cee5066f50df6744a3901c62ba171

SHA512
221a1d8c91dd5663a74e53910abe1c572f0c64b1dc1401fe116828aaf87610c726e0c8a10c8e49075546fccc6e9613bf7c2c49d519c18cf1c2db7b6a1b89b0e9

Download Submit
memory/460-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/540-183-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/660-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/856-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/900-232-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1076-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1168-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1368-168-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1392-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1544-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1648-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1744-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1760-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1992-96-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2032-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2136-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2188-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2236-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2280-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2388-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2544-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2580-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2724-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2824-240-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2832-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2912-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3028-136-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3140-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3232-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3372-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3388-248-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3460-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3540-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3548-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3648-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3756-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3800-120-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3812-180-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3832-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3860-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3952-152-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4004-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4060-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4064-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4292-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4408-192-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4448-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4512-256-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4604-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4628-216-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4692-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4876-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4884-200-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4900-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4924-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4976-208-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4992-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5004-224-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5160-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5200-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5240-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5280-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5320-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5360-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads