a9475c472b7026cdd454eef0732b5ab3da840e59a880773688372c39215b4648

Analysis

max time kernel
151s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2024, 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f444941a753fd75e2ba614864b1a8358.exe
Size

346KB
MD5

f444941a753fd75e2ba614864b1a8358
SHA1

2a0531454cc6ea716644c6a8aa27ef36ebeebea5
SHA256

a9475c472b7026cdd454eef0732b5ab3da840e59a880773688372c39215b4648
SHA512

1201d8474217659f6637b13dae22d13fd41abeaf4ce50465ec682c4ad4bb53d717b9766d66c46174b7820df02ca1f76c903825e762746449d8be55182d9d53a1
SSDEEP

6144:/8LPbTqYhdsFj5t13LJhrmMsFj5tzOvfFOM:/M39hds15tFrls15tz4FT

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qpcecb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aonhghjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqncnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fijdjfdb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhqefjpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfjjpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nohicdia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afpjel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnoddcef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edbiniff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kabcopmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oihmedma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqiibjlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipkdek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jadgnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qppaclio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqgojmb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfpecg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Giecfejd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kheekkjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcgdhkem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfepdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfepdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agimkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bobabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdojjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fniihmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fiqjke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkofga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hppeim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihmfco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jhifomdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Piocecgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdmmeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgpcliao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Haaaaeim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipihpkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpjjmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfjjpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iajdgcab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcfidb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfagighf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahdpjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpfkpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnoddcef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpmomo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipdndloi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kheekkjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koonge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pafkgphl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adcjop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Foapaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fijdjfdb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glhimp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpjjmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pimfpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pimfpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbhgoh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igfkfo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdojjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehbnigjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hioflcbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Heegad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kedlip32.exe

Malware Dropper & Backdoor - Berbew 25 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x000a00000002311a-39.dat	family_berbew
behavioral2/files/0x000600000002320e-46.dat	family_berbew
behavioral2/files/0x000600000002320b-31.dat	family_berbew
behavioral2/files/0x0006000000023248-273.dat	family_berbew
behavioral2/files/0x0006000000023246-265.dat	family_berbew
behavioral2/files/0x0006000000023243-256.dat	family_berbew
behavioral2/files/0x0006000000023241-248.dat	family_berbew
behavioral2/files/0x000600000002323f-239.dat	family_berbew
behavioral2/files/0x00060000000232db-752.dat	family_berbew
behavioral2/files/0x00060000000232df-766.dat	family_berbew
behavioral2/files/0x00060000000232ed-813.dat	family_berbew
behavioral2/files/0x00060000000232d1-719.dat	family_berbew
behavioral2/files/0x0006000000023282-455.dat	family_berbew
behavioral2/files/0x0006000000023273-401.dat	family_berbew
behavioral2/files/0x0006000000023255-300.dat	family_berbew
behavioral2/files/0x000700000002343c-1849.dat	family_berbew
behavioral2/files/0x0006000000023442-1861.dat	family_berbew
behavioral2/files/0x00060000000234ac-2215.dat	family_berbew
behavioral2/files/0x00060000000234ce-2328.dat	family_berbew
behavioral2/files/0x00060000000234e8-2417.dat	family_berbew
behavioral2/files/0x00060000000234da-2369.dat	family_berbew
behavioral2/files/0x00060000000234d6-2355.dat	family_berbew
behavioral2/files/0x00060000000234b2-2234.dat	family_berbew
behavioral2/files/0x000600000002354b-2730.dat	family_berbew
behavioral2/files/0x00060000000235f0-3295.dat	family_berbew

Executes dropped EXE 64 IoCs

pid	Process
1720	Hoadkn32.exe
4952	Hnfamjqg.exe
1792	Hfpecg32.exe
2676	Ifbbig32.exe
1072	Ifdonfka.exe
4708	Igfkfo32.exe
1440	Kcidmkpq.exe
4100	Pmblagmf.exe
2976	Qhhpop32.exe
3456	Qjfmkk32.exe
3612	Qpcecb32.exe
1004	Qhjmdp32.exe
3308	Qodeajbg.exe
3532	Qdaniq32.exe
4464	Afpjel32.exe
4624	Amjbbfgo.exe
3860	Adcjop32.exe
4996	Aknbkjfh.exe
3408	Aagkhd32.exe
2536	Adfgdpmi.exe
4940	Akpoaj32.exe
1484	Ahdpjn32.exe
2656	Aonhghjl.exe
4320	Aaldccip.exe
2032	Agimkk32.exe
3608	Amcehdod.exe
4884	Bdmmeo32.exe
1808	Bobabg32.exe
924	Bdojjo32.exe
3696	Boenhgdd.exe
2832	Bpfkpp32.exe
384	Bgpcliao.exe
1312	Bddcenpi.exe
1064	Bknlbhhe.exe
4648	Bnoddcef.exe
4608	Eqdpgk32.exe
4568	Ekjded32.exe
3524	Ebdlangb.exe
4484	Edbiniff.exe
3816	Egaejeej.exe
4736	Eqiibjlj.exe
2140	Ehpadhll.exe
1684	Eojiqb32.exe
744	Eqlfhjig.exe
2324	Ehbnigjj.exe
5028	Eqncnj32.exe
948	Fooclapd.exe
3792	Fbmohmoh.exe
4444	Figgdg32.exe
4380	Foapaa32.exe
4944	Fijdjfdb.exe
5132	Fkhpfbce.exe
5176	Fnfmbmbi.exe
5220	Fqeioiam.exe
5260	Filapfbo.exe
5300	Fkjmlaac.exe
5344	Fniihmpf.exe
5388	Fecadghc.exe
5432	Fbgbnkfm.exe
5476	Fiqjke32.exe
5520	Fkofga32.exe
5572	Gbiockdj.exe
5616	Gicgpelg.exe
5660	Gpmomo32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Koajmepf.exe	Khgbqkhj.exe
File created	C:\Windows\SysWOW64\Ckbcpc32.dll	Pmblagmf.exe
File created	C:\Windows\SysWOW64\Lcccepbd.dll	Adcjop32.exe
File opened for modification	C:\Windows\SysWOW64\Fbmohmoh.exe	Fooclapd.exe
File opened for modification	C:\Windows\SysWOW64\Iacngdgj.exe	Inebjihf.exe
File created	C:\Windows\SysWOW64\Lahoec32.dll	Bknlbhhe.exe
File created	C:\Windows\SysWOW64\Pmapoggk.dll	Gnblnlhl.exe
File created	C:\Windows\SysWOW64\Clmmco32.dll	Ihmfco32.exe
File created	C:\Windows\SysWOW64\Kabcopmg.exe	Kocgbend.exe
File created	C:\Windows\SysWOW64\Hlkfbocp.exe	Giljfddl.exe
File created	C:\Windows\SysWOW64\Bpemfc32.dll	Lcfidb32.exe
File created	C:\Windows\SysWOW64\Piocecgj.exe	Pfagighf.exe
File created	C:\Windows\SysWOW64\Kcidmkpq.exe	Igfkfo32.exe
File opened for modification	C:\Windows\SysWOW64\Ekjded32.exe	Eqdpgk32.exe
File opened for modification	C:\Windows\SysWOW64\Gkdpbpih.exe	Giecfejd.exe
File created	C:\Windows\SysWOW64\Odaodc32.dll	Gbpedjnb.exe
File opened for modification	C:\Windows\SysWOW64\Qfjjpf32.exe	Qppaclio.exe
File created	C:\Windows\SysWOW64\Ahdpjn32.exe	Akpoaj32.exe
File created	C:\Windows\SysWOW64\Eqncnj32.exe	Ehbnigjj.exe
File created	C:\Windows\SysWOW64\Iialhaad.exe	Iajdgcab.exe
File opened for modification	C:\Windows\SysWOW64\Lhqefjpo.exe	Lebijnak.exe
File created	C:\Windows\SysWOW64\Aglafhih.dll	Iajdgcab.exe
File created	C:\Windows\SysWOW64\Agolng32.dll	Oifppdpd.exe
File opened for modification	C:\Windows\SysWOW64\Igfkfo32.exe	Ifdonfka.exe
File created	C:\Windows\SysWOW64\Focanl32.dll	Fooclapd.exe
File opened for modification	C:\Windows\SysWOW64\Fqeioiam.exe	Fnfmbmbi.exe
File created	C:\Windows\SysWOW64\Coffgmig.dll	Gpaihooo.exe
File created	C:\Windows\SysWOW64\Ofblbapl.dll	Fkhpfbce.exe
File created	C:\Windows\SysWOW64\Hhfpbpdo.exe	Hehdfdek.exe
File created	C:\Windows\SysWOW64\Pfhmjf32.exe	Ppnenlka.exe
File created	C:\Windows\SysWOW64\Fhcbhh32.dll	Qbajeg32.exe
File created	C:\Windows\SysWOW64\Bknlbhhe.exe	Bddcenpi.exe
File created	C:\Windows\SysWOW64\Pekihfdc.dll	Jimldogg.exe
File opened for modification	C:\Windows\SysWOW64\Ljpaqmgb.exe	Lcfidb32.exe
File opened for modification	C:\Windows\SysWOW64\Jllhpkfk.exe	Jimldogg.exe
File created	C:\Windows\SysWOW64\Kfmcjh32.dll	Hfpecg32.exe
File created	C:\Windows\SysWOW64\Fnfmbmbi.exe	Fkhpfbce.exe
File created	C:\Windows\SysWOW64\Dlofiddl.dll	Hhimhobl.exe
File opened for modification	C:\Windows\SysWOW64\Jhifomdj.exe	Jaonbc32.exe
File created	C:\Windows\SysWOW64\Hdijbplg.dll	Hnfamjqg.exe
File created	C:\Windows\SysWOW64\Mgpilmfi.dll	Gbbajjlp.exe
File created	C:\Windows\SysWOW64\Lckboblp.exe	Lplfcf32.exe
File created	C:\Windows\SysWOW64\Lfgnho32.dll	Ppnenlka.exe
File created	C:\Windows\SysWOW64\Cnnnfkal.dll	Gicgpelg.exe
File created	C:\Windows\SysWOW64\Keifdpif.exe	Koonge32.exe
File created	C:\Windows\SysWOW64\Kldgkp32.dll	Kabcopmg.exe
File created	C:\Windows\SysWOW64\Ppdbgncl.exe	Obqanjdb.exe
File created	C:\Windows\SysWOW64\Aagkhd32.exe	Aknbkjfh.exe
File created	C:\Windows\SysWOW64\Kocgbend.exe	Klekfinp.exe
File created	C:\Windows\SysWOW64\Lpgmhg32.exe	Lhqefjpo.exe
File opened for modification	C:\Windows\SysWOW64\Ieccbbkn.exe	Iojkeh32.exe
File opened for modification	C:\Windows\SysWOW64\Lepleocn.exe	Kcapicdj.exe
File created	C:\Windows\SysWOW64\Lljdai32.exe	Lepleocn.exe
File opened for modification	C:\Windows\SysWOW64\Aonhghjl.exe	Ahdpjn32.exe
File opened for modification	C:\Windows\SysWOW64\Hlppno32.exe	Heegad32.exe
File opened for modification	C:\Windows\SysWOW64\Haaaaeim.exe	Hppeim32.exe
File created	C:\Windows\SysWOW64\Ihkjno32.exe	Haaaaeim.exe
File created	C:\Windows\SysWOW64\Fknofqcc.dll	Piocecgj.exe
File opened for modification	C:\Windows\SysWOW64\Qjfmkk32.exe	Qhhpop32.exe
File opened for modification	C:\Windows\SysWOW64\Fkhpfbce.exe	Fijdjfdb.exe
File opened for modification	C:\Windows\SysWOW64\Hhfpbpdo.exe	Hehdfdek.exe
File created	C:\Windows\SysWOW64\Njlmnj32.dll	Ihkjno32.exe
File opened for modification	C:\Windows\SysWOW64\Pmphaaln.exe	Pfepdg32.exe
File created	C:\Windows\SysWOW64\Qpcecb32.exe	Qjfmkk32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eqdpgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iamamcop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Keifdpif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aanpie32.dll"	Amfobp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lckboblp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Paihlpfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adcjop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Figgdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjiqkhgo.dll"	Ihbponja.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jihbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcfidb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amfobp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gpmomo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Giljfddl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iialhaad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lakfeodm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ampillfk.dll"	Boenhgdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akcjcnpe.dll"	Eqlfhjig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plmell32.dll"	Giljfddl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbojlfdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Koonge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmphaaln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qfjjpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chnpamkc.dll"	Ahdpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ichqihli.dll"	Aonhghjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aonhghjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihmfco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihpcinld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ieccbbkn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acqgojmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Foapaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Coppbe32.dll"	Hbenoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjoppf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Paihlpfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ppnenlka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geqnma32.dll"	Aagkhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecpfpo32.dll"	Bpfkpp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hppeim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iacngdgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpgmhg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfepdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ppgomnai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qbajeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eegcnaoo.dll"	Ehpadhll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihbponja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmjbog32.dll"	Jikoopij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hapfpelh.dll"	Klekfinp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lljdai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbiockdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbiockdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Giecfejd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Coffgmig.dll"	Gpaihooo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Foldamdm.dll"	Ifbbig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcidmkpq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpmomo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jppnpjel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lebijnak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iheocj32.dll"	Pfagighf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndikch32.dll"	Bgpcliao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eqlfhjig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fecadghc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhfpbpdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Khgbqkhj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1720	4348	f444941a753fd75e2ba614864b1a8358.exe	42
PID 4348 wrote to memory of 1720	4348	f444941a753fd75e2ba614864b1a8358.exe	42
PID 4348 wrote to memory of 1720	4348	f444941a753fd75e2ba614864b1a8358.exe	42
PID 1720 wrote to memory of 4952	1720	Hoadkn32.exe	41
PID 1720 wrote to memory of 4952	1720	Hoadkn32.exe	41
PID 1720 wrote to memory of 4952	1720	Hoadkn32.exe	41
PID 4952 wrote to memory of 1792	4952	Hnfamjqg.exe	40
PID 4952 wrote to memory of 1792	4952	Hnfamjqg.exe	40
PID 4952 wrote to memory of 1792	4952	Hnfamjqg.exe	40
PID 1792 wrote to memory of 2676	1792	Hfpecg32.exe	39
PID 1792 wrote to memory of 2676	1792	Hfpecg32.exe	39
PID 1792 wrote to memory of 2676	1792	Hfpecg32.exe	39
PID 2676 wrote to memory of 1072	2676	Ifbbig32.exe	38
PID 2676 wrote to memory of 1072	2676	Ifbbig32.exe	38
PID 2676 wrote to memory of 1072	2676	Ifbbig32.exe	38
PID 1072 wrote to memory of 4708	1072	Ifdonfka.exe	37
PID 1072 wrote to memory of 4708	1072	Ifdonfka.exe	37
PID 1072 wrote to memory of 4708	1072	Ifdonfka.exe	37
PID 4708 wrote to memory of 1440	4708	Igfkfo32.exe	290
PID 4708 wrote to memory of 1440	4708	Igfkfo32.exe	290
PID 4708 wrote to memory of 1440	4708	Igfkfo32.exe	290
PID 1440 wrote to memory of 4100	1440	Kcidmkpq.exe	289
PID 1440 wrote to memory of 4100	1440	Kcidmkpq.exe	289
PID 1440 wrote to memory of 4100	1440	Kcidmkpq.exe	289
PID 4100 wrote to memory of 2976	4100	Pmblagmf.exe	288
PID 4100 wrote to memory of 2976	4100	Pmblagmf.exe	288
PID 4100 wrote to memory of 2976	4100	Pmblagmf.exe	288
PID 2976 wrote to memory of 3456	2976	Qhhpop32.exe	287
PID 2976 wrote to memory of 3456	2976	Qhhpop32.exe	287
PID 2976 wrote to memory of 3456	2976	Qhhpop32.exe	287
PID 3456 wrote to memory of 3612	3456	Qjfmkk32.exe	285
PID 3456 wrote to memory of 3612	3456	Qjfmkk32.exe	285
PID 3456 wrote to memory of 3612	3456	Qjfmkk32.exe	285
PID 3612 wrote to memory of 1004	3612	Qpcecb32.exe	100
PID 3612 wrote to memory of 1004	3612	Qpcecb32.exe	100
PID 3612 wrote to memory of 1004	3612	Qpcecb32.exe	100
PID 1004 wrote to memory of 3308	1004	Qhjmdp32.exe	101
PID 1004 wrote to memory of 3308	1004	Qhjmdp32.exe	101
PID 1004 wrote to memory of 3308	1004	Qhjmdp32.exe	101
PID 3308 wrote to memory of 3532	3308	Qodeajbg.exe	284
PID 3308 wrote to memory of 3532	3308	Qodeajbg.exe	284
PID 3308 wrote to memory of 3532	3308	Qodeajbg.exe	284
PID 3532 wrote to memory of 4464	3532	Qdaniq32.exe	283
PID 3532 wrote to memory of 4464	3532	Qdaniq32.exe	283
PID 3532 wrote to memory of 4464	3532	Qdaniq32.exe	283
PID 4464 wrote to memory of 4624	4464	Afpjel32.exe	282
PID 4464 wrote to memory of 4624	4464	Afpjel32.exe	282
PID 4464 wrote to memory of 4624	4464	Afpjel32.exe	282
PID 4624 wrote to memory of 3860	4624	Amjbbfgo.exe	281
PID 4624 wrote to memory of 3860	4624	Amjbbfgo.exe	281
PID 4624 wrote to memory of 3860	4624	Amjbbfgo.exe	281
PID 3860 wrote to memory of 4996	3860	Adcjop32.exe	102
PID 3860 wrote to memory of 4996	3860	Adcjop32.exe	102
PID 3860 wrote to memory of 4996	3860	Adcjop32.exe	102
PID 4996 wrote to memory of 3408	4996	Aknbkjfh.exe	280
PID 4996 wrote to memory of 3408	4996	Aknbkjfh.exe	280
PID 4996 wrote to memory of 3408	4996	Aknbkjfh.exe	280
PID 3408 wrote to memory of 2536	3408	Aagkhd32.exe	278
PID 3408 wrote to memory of 2536	3408	Aagkhd32.exe	278
PID 3408 wrote to memory of 2536	3408	Aagkhd32.exe	278
PID 2536 wrote to memory of 4940	2536	Adfgdpmi.exe	103
PID 2536 wrote to memory of 4940	2536	Adfgdpmi.exe	103
PID 2536 wrote to memory of 4940	2536	Adfgdpmi.exe	103
PID 4940 wrote to memory of 1484	4940	Akpoaj32.exe	277

C:\Users\Admin\AppData\Local\Temp\f444941a753fd75e2ba614864b1a8358.exe
"C:\Users\Admin\AppData\Local\Temp\f444941a753fd75e2ba614864b1a8358.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\Hoadkn32.exe
  C:\Windows\system32\Hoadkn32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1720

C:\Windows\SysWOW64\Igfkfo32.exe
C:\Windows\system32\Igfkfo32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\Kcidmkpq.exe
  C:\Windows\system32\Kcidmkpq.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1440

C:\Windows\SysWOW64\Ifdonfka.exe
C:\Windows\system32\Ifdonfka.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\Jkkbnl32.exe
  C:\Windows\system32\Jkkbnl32.exe
  2⤵
  PID:3676
- - C:\Windows\SysWOW64\Jognokdi.exe
    C:\Windows\system32\Jognokdi.exe
    3⤵
    PID:4516
  - - C:\Windows\SysWOW64\Jhocgqjj.exe
      C:\Windows\system32\Jhocgqjj.exe
      4⤵
      PID:5584
    - - C:\Windows\SysWOW64\Jmlkpgia.exe
        
        C:\Windows\system32\Jmlkpgia.exe
        5⤵
        
        PID:5676

C:\Windows\SysWOW64\Ifbbig32.exe
C:\Windows\system32\Ifbbig32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2676

C:\Windows\SysWOW64\Hfpecg32.exe
C:\Windows\system32\Hfpecg32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\Hnfamjqg.exe
C:\Windows\system32\Hnfamjqg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4952

C:\Windows\SysWOW64\Qhjmdp32.exe
C:\Windows\system32\Qhjmdp32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Windows\SysWOW64\Qodeajbg.exe
  C:\Windows\system32\Qodeajbg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\SysWOW64\Qdaniq32.exe
    C:\Windows\system32\Qdaniq32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\SysWOW64\Bjlpcbqo.exe
      C:\Windows\system32\Bjlpcbqo.exe
      4⤵
      PID:2968
    - - C:\Windows\SysWOW64\Bmjlpnpb.exe
        
        C:\Windows\system32\Bmjlpnpb.exe
        5⤵
        
        PID:5064

C:\Windows\SysWOW64\Aknbkjfh.exe
C:\Windows\system32\Aknbkjfh.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Windows\SysWOW64\Aagkhd32.exe
  C:\Windows\system32\Aagkhd32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3408

C:\Windows\SysWOW64\Akpoaj32.exe
C:\Windows\system32\Akpoaj32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\SysWOW64\Ahdpjn32.exe
  C:\Windows\system32\Ahdpjn32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  PID:1484

C:\Windows\SysWOW64\Aonhghjl.exe
C:\Windows\system32\Aonhghjl.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2656
- C:\Windows\SysWOW64\Aaldccip.exe
  C:\Windows\system32\Aaldccip.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- - C:\Windows\SysWOW64\Agimkk32.exe
    C:\Windows\system32\Agimkk32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    PID:2032

C:\Windows\SysWOW64\Bobabg32.exe
C:\Windows\system32\Bobabg32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1808
- C:\Windows\SysWOW64\Bdojjo32.exe
  C:\Windows\system32\Bdojjo32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  PID:924

C:\Windows\SysWOW64\Bpfkpp32.exe
C:\Windows\system32\Bpfkpp32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
PID:2832
- C:\Windows\SysWOW64\Bgpcliao.exe
  C:\Windows\system32\Bgpcliao.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  PID:384

C:\Windows\SysWOW64\Bddcenpi.exe
C:\Windows\system32\Bddcenpi.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1312
- C:\Windows\SysWOW64\Bknlbhhe.exe
  C:\Windows\system32\Bknlbhhe.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1064
- - C:\Windows\SysWOW64\Bnoddcef.exe
    C:\Windows\system32\Bnoddcef.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    PID:4648
  - - C:\Windows\SysWOW64\Eqdpgk32.exe
      C:\Windows\system32\Eqdpgk32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      PID:4608
    - - C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        5⤵
        Executes dropped EXE
        
        PID:4568

C:\Windows\SysWOW64\Boenhgdd.exe
C:\Windows\system32\Boenhgdd.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:3696

C:\Windows\SysWOW64\Bdmmeo32.exe
C:\Windows\system32\Bdmmeo32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4884

C:\Windows\SysWOW64\Amcehdod.exe
C:\Windows\system32\Amcehdod.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:3608

C:\Windows\SysWOW64\Edbiniff.exe
C:\Windows\system32\Edbiniff.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:4484
- C:\Windows\SysWOW64\Egaejeej.exe
  C:\Windows\system32\Egaejeej.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- - C:\Windows\SysWOW64\Eqiibjlj.exe
    C:\Windows\system32\Eqiibjlj.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    PID:4736

C:\Windows\SysWOW64\Eojiqb32.exe
C:\Windows\system32\Eojiqb32.exe
1⤵
- Executes dropped EXE
PID:1684
- C:\Windows\SysWOW64\Eqlfhjig.exe
  C:\Windows\system32\Eqlfhjig.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:744
- - C:\Windows\SysWOW64\Ehbnigjj.exe
    C:\Windows\system32\Ehbnigjj.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:2324
  - - C:\Windows\SysWOW64\Eqncnj32.exe
      C:\Windows\system32\Eqncnj32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      PID:5028
    - - C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:948
      - C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        6⤵
        Executes dropped EXE
        
        PID:3792
  - - C:\Windows\SysWOW64\Aomipkic.exe
      C:\Windows\system32\Aomipkic.exe
      4⤵
      PID:3576
    - - C:\Windows\SysWOW64\Aakelfhg.exe
        
        C:\Windows\system32\Aakelfhg.exe
        5⤵
        
        PID:5388

C:\Windows\SysWOW64\Ehpadhll.exe
C:\Windows\system32\Ehpadhll.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:2140

C:\Windows\SysWOW64\Figgdg32.exe
C:\Windows\system32\Figgdg32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:4444
- C:\Windows\SysWOW64\Foapaa32.exe
  C:\Windows\system32\Foapaa32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  PID:4380
- - C:\Windows\SysWOW64\Fijdjfdb.exe
    C:\Windows\system32\Fijdjfdb.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:4944
  - - C:\Windows\SysWOW64\Fkhpfbce.exe
      C:\Windows\system32\Fkhpfbce.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:5132

C:\Windows\SysWOW64\Fnfmbmbi.exe
C:\Windows\system32\Fnfmbmbi.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5176
- C:\Windows\SysWOW64\Fqeioiam.exe
  C:\Windows\system32\Fqeioiam.exe
  2⤵
  - Executes dropped EXE
  PID:5220
- - C:\Windows\SysWOW64\Filapfbo.exe
    C:\Windows\system32\Filapfbo.exe
    3⤵
    - Executes dropped EXE
    PID:5260

C:\Windows\SysWOW64\Fkjmlaac.exe
C:\Windows\system32\Fkjmlaac.exe
1⤵
- Executes dropped EXE
PID:5300
- C:\Windows\SysWOW64\Fniihmpf.exe
  C:\Windows\system32\Fniihmpf.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  PID:5344
- - C:\Windows\SysWOW64\Fecadghc.exe
    C:\Windows\system32\Fecadghc.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5388
  - - C:\Windows\SysWOW64\Fbgbnkfm.exe
      C:\Windows\system32\Fbgbnkfm.exe
      4⤵
      Executes dropped EXE
      PID:5432
    - - C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5476

C:\Windows\SysWOW64\Fkofga32.exe
C:\Windows\system32\Fkofga32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:5520
- C:\Windows\SysWOW64\Gbiockdj.exe
  C:\Windows\system32\Gbiockdj.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:5572
- - C:\Windows\SysWOW64\Gicgpelg.exe
    C:\Windows\system32\Gicgpelg.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:5616
  - - C:\Windows\SysWOW64\Gpmomo32.exe
      C:\Windows\system32\Gpmomo32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      PID:5660
    - - C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5704
      - C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        6⤵
        
        PID:5752
  - - C:\Windows\SysWOW64\Ackbfioj.exe
      C:\Windows\system32\Ackbfioj.exe
      4⤵
      PID:2212
    - - C:\Windows\SysWOW64\Afinbdon.exe
        
        C:\Windows\system32\Afinbdon.exe
        5⤵
        
        PID:6252

C:\Windows\SysWOW64\Gnblnlhl.exe
C:\Windows\system32\Gnblnlhl.exe
1⤵
- Drops file in System32 directory
PID:5792
- C:\Windows\SysWOW64\Gaqhjggp.exe
  C:\Windows\system32\Gaqhjggp.exe
  2⤵
  PID:5832
- - C:\Windows\SysWOW64\Gihpkd32.exe
    C:\Windows\system32\Gihpkd32.exe
    3⤵
    PID:5880
  - - C:\Windows\SysWOW64\Gpaihooo.exe
      C:\Windows\system32\Gpaihooo.exe
      4⤵
      Drops file in System32 directory
      Modifies registry class
      PID:5924
    - - C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        5⤵
        Drops file in System32 directory
        
        PID:5972
      - C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6016
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        7⤵
        Drops file in System32 directory
        
        PID:6060
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        8⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6100

C:\Windows\SysWOW64\Hlkfbocp.exe
C:\Windows\system32\Hlkfbocp.exe
1⤵
PID:6140
- C:\Windows\SysWOW64\Hbenoi32.exe
  C:\Windows\system32\Hbenoi32.exe
  2⤵
  - Modifies registry class
  PID:5188

C:\Windows\SysWOW64\Hioflcbj.exe
C:\Windows\system32\Hioflcbj.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5248
- C:\Windows\SysWOW64\Hpioin32.exe
  C:\Windows\system32\Hpioin32.exe
  2⤵
  PID:5332

C:\Windows\SysWOW64\Heegad32.exe
C:\Windows\system32\Heegad32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:5416
- C:\Windows\SysWOW64\Hlppno32.exe
  C:\Windows\system32\Hlppno32.exe
  2⤵
  PID:5464

C:\Windows\SysWOW64\Hnnljj32.exe
C:\Windows\system32\Hnnljj32.exe
1⤵
PID:5540
- C:\Windows\SysWOW64\Hehdfdek.exe
  C:\Windows\system32\Hehdfdek.exe
  2⤵
  - Drops file in System32 directory
  PID:5612
- - C:\Windows\SysWOW64\Hhfpbpdo.exe
    C:\Windows\system32\Hhfpbpdo.exe
    3⤵
    - Modifies registry class
    PID:5668
  - - C:\Windows\SysWOW64\Hpmhdmea.exe
      C:\Windows\system32\Hpmhdmea.exe
      4⤵
      PID:5744
    - - C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        5⤵
        
        PID:5824

C:\Windows\SysWOW64\Hejqldci.exe
C:\Windows\system32\Hejqldci.exe
1⤵
PID:5876
- C:\Windows\SysWOW64\Hhimhobl.exe
  C:\Windows\system32\Hhimhobl.exe
  2⤵
  - Drops file in System32 directory
  PID:5952
- - C:\Windows\SysWOW64\Hppeim32.exe
    C:\Windows\system32\Hppeim32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Drops file in System32 directory
    - Modifies registry class
    PID:6036
  - - C:\Windows\SysWOW64\Haaaaeim.exe
      C:\Windows\system32\Haaaaeim.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Drops file in System32 directory
      PID:628
    - - C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        5⤵
        Drops file in System32 directory
        
        PID:6132

C:\Windows\SysWOW64\Inebjihf.exe
C:\Windows\system32\Inebjihf.exe
1⤵
- Drops file in System32 directory
PID:5208
- C:\Windows\SysWOW64\Iacngdgj.exe
  C:\Windows\system32\Iacngdgj.exe
  2⤵
  - Modifies registry class
  PID:5296
- - C:\Windows\SysWOW64\Ihmfco32.exe
    C:\Windows\system32\Ihmfco32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Drops file in System32 directory
    - Modifies registry class
    PID:5420
  - - C:\Windows\SysWOW64\Ipdndloi.exe
      C:\Windows\system32\Ipdndloi.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:5528
    - - C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        5⤵
        
        PID:5600
      - C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        6⤵
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        7⤵
        Drops file in System32 directory
        
        PID:5816
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        8⤵
        Modifies registry class
        
        PID:5920

C:\Windows\SysWOW64\Ihbponja.exe
C:\Windows\system32\Ihbponja.exe
1⤵
- Modifies registry class
PID:6048
- C:\Windows\SysWOW64\Ipihpkkd.exe
  C:\Windows\system32\Ipihpkkd.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:6096
- - C:\Windows\SysWOW64\Iajdgcab.exe
    C:\Windows\system32\Iajdgcab.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Drops file in System32 directory
    PID:5244
  - - C:\Windows\SysWOW64\Iialhaad.exe
      C:\Windows\system32\Iialhaad.exe
      4⤵
      Modifies registry class
      PID:5444
    - - C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3112

C:\Windows\SysWOW64\Iamamcop.exe
C:\Windows\system32\Iamamcop.exe
1⤵
- Modifies registry class
PID:5784
- C:\Windows\SysWOW64\Jidinqpb.exe
  C:\Windows\system32\Jidinqpb.exe
  2⤵
  PID:5892

C:\Windows\SysWOW64\Joqafgni.exe
C:\Windows\system32\Joqafgni.exe
1⤵
PID:6108
- C:\Windows\SysWOW64\Jaonbc32.exe
  C:\Windows\system32\Jaonbc32.exe
  2⤵
  - Drops file in System32 directory
  PID:3480

C:\Windows\SysWOW64\Jhifomdj.exe
C:\Windows\system32\Jhifomdj.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5360
- C:\Windows\SysWOW64\Jppnpjel.exe
  C:\Windows\system32\Jppnpjel.exe
  2⤵
  - Modifies registry class
  PID:5536
- - C:\Windows\SysWOW64\Jbojlfdp.exe
    C:\Windows\system32\Jbojlfdp.exe
    3⤵
    - Modifies registry class
    PID:5944
  - - C:\Windows\SysWOW64\Jihbip32.exe
      C:\Windows\system32\Jihbip32.exe
      4⤵
      Modifies registry class
      PID:3444

C:\Windows\SysWOW64\Jpbjfjci.exe
C:\Windows\system32\Jpbjfjci.exe
1⤵
PID:404
- C:\Windows\SysWOW64\Jadgnb32.exe
  C:\Windows\system32\Jadgnb32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:5868
- - C:\Windows\SysWOW64\Jikoopij.exe
    C:\Windows\system32\Jikoopij.exe
    3⤵
    - Modifies registry class
    PID:3056
  - - C:\Windows\SysWOW64\Jpegkj32.exe
      C:\Windows\system32\Jpegkj32.exe
      4⤵
      PID:5644
    - - C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        5⤵
        
        PID:5160

C:\Windows\SysWOW64\Jimldogg.exe
C:\Windows\system32\Jimldogg.exe
1⤵
- Drops file in System32 directory
PID:6092
- C:\Windows\SysWOW64\Jllhpkfk.exe
  C:\Windows\system32\Jllhpkfk.exe
  2⤵
  PID:6156
- - C:\Windows\SysWOW64\Jojdlfeo.exe
    C:\Windows\system32\Jojdlfeo.exe
    3⤵
    PID:6196
  - - C:\Windows\SysWOW64\Kedlip32.exe
      C:\Windows\system32\Kedlip32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:6244

C:\Windows\SysWOW64\Klndfj32.exe
C:\Windows\system32\Klndfj32.exe
1⤵
PID:6288
- C:\Windows\SysWOW64\Kpiqfima.exe
  C:\Windows\system32\Kpiqfima.exe
  2⤵
  PID:6332
- - C:\Windows\SysWOW64\Kakmna32.exe
    C:\Windows\system32\Kakmna32.exe
    3⤵
    PID:6376
  - - C:\Windows\SysWOW64\Kheekkjl.exe
      C:\Windows\system32\Kheekkjl.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:6420
    - - C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6460
      - C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        6⤵
        Modifies registry class
        
        PID:6508
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        7⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6548

C:\Windows\SysWOW64\Koajmepf.exe
C:\Windows\system32\Koajmepf.exe
1⤵
PID:6588
- C:\Windows\SysWOW64\Kapfiqoj.exe
  C:\Windows\system32\Kapfiqoj.exe
  2⤵
  PID:6636
- - C:\Windows\SysWOW64\Klekfinp.exe
    C:\Windows\system32\Klekfinp.exe
    3⤵
    - Drops file in System32 directory
    - Modifies registry class
    PID:6680

C:\Windows\SysWOW64\Kocgbend.exe
C:\Windows\system32\Kocgbend.exe
1⤵
- Drops file in System32 directory
PID:6724
- C:\Windows\SysWOW64\Kabcopmg.exe
  C:\Windows\system32\Kabcopmg.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  PID:6760
- - C:\Windows\SysWOW64\Kcapicdj.exe
    C:\Windows\system32\Kcapicdj.exe
    3⤵
    - Drops file in System32 directory
    PID:6804
  - - C:\Windows\SysWOW64\Lepleocn.exe
      C:\Windows\system32\Lepleocn.exe
      4⤵
      Drops file in System32 directory
      PID:6852
    - - C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        5⤵
        Modifies registry class
        
        PID:6892
      - C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        6⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Lgqhki32.exe
        
        C:\Windows\system32\Lgqhki32.exe
        7⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Lkldlgok.exe
        
        C:\Windows\system32\Lkldlgok.exe
        8⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Mqpcdn32.exe
        
        C:\Windows\system32\Mqpcdn32.exe
        9⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Mhgkfkhl.exe
        
        C:\Windows\system32\Mhgkfkhl.exe
        10⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Mkegbfgp.exe
        
        C:\Windows\system32\Mkegbfgp.exe
        11⤵
        
        PID:6716
- C:\Windows\SysWOW64\Lnhdbc32.exe
  C:\Windows\system32\Lnhdbc32.exe
  2⤵
  PID:6760
- - C:\Windows\SysWOW64\Ldblon32.exe
    C:\Windows\system32\Ldblon32.exe
    3⤵
    PID:6936

C:\Windows\SysWOW64\Lebijnak.exe
C:\Windows\system32\Lebijnak.exe
1⤵
- Drops file in System32 directory
- Modifies registry class
PID:6980
- C:\Windows\SysWOW64\Lhqefjpo.exe
  C:\Windows\system32\Lhqefjpo.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  PID:7024
- - C:\Windows\SysWOW64\Lpgmhg32.exe
    C:\Windows\system32\Lpgmhg32.exe
    3⤵
    - Modifies registry class
    PID:7068
  - - C:\Windows\SysWOW64\Lcfidb32.exe
      C:\Windows\system32\Lcfidb32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Drops file in System32 directory
      Modifies registry class
      PID:7112
    - - C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        5⤵
        
        PID:7160

C:\Windows\SysWOW64\Lpjjmg32.exe
C:\Windows\system32\Lpjjmg32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6168
- C:\Windows\SysWOW64\Lakfeodm.exe
  C:\Windows\system32\Lakfeodm.exe
  2⤵
  - Modifies registry class
  PID:6256

C:\Windows\SysWOW64\Ljbnfleo.exe
C:\Windows\system32\Ljbnfleo.exe
1⤵
PID:6316
- C:\Windows\SysWOW64\Lplfcf32.exe
  C:\Windows\system32\Lplfcf32.exe
  2⤵
  - Drops file in System32 directory
  PID:6408

C:\Windows\SysWOW64\Lckboblp.exe
C:\Windows\system32\Lckboblp.exe
1⤵
- Modifies registry class
PID:6524
- C:\Windows\SysWOW64\Lfiokmkc.exe
  C:\Windows\system32\Lfiokmkc.exe
  2⤵
  PID:6648
- - C:\Windows\SysWOW64\Oifppdpd.exe
    C:\Windows\system32\Oifppdpd.exe
    3⤵
    - Drops file in System32 directory
    PID:6716
  - - C:\Windows\SysWOW64\Mndcnafd.exe
      C:\Windows\system32\Mndcnafd.exe
      4⤵
      PID:6848

C:\Windows\SysWOW64\Ebdlangb.exe
C:\Windows\system32\Ebdlangb.exe
1⤵
- Executes dropped EXE
PID:3524

C:\Windows\SysWOW64\Oqmhqapg.exe
C:\Windows\system32\Oqmhqapg.exe
1⤵
PID:6756
- C:\Windows\SysWOW64\Ockdmmoj.exe
  C:\Windows\system32\Ockdmmoj.exe
  2⤵
  PID:6844

C:\Windows\SysWOW64\Oihmedma.exe
C:\Windows\system32\Oihmedma.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6928
- C:\Windows\SysWOW64\Obqanjdb.exe
  C:\Windows\system32\Obqanjdb.exe
  2⤵
  - Drops file in System32 directory
  PID:7056
- - C:\Windows\SysWOW64\Ppdbgncl.exe
    C:\Windows\system32\Ppdbgncl.exe
    3⤵
    PID:7152
  - - C:\Windows\SysWOW64\Pfojdh32.exe
      C:\Windows\system32\Pfojdh32.exe
      4⤵
      PID:6184
    - - C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6388
      - C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        6⤵
        Modifies registry class
        
        PID:6496
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6660
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6832
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6880
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4396
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        11⤵
        Modifies registry class
        
        PID:2184
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        12⤵
        Modifies registry class
        
        PID:4448

C:\Windows\SysWOW64\Pcgdhkem.exe
C:\Windows\system32\Pcgdhkem.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6364
- C:\Windows\SysWOW64\Pfepdg32.exe
  C:\Windows\system32\Pfepdg32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  - Modifies registry class
  PID:6644
- - C:\Windows\SysWOW64\Pmphaaln.exe
    C:\Windows\system32\Pmphaaln.exe
    3⤵
    - Modifies registry class
    PID:6812
  - - C:\Windows\SysWOW64\Ppnenlka.exe
      C:\Windows\system32\Ppnenlka.exe
      4⤵
      Drops file in System32 directory
      Modifies registry class
      PID:4596

C:\Windows\SysWOW64\Pfhmjf32.exe
C:\Windows\system32\Pfhmjf32.exe
1⤵
PID:4784
- C:\Windows\SysWOW64\Pmbegqjk.exe
  C:\Windows\system32\Pmbegqjk.exe
  2⤵
  PID:6572
- - C:\Windows\SysWOW64\Qppaclio.exe
    C:\Windows\system32\Qppaclio.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Drops file in System32 directory
    PID:7016

C:\Windows\SysWOW64\Qfjjpf32.exe
C:\Windows\system32\Qfjjpf32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6224
- C:\Windows\SysWOW64\Qiiflaoo.exe
  C:\Windows\system32\Qiiflaoo.exe
  2⤵
  PID:7060
- - C:\Windows\SysWOW64\Qpbnhl32.exe
    C:\Windows\system32\Qpbnhl32.exe
    3⤵
    PID:7140

C:\Windows\SysWOW64\Qbajeg32.exe
C:\Windows\system32\Qbajeg32.exe
1⤵
- Drops file in System32 directory
- Modifies registry class
PID:7208
- C:\Windows\SysWOW64\Qjhbfd32.exe
  C:\Windows\system32\Qjhbfd32.exe
  2⤵
  PID:7248
- - C:\Windows\SysWOW64\Amfobp32.exe
    C:\Windows\system32\Amfobp32.exe
    3⤵
    - Modifies registry class
    PID:7288
  - - C:\Windows\SysWOW64\Acqgojmb.exe
      C:\Windows\system32\Acqgojmb.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Modifies registry class
      PID:7328

C:\Windows\SysWOW64\Afockelf.exe
C:\Windows\system32\Afockelf.exe
1⤵
PID:7376
- C:\Windows\SysWOW64\Aimogakj.exe
  C:\Windows\system32\Aimogakj.exe
  2⤵
  PID:7416
- - C:\Windows\SysWOW64\Aadghn32.exe
    C:\Windows\system32\Aadghn32.exe
    3⤵
    PID:7460
  - - C:\Windows\SysWOW64\Abfdpfaj.exe
      C:\Windows\system32\Abfdpfaj.exe
      4⤵
      PID:7504

C:\Windows\SysWOW64\Aiplmq32.exe
C:\Windows\system32\Aiplmq32.exe
1⤵
PID:7544
- C:\Windows\SysWOW64\Aagdnn32.exe
  C:\Windows\system32\Aagdnn32.exe
  2⤵
  PID:7588
- - C:\Windows\SysWOW64\Adepji32.exe
    C:\Windows\system32\Adepji32.exe
    3⤵
    PID:7628

C:\Windows\SysWOW64\Afcmfe32.exe
C:\Windows\system32\Afcmfe32.exe
1⤵
PID:7668
- C:\Windows\SysWOW64\Aibibp32.exe
  C:\Windows\system32\Aibibp32.exe
  2⤵
  PID:7716

C:\Windows\SysWOW64\Adgmoigj.exe
C:\Windows\system32\Adgmoigj.exe
1⤵
PID:7760
- C:\Windows\SysWOW64\Ajaelc32.exe
  C:\Windows\system32\Ajaelc32.exe
  2⤵
  PID:7800

C:\Windows\SysWOW64\Aalmimfd.exe
C:\Windows\system32\Aalmimfd.exe
1⤵
PID:7836
- C:\Windows\SysWOW64\Adjjeieh.exe
  C:\Windows\system32\Adjjeieh.exe
  2⤵
  PID:7876
- - C:\Windows\SysWOW64\Bigbmpco.exe
    C:\Windows\system32\Bigbmpco.exe
    3⤵
    PID:7924
- - C:\Windows\SysWOW64\Ngekmf32.exe
    C:\Windows\system32\Ngekmf32.exe
    3⤵
    PID:8816
  - - C:\Windows\SysWOW64\Nombnc32.exe
      C:\Windows\system32\Nombnc32.exe
      4⤵
      PID:8844
    - - C:\Windows\SysWOW64\Nqnofkkj.exe
        
        C:\Windows\system32\Nqnofkkj.exe
        5⤵
        
        PID:232
      - C:\Windows\SysWOW64\Nieggill.exe
        
        C:\Windows\system32\Nieggill.exe
        6⤵
        
        PID:2948

C:\Windows\SysWOW64\Bmidnm32.exe
C:\Windows\system32\Bmidnm32.exe
1⤵
PID:7964
- C:\Windows\SysWOW64\Bphqji32.exe
  C:\Windows\system32\Bphqji32.exe
  2⤵
  PID:8060
- - C:\Windows\SysWOW64\Cmpcdfll.exe
    C:\Windows\system32\Cmpcdfll.exe
    3⤵
    PID:8116
  - - C:\Windows\SysWOW64\Cboibm32.exe
      C:\Windows\system32\Cboibm32.exe
      4⤵
      PID:8184
    - - C:\Windows\SysWOW64\Ciiaogon.exe
        
        C:\Windows\system32\Ciiaogon.exe
        5⤵
        
        PID:7200

C:\Windows\SysWOW64\Adfgdpmi.exe
C:\Windows\system32\Adfgdpmi.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536

C:\Windows\SysWOW64\Adcjop32.exe
C:\Windows\system32\Adcjop32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3860

C:\Windows\SysWOW64\Amjbbfgo.exe
C:\Windows\system32\Amjbbfgo.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624

C:\Windows\SysWOW64\Afpjel32.exe
C:\Windows\system32\Afpjel32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464

C:\Windows\SysWOW64\Qpcecb32.exe
C:\Windows\system32\Qpcecb32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612

C:\Windows\SysWOW64\Qjfmkk32.exe
C:\Windows\system32\Qjfmkk32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3456

C:\Windows\SysWOW64\Qhhpop32.exe
C:\Windows\system32\Qhhpop32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2976

C:\Windows\SysWOW64\Pmblagmf.exe
C:\Windows\system32\Pmblagmf.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4100

C:\Windows\SysWOW64\Clgmkbna.exe
C:\Windows\system32\Clgmkbna.exe
1⤵
PID:7284
- C:\Windows\SysWOW64\Cdnelpod.exe
  C:\Windows\system32\Cdnelpod.exe
  2⤵
  PID:7368
- - C:\Windows\SysWOW64\Cfmahknh.exe
    C:\Windows\system32\Cfmahknh.exe
    3⤵
    PID:7424
  - - C:\Windows\SysWOW64\Cmgjee32.exe
      C:\Windows\system32\Cmgjee32.exe
      4⤵
      PID:7488

C:\Windows\SysWOW64\Dfonnk32.exe
C:\Windows\system32\Dfonnk32.exe
1⤵
PID:7624
- C:\Windows\SysWOW64\Dmifkecb.exe
  C:\Windows\system32\Dmifkecb.exe
  2⤵
  PID:7708
- - C:\Windows\SysWOW64\Digmqe32.exe
    C:\Windows\system32\Digmqe32.exe
    3⤵
    PID:7780

C:\Windows\SysWOW64\Ddqbbo32.exe
C:\Windows\system32\Ddqbbo32.exe
1⤵
PID:7576

C:\Windows\SysWOW64\Dmbiackg.exe
C:\Windows\system32\Dmbiackg.exe
1⤵
PID:7812
- C:\Windows\SysWOW64\Epaemojk.exe
  C:\Windows\system32\Epaemojk.exe
  2⤵
  PID:7916

C:\Windows\SysWOW64\Ecoaijio.exe
C:\Windows\system32\Ecoaijio.exe
1⤵
PID:7952
- C:\Windows\SysWOW64\Egknji32.exe
  C:\Windows\system32\Egknji32.exe
  2⤵
  PID:6492
- - C:\Windows\SysWOW64\Eiijfd32.exe
    C:\Windows\system32\Eiijfd32.exe
    3⤵
    PID:6964
  - - C:\Windows\SysWOW64\Elhfbp32.exe
      C:\Windows\system32\Elhfbp32.exe
      4⤵
      PID:7032
    - - C:\Windows\SysWOW64\Ecfhji32.exe
        
        C:\Windows\system32\Ecfhji32.exe
        5⤵
        
        PID:8156
      - C:\Windows\SysWOW64\Eippgckc.exe
        
        C:\Windows\system32\Eippgckc.exe
        6⤵
        
        PID:6788

C:\Windows\SysWOW64\Elolco32.exe
C:\Windows\system32\Elolco32.exe
1⤵
PID:7348
- C:\Windows\SysWOW64\Edfddl32.exe
  C:\Windows\system32\Edfddl32.exe
  2⤵
  PID:7456
- - C:\Windows\SysWOW64\Egdqph32.exe
    C:\Windows\system32\Egdqph32.exe
    3⤵
    PID:3412
  - - C:\Windows\SysWOW64\Fnnimbaj.exe
      C:\Windows\system32\Fnnimbaj.exe
      4⤵
      PID:7660
    - - C:\Windows\SysWOW64\Fdhail32.exe
        
        C:\Windows\system32\Fdhail32.exe
        5⤵
        
        PID:7792
      - C:\Windows\SysWOW64\Feimadoe.exe
        
        C:\Windows\system32\Feimadoe.exe
        6⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Flcfnn32.exe
        
        C:\Windows\system32\Flcfnn32.exe
        7⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Feljgd32.exe
        
        C:\Windows\system32\Feljgd32.exe
        8⤵
        
        PID:8076

C:\Windows\SysWOW64\Fjgfgbek.exe
C:\Windows\system32\Fjgfgbek.exe
1⤵
PID:8124
- C:\Windows\SysWOW64\Flfbcndo.exe
  C:\Windows\system32\Flfbcndo.exe
  2⤵
  PID:7244
- - C:\Windows\SysWOW64\Fcpkph32.exe
    C:\Windows\system32\Fcpkph32.exe
    3⤵
    PID:7496

C:\Windows\SysWOW64\Ffnglc32.exe
C:\Windows\system32\Ffnglc32.exe
1⤵
PID:7608
- C:\Windows\SysWOW64\Fneoma32.exe
  C:\Windows\system32\Fneoma32.exe
  2⤵
  PID:7832
- - C:\Windows\SysWOW64\Flhoinbl.exe
    C:\Windows\system32\Flhoinbl.exe
    3⤵
    PID:212

C:\Windows\SysWOW64\Fdogjk32.exe
C:\Windows\system32\Fdogjk32.exe
1⤵
PID:8052
- C:\Windows\SysWOW64\Fgncff32.exe
  C:\Windows\system32\Fgncff32.exe
  2⤵
  PID:8160

C:\Windows\SysWOW64\Ffpcbchm.exe
C:\Windows\system32\Ffpcbchm.exe
1⤵
PID:7408
- C:\Windows\SysWOW64\Fpfholhc.exe
  C:\Windows\system32\Fpfholhc.exe
  2⤵
  PID:7752
- - C:\Windows\SysWOW64\Gdfmkjlg.exe
    C:\Windows\system32\Gdfmkjlg.exe
    3⤵
    PID:8024
  - - C:\Windows\SysWOW64\Gjcfcakn.exe
      C:\Windows\system32\Gjcfcakn.exe
      4⤵
      PID:8148
    - - C:\Windows\SysWOW64\Gdhjpjjd.exe
        
        C:\Windows\system32\Gdhjpjjd.exe
        5⤵
        
        PID:7616
      - C:\Windows\SysWOW64\Gggfme32.exe
        
        C:\Windows\system32\Gggfme32.exe
        6⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Gmdoel32.exe
        
        C:\Windows\system32\Gmdoel32.exe
        7⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Gqokekph.exe
        
        C:\Windows\system32\Gqokekph.exe
        8⤵
        
        PID:7232

C:\Windows\SysWOW64\Ggicbe32.exe
C:\Windows\system32\Ggicbe32.exe
1⤵
PID:7396
- C:\Windows\SysWOW64\Gjhonp32.exe
  C:\Windows\system32\Gjhonp32.exe
  2⤵
  PID:8208
- - C:\Windows\SysWOW64\Gdmcki32.exe
    C:\Windows\system32\Gdmcki32.exe
    3⤵
    PID:8248
  - - C:\Windows\SysWOW64\Hfnpca32.exe
      C:\Windows\system32\Hfnpca32.exe
      4⤵
      PID:8292
    - - C:\Windows\SysWOW64\Hqddqj32.exe
        
        C:\Windows\system32\Hqddqj32.exe
        5⤵
        
        PID:8336

C:\Windows\SysWOW64\Hcbpme32.exe
C:\Windows\system32\Hcbpme32.exe
1⤵
PID:8372
- C:\Windows\SysWOW64\Hjlhipbc.exe
  C:\Windows\system32\Hjlhipbc.exe
  2⤵
  PID:8460
- - C:\Windows\SysWOW64\Inagpm32.exe
    C:\Windows\system32\Inagpm32.exe
    3⤵
    PID:8524

C:\Windows\SysWOW64\Iqpclh32.exe
C:\Windows\system32\Iqpclh32.exe
1⤵
PID:8576
- C:\Windows\SysWOW64\Lcqgahoe.exe
  C:\Windows\system32\Lcqgahoe.exe
  2⤵
  PID:8756
- - C:\Windows\SysWOW64\Ogpfko32.exe
    C:\Windows\system32\Ogpfko32.exe
    3⤵
    PID:8848
  - - C:\Windows\SysWOW64\Lcpqgbkj.exe
      C:\Windows\system32\Lcpqgbkj.exe
      4⤵
      PID:8908
    - - C:\Windows\SysWOW64\Opjponbf.exe
        
        C:\Windows\system32\Opjponbf.exe
        5⤵
        
        PID:8984
      - C:\Windows\SysWOW64\Eanqpdgi.exe
        
        C:\Windows\system32\Eanqpdgi.exe
        6⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Gdfhil32.exe
        
        C:\Windows\system32\Gdfhil32.exe
        7⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Linojbdc.exe
        
        C:\Windows\system32\Linojbdc.exe
        8⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Bhldio32.exe
        
        C:\Windows\system32\Bhldio32.exe
        9⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Bkjpek32.exe
        
        C:\Windows\system32\Bkjpek32.exe
        10⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Bcahgh32.exe
        
        C:\Windows\system32\Bcahgh32.exe
        11⤵
        
        PID:3532

C:\Windows\SysWOW64\Lkmkfncf.exe
C:\Windows\system32\Lkmkfncf.exe
1⤵
PID:8256
- C:\Windows\SysWOW64\Lohggm32.exe
  C:\Windows\system32\Lohggm32.exe
  2⤵
  PID:5916

C:\Windows\SysWOW64\Lfbpcgbl.exe
C:\Windows\system32\Lfbpcgbl.exe
1⤵
PID:3568
- C:\Windows\SysWOW64\Miqlpbap.exe
  C:\Windows\system32\Miqlpbap.exe
  2⤵
  PID:8500

C:\Windows\SysWOW64\Mkohln32.exe
C:\Windows\system32\Mkohln32.exe
1⤵
PID:8600
- C:\Windows\SysWOW64\Mnndhi32.exe
  C:\Windows\system32\Mnndhi32.exe
  2⤵
  PID:1232

C:\Windows\SysWOW64\Mbiphhhq.exe
C:\Windows\system32\Mbiphhhq.exe
1⤵
PID:1408
- C:\Windows\SysWOW64\Mfdlif32.exe
  C:\Windows\system32\Mfdlif32.exe
  2⤵
  PID:2368
- - C:\Windows\SysWOW64\Mkadam32.exe
    C:\Windows\system32\Mkadam32.exe
    3⤵
    PID:4524
  - - C:\Windows\SysWOW64\Mnpami32.exe
      C:\Windows\system32\Mnpami32.exe
      4⤵
      PID:6080
    - - C:\Windows\SysWOW64\Mbkmngfn.exe
        
        C:\Windows\system32\Mbkmngfn.exe
        5⤵
        
        PID:4388
      - C:\Windows\SysWOW64\Mejijcea.exe
        
        C:\Windows\system32\Mejijcea.exe
        6⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Mkdagm32.exe
        
        C:\Windows\system32\Mkdagm32.exe
        7⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Mndjhhjp.exe
        
        C:\Windows\system32\Mndjhhjp.exe
        8⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Hdodeedi.exe
        
        C:\Windows\system32\Hdodeedi.exe
        9⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\Hjimaole.exe
        
        C:\Windows\system32\Hjimaole.exe
        10⤵
        
        PID:408
        
        C:\Windows\SysWOW64\Hmginjki.exe
        
        C:\Windows\system32\Hmginjki.exe
        11⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\Hdaajd32.exe
        
        C:\Windows\system32\Hdaajd32.exe
        12⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Ijpcbn32.exe
        
        C:\Windows\system32\Ijpcbn32.exe
        13⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Iajkohmj.exe
        
        C:\Windows\system32\Iajkohmj.exe
        14⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Idhgkcln.exe
        
        C:\Windows\system32\Idhgkcln.exe
        15⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\Ionlhlld.exe
        
        C:\Windows\system32\Ionlhlld.exe
        16⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Ialhdh32.exe
        
        C:\Windows\system32\Ialhdh32.exe
        17⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Ihfpabbd.exe
        
        C:\Windows\system32\Ihfpabbd.exe
        18⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\Ikdlmmbh.exe
        
        C:\Windows\system32\Ikdlmmbh.exe
        19⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Jhmfba32.exe
        
        C:\Windows\system32\Jhmfba32.exe
        20⤵
        
        PID:1072

C:\Windows\SysWOW64\Lbgcch32.exe
C:\Windows\system32\Lbgcch32.exe
1⤵
PID:8368

C:\Windows\SysWOW64\Jahgpf32.exe
C:\Windows\system32\Jahgpf32.exe
1⤵
PID:5264
- C:\Windows\SysWOW64\Jdfcla32.exe
  C:\Windows\system32\Jdfcla32.exe
  2⤵
  PID:5344
- - C:\Windows\SysWOW64\Jkplilgk.exe
    C:\Windows\system32\Jkplilgk.exe
    3⤵
    PID:5480
  - - C:\Windows\SysWOW64\Jmnheggo.exe
      C:\Windows\system32\Jmnheggo.exe
      4⤵
      PID:5128
- - C:\Windows\SysWOW64\Cjbfdakf.exe
    C:\Windows\system32\Cjbfdakf.exe
    3⤵
    PID:5352
  - - C:\Windows\SysWOW64\Cmabpmjj.exe
      C:\Windows\system32\Cmabpmjj.exe
      4⤵
      PID:5924
    - - C:\Windows\SysWOW64\Cfigib32.exe
        
        C:\Windows\system32\Cfigib32.exe
        5⤵
        
        PID:2836

C:\Windows\SysWOW64\Jhdlbp32.exe
C:\Windows\system32\Jhdlbp32.exe
1⤵
PID:5372
- C:\Windows\SysWOW64\Jkbhok32.exe
  C:\Windows\system32\Jkbhok32.exe
  2⤵
  PID:2676
- - C:\Windows\SysWOW64\Jalakeme.exe
    C:\Windows\system32\Jalakeme.exe
    3⤵
    PID:5924
  - - C:\Windows\SysWOW64\Jgiiclkl.exe
      C:\Windows\system32\Jgiiclkl.exe
      4⤵
      PID:6020
    - - C:\Windows\SysWOW64\Jncapf32.exe
        
        C:\Windows\system32\Jncapf32.exe
        5⤵
        
        PID:5980
      - C:\Windows\SysWOW64\Kpanmb32.exe
        
        C:\Windows\system32\Kpanmb32.exe
        6⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\Cihcen32.exe
        
        C:\Windows\system32\Cihcen32.exe
        7⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Ckfpai32.exe
        
        C:\Windows\system32\Ckfpai32.exe
        8⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Ccmgbf32.exe
        
        C:\Windows\system32\Ccmgbf32.exe
        9⤵
        
        PID:2884

C:\Windows\SysWOW64\Kgkfil32.exe
C:\Windows\system32\Kgkfil32.exe
1⤵
PID:5248
- C:\Windows\SysWOW64\Kobnji32.exe
  C:\Windows\system32\Kobnji32.exe
  2⤵
  PID:5560
- - C:\Windows\SysWOW64\Khkbcopl.exe
    C:\Windows\system32\Khkbcopl.exe
    3⤵
    PID:5668
  - - C:\Windows\SysWOW64\Kkioojpp.exe
      C:\Windows\system32\Kkioojpp.exe
      4⤵
      PID:6088
    - - C:\Windows\SysWOW64\Kacgld32.exe
        
        C:\Windows\system32\Kacgld32.exe
        5⤵
        
        PID:4696
      - C:\Windows\SysWOW64\Kgpodk32.exe
        
        C:\Windows\system32\Kgpodk32.exe
        6⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Kafcadej.exe
        
        C:\Windows\system32\Kafcadej.exe
        7⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Kphdma32.exe
        
        C:\Windows\system32\Kphdma32.exe
        8⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Knldfe32.exe
        
        C:\Windows\system32\Knldfe32.exe
        9⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Kpkqbq32.exe
        
        C:\Windows\system32\Kpkqbq32.exe
        10⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Kgeiokao.exe
        
        C:\Windows\system32\Kgeiokao.exe
        11⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\Kolaqh32.exe
        
        C:\Windows\system32\Kolaqh32.exe
        12⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Lpmmhpgp.exe
        
        C:\Windows\system32\Lpmmhpgp.exe
        13⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Lhdeinhb.exe
        
        C:\Windows\system32\Lhdeinhb.exe
        14⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Cjgpoq32.exe
        
        C:\Windows\system32\Cjgpoq32.exe
        9⤵
        
        PID:5100

C:\Windows\SysWOW64\Lonnfg32.exe
C:\Windows\system32\Lonnfg32.exe
1⤵
PID:6484
- C:\Windows\SysWOW64\Lppjnpem.exe
  C:\Windows\system32\Lppjnpem.exe
  2⤵
  PID:6608

C:\Windows\SysWOW64\Lkenkhec.exe
C:\Windows\system32\Lkenkhec.exe
1⤵
PID:6696
- C:\Windows\SysWOW64\Lncjgddf.exe
  C:\Windows\system32\Lncjgddf.exe
  2⤵
  PID:6244
- - C:\Windows\SysWOW64\Lkgkqh32.exe
    C:\Windows\system32\Lkgkqh32.exe
    3⤵
    PID:6380
  - - C:\Windows\SysWOW64\Laacmbkm.exe
      C:\Windows\system32\Laacmbkm.exe
      4⤵
      PID:8676
    - - C:\Windows\SysWOW64\Ldpoinjq.exe
        
        C:\Windows\system32\Ldpoinjq.exe
        5⤵
        
        PID:7084

C:\Windows\SysWOW64\Lgnleiid.exe
C:\Windows\system32\Lgnleiid.exe
1⤵
PID:6676
- C:\Windows\SysWOW64\Lkjhfh32.exe
  C:\Windows\system32\Lkjhfh32.exe
  2⤵
  PID:6724

C:\Windows\SysWOW64\Mdnlkl32.exe
C:\Windows\system32\Mdnlkl32.exe
1⤵
PID:7004
- C:\Windows\SysWOW64\Mglhgg32.exe
  C:\Windows\system32\Mglhgg32.exe
  2⤵
  PID:6744
- - C:\Windows\SysWOW64\Nocphd32.exe
    C:\Windows\system32\Nocphd32.exe
    3⤵
    PID:2216
  - - C:\Windows\SysWOW64\Ndphpk32.exe
      C:\Windows\system32\Ndphpk32.exe
      4⤵
      PID:6880
    - - C:\Windows\SysWOW64\Ngodlgka.exe
        
        C:\Windows\system32\Ngodlgka.exe
        5⤵
        
        PID:7344
      - C:\Windows\SysWOW64\Nbdijpjh.exe
        
        C:\Windows\system32\Nbdijpjh.exe
        6⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Ndbefkjk.exe
        
        C:\Windows\system32\Ndbefkjk.exe
        7⤵
        
        PID:2564

C:\Windows\SysWOW64\Ngaabfio.exe
C:\Windows\system32\Ngaabfio.exe
1⤵
PID:7644
- C:\Windows\SysWOW64\Nohicdia.exe
  C:\Windows\system32\Nohicdia.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:7060
- - C:\Windows\SysWOW64\Nqifkl32.exe
    C:\Windows\system32\Nqifkl32.exe
    3⤵
    PID:7332

C:\Windows\SysWOW64\Niqnli32.exe
C:\Windows\system32\Niqnli32.exe
1⤵
PID:7548
- C:\Windows\SysWOW64\Nkojheoe.exe
  C:\Windows\system32\Nkojheoe.exe
  2⤵
  PID:7720
- - C:\Windows\SysWOW64\Nnmfdpni.exe
    C:\Windows\system32\Nnmfdpni.exe
    3⤵
    PID:7800
  - - C:\Windows\SysWOW64\Negoaj32.exe
      C:\Windows\system32\Negoaj32.exe
      4⤵
      PID:7876

C:\Windows\SysWOW64\Okcccdkp.exe
C:\Windows\system32\Okcccdkp.exe
1⤵
PID:7440
- C:\Windows\SysWOW64\Onbpop32.exe
  C:\Windows\system32\Onbpop32.exe
  2⤵
  PID:8120
- - C:\Windows\SysWOW64\Oapllk32.exe
    C:\Windows\system32\Oapllk32.exe
    3⤵
    PID:7484
  - - C:\Windows\SysWOW64\Oendaipn.exe
      C:\Windows\system32\Oendaipn.exe
      4⤵
      PID:5736
    - - C:\Windows\SysWOW64\Okhmnc32.exe
        
        C:\Windows\system32\Okhmnc32.exe
        5⤵
        
        PID:9024
      - C:\Windows\SysWOW64\Ongijo32.exe
        
        C:\Windows\system32\Ongijo32.exe
        6⤵
        
        PID:9036

C:\Windows\SysWOW64\Obbekn32.exe
C:\Windows\system32\Obbekn32.exe
1⤵
PID:7784
- C:\Windows\SysWOW64\Oilmhhfd.exe
  C:\Windows\system32\Oilmhhfd.exe
  2⤵
  PID:7620

C:\Windows\SysWOW64\Okkidceh.exe
C:\Windows\system32\Okkidceh.exe
1⤵
PID:7908
- C:\Windows\SysWOW64\Onifpodl.exe
  C:\Windows\system32\Onifpodl.exe
  2⤵
  PID:6964
- - C:\Windows\SysWOW64\Oagbljcp.exe
    C:\Windows\system32\Oagbljcp.exe
    3⤵
    PID:8156
  - - C:\Windows\SysWOW64\Olmficce.exe
      C:\Windows\system32\Olmficce.exe
      4⤵
      PID:7456
    - - C:\Windows\SysWOW64\Onkbenbi.exe
        
        C:\Windows\system32\Onkbenbi.exe
        5⤵
        
        PID:6620

C:\Windows\SysWOW64\Oiagcg32.exe
C:\Windows\system32\Oiagcg32.exe
1⤵
PID:7412
- C:\Windows\SysWOW64\Ppkopail.exe
  C:\Windows\system32\Ppkopail.exe
  2⤵
  PID:7856
- - C:\Windows\SysWOW64\Pbiklmhp.exe
    C:\Windows\system32\Pbiklmhp.exe
    3⤵
    PID:8112

C:\Windows\SysWOW64\Pehghhgc.exe
C:\Windows\system32\Pehghhgc.exe
1⤵
PID:8228
- C:\Windows\SysWOW64\Plapdb32.exe
  C:\Windows\system32\Plapdb32.exe
  2⤵
  PID:8396
- - C:\Windows\SysWOW64\Pblhalfm.exe
    C:\Windows\system32\Pblhalfm.exe
    3⤵
    PID:4816
  - - C:\Windows\SysWOW64\Pejdmh32.exe
      C:\Windows\system32\Pejdmh32.exe
      4⤵
      PID:8296
    - - C:\Windows\SysWOW64\Piepnfnj.exe
        
        C:\Windows\system32\Piepnfnj.exe
        5⤵
        
        PID:8464
      - C:\Windows\SysWOW64\Pihmcflg.exe
        
        C:\Windows\system32\Pihmcflg.exe
        6⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Ppbepp32.exe
        
        C:\Windows\system32\Ppbepp32.exe
        7⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Pacahhib.exe
        
        C:\Windows\system32\Pacahhib.exe
        8⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Pijiif32.exe
        
        C:\Windows\system32\Pijiif32.exe
        9⤵
        
        PID:8400

C:\Windows\SysWOW64\Ppdbfpaa.exe
C:\Windows\system32\Ppdbfpaa.exe
1⤵
PID:8560
- C:\Windows\SysWOW64\Pngbam32.exe
  C:\Windows\system32\Pngbam32.exe
  2⤵
  PID:6516

C:\Windows\SysWOW64\Qimfoe32.exe
C:\Windows\system32\Qimfoe32.exe
1⤵
PID:1976
- C:\Windows\SysWOW64\Qlkbka32.exe
  C:\Windows\system32\Qlkbka32.exe
  2⤵
  PID:4384
- - C:\Windows\SysWOW64\Qbekgknb.exe
    C:\Windows\system32\Qbekgknb.exe
    3⤵
    PID:64
  - - C:\Windows\SysWOW64\Qecgcfmf.exe
      C:\Windows\system32\Qecgcfmf.exe
      4⤵
      PID:4124
    - - C:\Windows\SysWOW64\Qhbcpb32.exe
        
        C:\Windows\system32\Qhbcpb32.exe
        5⤵
        
        PID:4192
      - C:\Windows\SysWOW64\Qpikao32.exe
        
        C:\Windows\system32\Qpikao32.exe
        6⤵
        
        PID:2776

C:\Windows\SysWOW64\Qajhigcj.exe
C:\Windows\system32\Qajhigcj.exe
1⤵
PID:3632
- C:\Windows\SysWOW64\Alplfpbp.exe
  C:\Windows\system32\Alplfpbp.exe
  2⤵
  PID:7096

C:\Windows\SysWOW64\Aonhblad.exe
C:\Windows\system32\Aonhblad.exe
1⤵
PID:1484
- C:\Windows\SysWOW64\Aehpof32.exe
  C:\Windows\system32\Aehpof32.exe
  2⤵
  PID:924
- - C:\Windows\SysWOW64\Ahfmka32.exe
    C:\Windows\system32\Ahfmka32.exe
    3⤵
    PID:8632
  - - C:\Windows\SysWOW64\Apndloif.exe
      C:\Windows\system32\Apndloif.exe
      4⤵
      PID:4060

C:\Windows\SysWOW64\Aaoadg32.exe
C:\Windows\system32\Aaoadg32.exe
1⤵
PID:2860
- C:\Windows\SysWOW64\Aified32.exe
  C:\Windows\system32\Aified32.exe
  2⤵
  PID:8648

C:\Windows\SysWOW64\Ahiiqafa.exe
C:\Windows\system32\Ahiiqafa.exe
1⤵
PID:1628
- C:\Windows\SysWOW64\Aocamk32.exe
  C:\Windows\system32\Aocamk32.exe
  2⤵
  PID:5000
- - C:\Windows\SysWOW64\Aaanif32.exe
    C:\Windows\system32\Aaanif32.exe
    3⤵
    PID:4872
  - - C:\Windows\SysWOW64\Aihfjd32.exe
      C:\Windows\system32\Aihfjd32.exe
      4⤵
      PID:4944
    - - C:\Windows\SysWOW64\Ahkffqdo.exe
        
        C:\Windows\system32\Ahkffqdo.exe
        5⤵
        
        PID:5856

C:\Windows\SysWOW64\Aoenbkll.exe
C:\Windows\system32\Aoenbkll.exe
1⤵
PID:5572
- C:\Windows\SysWOW64\Abqjci32.exe
  C:\Windows\system32\Abqjci32.exe
  2⤵
  PID:5708

C:\Windows\SysWOW64\Aeofoe32.exe
C:\Windows\system32\Aeofoe32.exe
1⤵
PID:5928
- C:\Windows\SysWOW64\Alioloje.exe
  C:\Windows\system32\Alioloje.exe
  2⤵
  PID:6064
- - C:\Windows\SysWOW64\Bedpjdoc.exe
    C:\Windows\system32\Bedpjdoc.exe
    3⤵
    PID:1820
  - - C:\Windows\SysWOW64\Iicboncn.exe
      C:\Windows\system32\Iicboncn.exe
      4⤵
      PID:2028
    - - C:\Windows\SysWOW64\Jfpocjfa.exe
        
        C:\Windows\system32\Jfpocjfa.exe
        5⤵
        
        PID:5124
      - C:\Windows\SysWOW64\Oibbjoij.exe
        
        C:\Windows\system32\Oibbjoij.exe
        6⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Hajpli32.exe
        
        C:\Windows\system32\Hajpli32.exe
        7⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Jnklnfpq.exe
        
        C:\Windows\system32\Jnklnfpq.exe
        8⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Kabkpqgj.exe
        
        C:\Windows\system32\Kabkpqgj.exe
        9⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Ljmmnf32.exe
        
        C:\Windows\system32\Ljmmnf32.exe
        10⤵
        
        PID:6728

C:\Windows\SysWOW64\Llabchoe.exe
C:\Windows\system32\Llabchoe.exe
1⤵
PID:8744
- C:\Windows\SysWOW64\Lnpopcni.exe
  C:\Windows\system32\Lnpopcni.exe
  2⤵
  PID:6280
- - C:\Windows\SysWOW64\Macdgn32.exe
    C:\Windows\system32\Macdgn32.exe
    3⤵
    PID:3924
  - - C:\Windows\SysWOW64\Milinkgf.exe
      C:\Windows\system32\Milinkgf.exe
      4⤵
      PID:6524
    - - C:\Windows\SysWOW64\Mecjbl32.exe
        
        C:\Windows\system32\Mecjbl32.exe
        5⤵
        
        PID:6976
      - C:\Windows\SysWOW64\Majjgmco.exe
        
        C:\Windows\system32\Majjgmco.exe
        6⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Mnnkaa32.exe
        
        C:\Windows\system32\Mnnkaa32.exe
        7⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Nhfpjghi.exe
        
        C:\Windows\system32\Nhfpjghi.exe
        8⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\Nblcgpho.exe
        
        C:\Windows\system32\Nblcgpho.exe
        9⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Nejpckgc.exe
        
        C:\Windows\system32\Nejpckgc.exe
        10⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\Nhhlog32.exe
        
        C:\Windows\system32\Nhhlog32.exe
        11⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Nobdlqnc.exe
        
        C:\Windows\system32\Nobdlqnc.exe
        12⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Naaqhlmg.exe
        
        C:\Windows\system32\Naaqhlmg.exe
        13⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Nacmnlkd.exe
        
        C:\Windows\system32\Nacmnlkd.exe
        14⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Nijeoikf.exe
        
        C:\Windows\system32\Nijeoikf.exe
        15⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Obgccn32.exe
        
        C:\Windows\system32\Obgccn32.exe
        16⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Olbdacbp.exe
        
        C:\Windows\system32\Olbdacbp.exe
        17⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Oocmcn32.exe
        
        C:\Windows\system32\Oocmcn32.exe
        18⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Oaajoj32.exe
        
        C:\Windows\system32\Oaajoj32.exe
        19⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Okjnhpee.exe
        
        C:\Windows\system32\Okjnhpee.exe
        20⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Obafim32.exe
        
        C:\Windows\system32\Obafim32.exe
        21⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Pkngco32.exe
        
        C:\Windows\system32\Pkngco32.exe
        22⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Pcepdl32.exe
        
        C:\Windows\system32\Pcepdl32.exe
        23⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Phbhlcpi.exe
        
        C:\Windows\system32\Phbhlcpi.exe
        24⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Pkqdhnom.exe
        
        C:\Windows\system32\Pkqdhnom.exe
        25⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Pefhfgoc.exe
        
        C:\Windows\system32\Pefhfgoc.exe
        26⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Phddbbnf.exe
        
        C:\Windows\system32\Phddbbnf.exe
        27⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\Phgagb32.exe
        
        C:\Windows\system32\Phgagb32.exe
        28⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Poajdlcq.exe
        
        C:\Windows\system32\Poajdlcq.exe
        29⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Qaofphbd.exe
        
        C:\Windows\system32\Qaofphbd.exe
        30⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Qocfjlan.exe
        
        C:\Windows\system32\Qocfjlan.exe
        31⤵
        
        PID:8516

C:\Windows\SysWOW64\Qaabfgpa.exe
C:\Windows\system32\Qaabfgpa.exe
1⤵
PID:6632
- C:\Windows\SysWOW64\Qlggcp32.exe
  C:\Windows\system32\Qlggcp32.exe
  2⤵
  PID:1468

C:\Windows\SysWOW64\Ajkgmd32.exe
C:\Windows\system32\Ajkgmd32.exe
1⤵
PID:4892
- C:\Windows\SysWOW64\Aljcip32.exe
  C:\Windows\system32\Aljcip32.exe
  2⤵
  PID:1132

C:\Windows\SysWOW64\Aklddmep.exe
C:\Windows\system32\Aklddmep.exe
1⤵
PID:4980
- C:\Windows\SysWOW64\Aaflag32.exe
  C:\Windows\system32\Aaflag32.exe
  2⤵
  PID:1784
- - C:\Windows\SysWOW64\Allpnplb.exe
    C:\Windows\system32\Allpnplb.exe
    3⤵
    PID:3508

C:\Windows\SysWOW64\Acfhkj32.exe
C:\Windows\system32\Acfhkj32.exe
1⤵
PID:2872
- C:\Windows\SysWOW64\Afddge32.exe
  C:\Windows\system32\Afddge32.exe
  2⤵
  PID:2580

C:\Windows\SysWOW64\Akffjkme.exe
C:\Windows\system32\Akffjkme.exe
1⤵
PID:5976

C:\Windows\SysWOW64\Bbpoge32.exe
C:\Windows\system32\Bbpoge32.exe
1⤵
PID:9092
- C:\Windows\SysWOW64\Bfkkhdlk.exe
  C:\Windows\system32\Bfkkhdlk.exe
  2⤵
  PID:6084

C:\Windows\SysWOW64\Bkhcpkkb.exe
C:\Windows\system32\Bkhcpkkb.exe
1⤵
PID:1796
- C:\Windows\SysWOW64\Bcokah32.exe
  C:\Windows\system32\Bcokah32.exe
  2⤵
  PID:3372

C:\Windows\SysWOW64\Bbgehd32.exe
C:\Windows\system32\Bbgehd32.exe
1⤵
PID:2536

C:\Windows\SysWOW64\Bhqmdoef.exe
C:\Windows\system32\Bhqmdoef.exe
1⤵
PID:5172
- C:\Windows\SysWOW64\Bkoiqjdj.exe
  C:\Windows\system32\Bkoiqjdj.exe
  2⤵
  PID:4908

C:\Windows\SysWOW64\Bbiamd32.exe
C:\Windows\system32\Bbiamd32.exe
1⤵
PID:5424

C:\Windows\SysWOW64\Combgh32.exe
C:\Windows\system32\Combgh32.exe
1⤵
PID:5584
- C:\Windows\SysWOW64\Cbkncd32.exe
  C:\Windows\system32\Cbkncd32.exe
  2⤵
  PID:5344

C:\Windows\SysWOW64\Ckhlgilp.exe
C:\Windows\system32\Ckhlgilp.exe
1⤵
PID:7684
- C:\Windows\SysWOW64\Ccpdhfmb.exe
  C:\Windows\system32\Ccpdhfmb.exe
  2⤵
  PID:6552
- - C:\Windows\SysWOW64\Dcdnce32.exe
    C:\Windows\system32\Dcdnce32.exe
    3⤵
    PID:6760
  - - C:\Windows\SysWOW64\Dbgnobpg.exe
      C:\Windows\system32\Dbgnobpg.exe
      4⤵
      PID:6220

C:\Windows\SysWOW64\Cijpkmml.exe
C:\Windows\system32\Cijpkmml.exe
1⤵
PID:7072

C:\Windows\SysWOW64\Cbphncfo.exe
C:\Windows\system32\Cbphncfo.exe
1⤵
PID:5720

C:\Windows\SysWOW64\Bmofkm32.exe
C:\Windows\system32\Bmofkm32.exe
1⤵
PID:6052

C:\Windows\SysWOW64\Dcgjie32.exe
C:\Windows\system32\Dcgjie32.exe
1⤵
PID:6672
- C:\Windows\SysWOW64\Dfefeq32.exe
  C:\Windows\system32\Dfefeq32.exe
  2⤵
  PID:6716
- - C:\Windows\SysWOW64\Dmooak32.exe
    C:\Windows\system32\Dmooak32.exe
    3⤵
    PID:8944

C:\Windows\SysWOW64\Dkbomgde.exe
C:\Windows\system32\Dkbomgde.exe
1⤵
PID:6216
- C:\Windows\SysWOW64\Dcigneeg.exe
  C:\Windows\system32\Dcigneeg.exe
  2⤵
  PID:4032
- - C:\Windows\SysWOW64\Dmakgj32.exe
    C:\Windows\system32\Dmakgj32.exe
    3⤵
    PID:7212
  - - C:\Windows\SysWOW64\Dpphcf32.exe
      C:\Windows\system32\Dpphcf32.exe
      4⤵
      PID:7632
    - - C:\Windows\SysWOW64\Djelqo32.exe
        
        C:\Windows\system32\Djelqo32.exe
        5⤵
        
        PID:7840

C:\Windows\SysWOW64\Dpbdiehi.exe
C:\Windows\system32\Dpbdiehi.exe
1⤵
PID:7584
- C:\Windows\SysWOW64\Dbqqeahl.exe
  C:\Windows\system32\Dbqqeahl.exe
  2⤵
  PID:7608
- - C:\Windows\SysWOW64\Eijiak32.exe
    C:\Windows\system32\Eijiak32.exe
    3⤵
    PID:8316

C:\Windows\SysWOW64\Elienf32.exe
C:\Windows\system32\Elienf32.exe
1⤵
PID:7400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bdojjo32.exe

Filesize
346KB

MD5
b434a459f0f3ae2bc2f2520e15dfc2ec

SHA1
ba5ffbeb65ee739dc0f39ceb27a2fa49433c61fe

SHA256
4cb33fcc9aa221f91770f6c63d13206fc0028b6bc8ef4f384901924cd5bfa98a

SHA512
1c861db40c1dbe3fbe2a97e9c2a884e793efb7146a2e2c1487909f964f45b0e99fcfd19b3ef1a6b2a6e110a7f0a8b21877bad5c9011694eb524dd400945f6b85

Download Submit
C:\Windows\SysWOW64\Bgpcliao.exe

Filesize
346KB

MD5
158fa31f1288766dbfaa95dbb592cb4b

SHA1
53f29f82fb5468c11095c1454aba771451638066

SHA256
ba7cb056827b106ef3fd8bd90de614731f7c0a2aef147d24901a7bcad09efb6a

SHA512
ad7f9d305403d7cf5470ca0e2fe6e49e16780ef114ff6606a6207aa844a690b183f57793fa25e5bf8820e65363d6271274ca71e07463af10f8b489c9cf3a3f23

Download Submit
C:\Windows\SysWOW64\Bobabg32.exe

Filesize
346KB

MD5
0073dc9a3621aede640623d4043ef514

SHA1
e978f8fabb63f532dfe6b5a9080d4065940a9215

SHA256
012daabc1743b58c58c0ff1b74df2df813e48cda1535d3e779497126930dd342

SHA512
19b74780f867c1357eecce3925a56a3f15b442974a817ba7662125e8a82e6f97cbe299eab28bde6ca6023c6a08507a0721b7c9b42f4a9b7a6b2c19909766d439

Download Submit
C:\Windows\SysWOW64\Boenhgdd.exe

Filesize
346KB

MD5
79586660fbcc4f103461123d10767ab2

SHA1
5f4d86fd150ecf1763ec4cca077a958b4b6cd045

SHA256
dc1996a7114295b31f4b09093ecce3bebdbacd29158254034008adc324bc5a4a

SHA512
84baccfe0a8dc5498b579c819a40239ddb31e8b07fa2c7a730c63eb7f77824ab1fd1098ee78861527f74a0f489a02563c02d21e9240c56da2303db3d9ed156ec

Download Submit
C:\Windows\SysWOW64\Bpfkpp32.exe

Filesize
346KB

MD5
acd20cfeb5f03ab552649caaecca9558

SHA1
e9829d671a0de4aefdca369c82fd67673aa8214b

SHA256
195fadc281f8b4cd09097a0d5e816c5320abcce707f9155f1472e04ec7865b3b

SHA512
408c40cf87505e3194efc749086b19871556e726dea5ff51f174f5940f8072fddd5dde63098d73967f3a12afd1695c16faed05a2a3ace0ebcc05423f1bf2e749

Download Submit
C:\Windows\SysWOW64\Dcdnce32.exe

Filesize
92KB

MD5
ceeff91ef386ffa4a07ff01af72380f0

SHA1
56c2a831a07165d065f3ede78f26a173e7b28b5c

SHA256
0a4d9a1bf6421e3eb72876b9b9cc3dec095d83e639f7de66577ed5e65fae4f78

SHA512
742355bc84d1ef2b44255227a36fcfae2a066d354d126f33d42cd4102c3cb40ebfb2e0dad0bfeb6acb70de3dce66427dab65bf3c570c161c60bf46b33627f6cd

Download Submit
C:\Windows\SysWOW64\Ekjded32.exe

Filesize
346KB

MD5
ceed2829b66508e86c077fcf091837a9

SHA1
4f4dbdef7132e63b55853066cd2bca2a15ad1724

SHA256
5320ce7c094439769d1bc8fa1e9fc9660042a2317e99fbc28d424f6b3d3d167d

SHA512
6ad559e2d9a7435fb21a76159d584269890cc291948e11e60233945b515e35b050be5d737476d9daa2654c07b5e5dc9f6aec195b25862a5513d57e8ec144533b

Download Submit
C:\Windows\SysWOW64\Fiqjke32.exe

Filesize
346KB

MD5
d33d92bb8cd08deeb7b65f634b22d229

SHA1
4ae02e508f90b6dbdab997044c6649b4a71047ea

SHA256
cf3bee7ccd11e7779ba68cb82add8d54705b1fc93dd84acede1b96644a5aab34

SHA512
f1423c1fb16482ed09d76f00d54c6e8285af71bb6ae402ed1cd1aa4b1da873c5cb4dad3c0ac303253fd31c170c147c92907f7ca31a24635987091a74af893b5b

Download Submit
C:\Windows\SysWOW64\Fkhpfbce.exe

Filesize
346KB

MD5
01d8fbe78674183ead9190958996d8a7

SHA1
a69e8879d116197371fe18f40efbedc8c76a0696

SHA256
4bc5d718ee0ea43ddf2bfe0a54c6767445095ac0f7addb3bea0586a6c109f388

SHA512
b6a2cb6a87497c6f586ffb2777838bc1ce26e35d807fbf40b11a4ca474529b3107bf5076d05d268e9139c567748e79e83abe32af8b6b8baaa3ccc695b04a9933

Download Submit
C:\Windows\SysWOW64\Hdaajd32.exe

Filesize
92KB

MD5
9c34b7166422588d3d572de48cfc50a7

SHA1
09031c54a92c00f758ad2194f3e79a9959f78e67

SHA256
d7bc053a453889a610f1a2bc293a49a95144304447eebe23298499ba9eb584eb

SHA512
3ac116678788f609c6ac878949a8dab0503da1bf2b55b398f4f2c331a42c8e6f7b02833961fd932622c4ee55b7b95930f959b6214f28ebbd3d681f8cca69c0e7

Download Submit
C:\Windows\SysWOW64\Hjimaole.exe

Filesize
346KB

MD5
fab42f79e8f9062dcdd93422a937be37

SHA1
0a50cd4793a72e8cd0b1cc18ab5dcc8556f89584

SHA256
4a37fcdd8dd66c2e9634a5cbdbff617390ed0e5be929ed7ff69e9a8a822fa479

SHA512
71706d1bfb6d332face97bd1e47df6c7cb7597ac22edae518debe56d88c9a7d17cacd84a430fd040bcaaf6003edc6b6e154085d5588e066429f02288cecb229f

Download Submit
C:\Windows\SysWOW64\Iamamcop.exe

Filesize
231KB

MD5
d4dcdd456c389103ff3a05fa65bdf664

SHA1
6142bceba4cd2f6cb374bbf1159c8ae5c200aa5b

SHA256
6559787a6ac24fa402b565aaddd6cd1e0abb23cb118957812504813f71f226dd

SHA512
e3c3df9c5641bfc14431c55b282b5e779d0e73bdf272e72cc7758516c8d39bb7caa9ee662714a9bef3126532649ca9669e57446dd2b887334edca73a29a30f04

Download Submit
C:\Windows\SysWOW64\Ifbbig32.exe

Filesize
346KB

MD5
56d53a262ec2515d8ca5952617e059ad

SHA1
3731fae30530b0ea4312029f736dc017f7c20f54

SHA256
1c99da70c6443d35cd59a758e8762d4e24d155af09d20a63930fdb4d515f52a2

SHA512
9943fbf3d53641387ccd49ea3308ddb328da11db9fce09eaf8ecefe285710b322315dbf16f8807805e11f650b0975225ce5393f5959f4f7830828a08aedc6b63

Download Submit
C:\Windows\SysWOW64\Ifdonfka.exe

Filesize
346KB

MD5
b154d6243befbc5d1d5aea0f30dd9a4f

SHA1
2c48c84bb03e1f005c02bc279485c7d134616ae0

SHA256
f948e98f7490d8e73c2425f79557d0c4eb10e79d7cf6cccf707bf7a93c4b27f9

SHA512
888d1601cef577e8a7a7edc8a05407d7e28a821a1bb671cfac1e5f2065f8f367dcab739dc2108d4fdff6f2752e1dc97e3fd52b57ce001de575f0ac4d57c59d62

Download Submit
C:\Windows\SysWOW64\Igfkfo32.exe

Filesize
346KB

MD5
4e53b1f906ae609d6eb2ccf79c6f929d

SHA1
499304aaf0f318d55d66d1d0cdd0f013c1361770

SHA256
edce7c7f4b658f4ef61fcdab247be5fb54904a4adcea1541bf503738a8022efe

SHA512
e0dc06e21a1d8cd22ba927084742d78278140c26234777addec33ff3d08f9fbf5227f17f9990b1da1b341aac4de1981ed66a4c149c340d6ac2b81410375762a1

Download Submit
C:\Windows\SysWOW64\Ihbponja.exe

Filesize
346KB

MD5
1befdfde550e8b7655f1170f10b11671

SHA1
90a400c8cd92c34e7fb873db0c81ddf5c786702c

SHA256
3fb7f357d7c80ff97ca02212d8becf7511c72e65d58c785139b0aef294a30a16

SHA512
641c00732afdfbe4f5843d5a76ca6ced37f92f905a9880df23ce9f84c95b03d9b1227c27ddc85b6855f33a35ab8bc8f03f6b86df30d6c84303bc573d417ed205

Download Submit
C:\Windows\SysWOW64\Jadgnb32.exe

Filesize
32KB

MD5
073da7dc8ead3350b4c65fdd1c568114

SHA1
b49b58876ef69f22cadc1dc0ebb1a9741940e5e4

SHA256
f641c07e881fe0723ce23e95c620b5562261e39178316feee3784c43a8ed487c

SHA512
e85a19a344532cf200c2b6ecab301ee8f39174e306e8484a9b25b72f271251c0bf355ebff903a896223805db5a60b80978f3aea580ee9d915b87fa9901258bf9

Download Submit
C:\Windows\SysWOW64\Joqafgni.exe

Filesize
92KB

MD5
31bf7c6ed8ced891866f2cd7157ceac9

SHA1
0ba78adaa0205aa851cbd8c204b13bf70b866578

SHA256
1f6350034ba7fbc7e3e27e40b3d5f9fcbf78f16f4a696e6609c9e6762df0c096

SHA512
df10e3ded22d450adff875e4fb121ad2b4c7a79e2313987326e452f7f47040b42606fb222495f60da3e2848d11a67eb0d1503a41015ccf7ec1001bea5af25bb9

Download Submit
C:\Windows\SysWOW64\Ljmmnf32.exe

Filesize
346KB

MD5
18da797489fd56029be23bf61ceed952

SHA1
95e590a0199a60a9efceaea66e1fc02ee4e438d6

SHA256
f0a19a1c6c432a3b53a2f7f6afaf64d72a3d29c77584fe4a333804e800e9ee10

SHA512
d290ed4f78c06000c16890a73a182f1f8b7e205fe85dbb31c197bc1ec9fcd9a953c05f9402fbc0224ae83d9e2e163f63a6b8cc219d7cbbd96eb31bcd0dab6c8f

Download Submit
C:\Windows\SysWOW64\Mndcnafd.exe

Filesize
346KB

MD5
5ddd297d4664b1c5281e2eebc622b545

SHA1
2e25609ee6eab6de0f70d38079228365ccb94495

SHA256
39785b6bc1d87f27d4066f6d5025eedb33620bc30ae97c7182f19272cdd4af4c

SHA512
40746b91223be10baf8f1e1c356aa4a2245fb2248da6338160bfa403302a42107fe18c39e44b4d4a1adc1ab372310cb66f7cbe37a518f912dc9ba28378401d77

Download Submit
C:\Windows\SysWOW64\Nocphd32.exe

Filesize
185KB

MD5
6f97079474444465c19e745365412546

SHA1
25341ac32937e516ff9e0b75380a4c7dbb045364

SHA256
2f18b5668b75804b7bd2e62c007bd88c5fafd8607795a9898cacf3e30cdd5220

SHA512
fb42acfd71034fbc964baee31087419fd3be014c9cbe05eeef3ca528c1dbd0a81f885478e748b02e65639aa45d969a7d7958b492014efda83c7216cbec4ed019

Download Submit
C:\Windows\SysWOW64\Nqnofkkj.exe

Filesize
42KB

MD5
54f4bcecd2e7d26380daf0aefc658ec8

SHA1
ef171339ea98283332acf34ffd242c18ebc23f84

SHA256
a49c003fcba65def29154a883237511f60138905800706af92a8f7d21b0b942a

SHA512
e6cbb76c8a62a9865fc1fba0b85ca43d8b44d6d986dc8f0d20dd4b966fc3c0901bb0b199eb2d90b7a39a20f85395021350d2092faaad86cee8ba0a7f4ec2f0f9

Download Submit
C:\Windows\SysWOW64\Oapllk32.exe

Filesize
122KB

MD5
f5d14fc68b775fcc5247f9bfdd30a8d0

SHA1
73cf5f7bb7f60ea429581eb97d02f0a45e1d2fe8

SHA256
f4d83b7a2b6886a8a418b39f3a91f34b7a184f2ec2ca2c7f9430947a391cfe28

SHA512
bdf39bf79474be496c00734c35137d4a9ffc01175189d1f714978aecc67df105d4606d5e78e855d861cdfc92072321066d08daa930558f935d8aa6bb73bb0587

Download Submit
C:\Windows\SysWOW64\Okhmnc32.exe

Filesize
48KB

MD5
d97f63743384870f2bea28180f3607d6

SHA1
1e002ace61e25d03128bc23fd0f3b7ddcdd7da89

SHA256
fe4da58dfb9ecff4fa895d7772daa6b5cb58255e57fc068b7a2054ff400a0b80

SHA512
3e9f6c3299559fa72c8a504be931704ce6159a859c95a1dbb9e2ee6b9d20ef713d366b248464c3f7e74c2c38a1eb5950c2adf61f5dc7789e4f4ca5bdaed8593f

Download Submit
C:\Windows\SysWOW64\Olmficce.exe

Filesize
32KB

MD5
1cf55f6093dd972d73e0e5592ec504c1

SHA1
ee5bbcee3192a2b003ce21fb6a2ad078b93e37da

SHA256
30f68cd15653aeb12563e27aab093552007779a3fecdbaa9288340d6ed216dec

SHA512
45cff05e22875514647f2cddec09f5fe3f6ec226046c559960b719777aa7ea0d34ef64cb63d6ce2ed1a3026c222482992b95350b4a1f0f4eab1e4518c6164f0b

Download Submit
memory/384-274-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/924-249-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/924-312-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1004-107-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1064-287-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1072-40-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1072-53-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1312-285-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1440-66-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1440-142-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1484-272-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1484-192-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1720-57-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1720-7-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1792-56-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1792-24-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1808-305-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1808-241-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2032-220-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2536-175-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2656-200-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2656-284-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2676-32-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2676-54-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2832-264-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2832-331-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2976-78-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2976-160-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3308-111-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3308-196-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3408-166-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3456-170-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3456-85-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3524-313-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3532-119-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3532-204-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3608-229-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3612-94-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3612-179-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3696-261-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3816-325-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3860-232-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3860-144-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4100-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4100-152-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4320-210-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4348-58-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4348-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4464-127-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4464-213-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4484-319-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4568-306-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4608-299-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4624-223-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4624-135-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4648-293-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4708-102-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4708-47-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4736-336-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4884-237-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4940-184-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4952-55-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4952-15-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4996-158-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads