670bcc5f9cd96eaad6bde96178d49eb3352d379eb902f3e32a90eb017ac747ec

Analysis

max time kernel
72s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 20:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8992bd8fa6a34b58073b53fef125a2d6.exe
Size 199KB
Sample240107-y5ncdsefb3
SHA256 670bcc5f9cd96eaad6bde96178d49eb3352d379eb902f3e32a90eb017ac747ec
MD5 8992bd8fa6a34b58073b53fef125a2d6
SHA1 7bbbcfe50d89e51b1d6e05ce80816e6ae2d8ef97
SHA512 2adcfa063db21badbcdced45828ad708b69b4e6b3f5eeaff8d6e4ef80dc50355e022e9c1ef2961de13ac99c5227817241fb1c6c0835483a57e5cb74762ec9bdd
SSDEEP 6144:o3L43f2CESZSCZj81+jq4peBK034YOmFz1h:+kb5ZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Moglpedd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndmgnkja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oacdmo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojnfihmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bpemkcck.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qkcackeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppgomnai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qomghp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oiqomj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omalpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oolnabal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbkcek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Moeoje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Najagp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eimelg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Faopah32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agobna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oblhcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Naokbokn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oojalb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohkijc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojqcnhkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oonlfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgejkh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omalpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ockdmmoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Philfgdh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bogkmgba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nglcjfie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhddgofo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bqkigp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckmmpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eejcki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eahjqicj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qdllffpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmeandma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhkfkmmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbhgoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Leqkeajd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmebpbod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oeffnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agcdnjcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckmmpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Noblkqca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaqejcep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbbkbbkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eimelg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Meljappg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnoiqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cigcjj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnfkgp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oogdfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohobebig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bqkigp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Engaon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndhgie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Naokbokn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaioidkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mehafq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Necqbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aocmio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aiqkmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abflfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohpiphlb.exe

Malware Dropper & Backdoor - Berbew 28 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x0007000000023235-8.dat	family_berbew
behavioral2/files/0x0007000000023235-7.dat	family_berbew
behavioral2/files/0x000600000002326e-225.dat	family_berbew
behavioral2/files/0x0006000000023271-234.dat	family_berbew
behavioral2/files/0x0009000000023152-241.dat	family_berbew
behavioral2/files/0x0006000000023274-249.dat	family_berbew
behavioral2/files/0x0006000000023278-260.dat	family_berbew
behavioral2/files/0x0006000000023276-257.dat	family_berbew
behavioral2/files/0x0006000000023290-331.dat	family_berbew
behavioral2/files/0x00060000000232a3-385.dat	family_berbew
behavioral2/files/0x00060000000232a7-397.dat	family_berbew
behavioral2/files/0x000600000002329b-361.dat	family_berbew
behavioral2/files/0x0006000000023298-348.dat	family_berbew
behavioral2/files/0x000600000002328c-319.dat	family_berbew
behavioral2/files/0x0006000000023276-256.dat	family_berbew
behavioral2/files/0x0006000000023274-248.dat	family_berbew
behavioral2/files/0x0009000000023152-240.dat	family_berbew
behavioral2/files/0x0006000000023271-232.dat	family_berbew
behavioral2/files/0x000600000002326e-224.dat	family_berbew
behavioral2/files/0x000600000002346c-1765.dat	family_berbew
behavioral2/files/0x00060000000234be-2025.dat	family_berbew
behavioral2/files/0x0006000000023498-1903.dat	family_berbew
behavioral2/files/0x0006000000023488-1852.dat	family_berbew
behavioral2/files/0x0006000000023501-2278.dat	family_berbew
behavioral2/files/0x0006000000023574-2588.dat	family_berbew
behavioral2/files/0x0006000000023570-2576.dat	family_berbew
behavioral2/files/0x0006000000023561-2531.dat	family_berbew
behavioral2/files/0x000600000002341c-1505.dat	family_berbew

Executes dropped EXE 64 IoCs

pid	Process
3216	Kfnfjehl.exe
2952	Kgnbdh32.exe
2904	Kngkqbgl.exe
3992	Pfkpiled.exe
1300	Ohpiphlb.exe
4964	Phneqf32.exe
1816	Mphamg32.exe
3472	Mjcngpjh.exe
1948	Nfjola32.exe
3444	Agobna32.exe
3844	Njmqnobn.exe
1844	Nceefd32.exe
2936	Ojomcopk.exe
4636	Oaifpi32.exe
2768	Ojdgnn32.exe
1620	Qdllffpo.exe
4180	Abgcqjhp.exe
3568	Ofmdio32.exe
1484	Aoapcood.exe
4192	Pmiikh32.exe
4300	Phonha32.exe
4200	Agmehamp.exe
3956	Ppjbmc32.exe
4988	Pfdjinjo.exe
2096	Pplobcpp.exe
3984	Phcgcqab.exe
2892	Pnmopk32.exe
3592	Oiqomj32.exe
368	Nibbklke.exe
1676	Ppahmb32.exe
3612	Qfkqjmdg.exe
1848	Lpgalc32.exe
2908	Qhjmdp32.exe
4260	Qmgelf32.exe
3548	Ahmjjoig.exe
3996	Ndhgie32.exe
4576	Adcjop32.exe
4452	Pnenchoc.exe
1796	Agimkk32.exe
1156	Amcehdod.exe
788	Bmeandma.exe
556	Bpdnjple.exe
4856	Bhkfkmmg.exe
4676	Bkibgh32.exe
3772	Odhppclh.exe
1416	Okiefn32.exe
1388	Bogkmgba.exe
1496	Baegibae.exe
3492	Ohdlpa32.exe
1004	Bknlbhhe.exe
5148	Bahdob32.exe
5188	Bhblllfo.exe
5228	Bkphhgfc.exe
5272	Bajqda32.exe
5312	Opfnne32.exe
5352	Conanfli.exe
5436	Cammjakm.exe
5472	Qajlje32.exe
5512	Nhegig32.exe
5556	Nqmojd32.exe
5596	Oickbjmb.exe
5644	Phmnfp32.exe
5684	Oajccgmd.exe
5724	Nmcpoedn.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Medglemj.exe	Pmmlla32.exe
File created	C:\Windows\SysWOW64\Ohbaonna.dll	Pfmlok32.exe
File created	C:\Windows\SysWOW64\Gfjofpjj.dll	Omgabj32.exe
File opened for modification	C:\Windows\SysWOW64\Agimkk32.exe	Pnenchoc.exe
File created	C:\Windows\SysWOW64\Gejimf32.dll	Oblhcj32.exe
File created	C:\Windows\SysWOW64\Hpjonehk.dll	Pkedbmab.exe
File opened for modification	C:\Windows\SysWOW64\Ldhdlnli.exe	Lmlpjdgo.exe
File created	C:\Windows\SysWOW64\Honhbgej.dll	Mehafq32.exe
File created	C:\Windows\SysWOW64\Folkjnbc.exe	Eahjqicj.exe
File created	C:\Windows\SysWOW64\Negpqn32.dll	Nkpijfgf.exe
File created	C:\Windows\SysWOW64\Ledioi32.dll	Qbmpjkqk.exe
File created	C:\Windows\SysWOW64\Jnkqlk32.dll	Bdlncn32.exe
File opened for modification	C:\Windows\SysWOW64\Nolekd32.exe	Nkpijfgf.exe
File created	C:\Windows\SysWOW64\Clclnfln.dll	Ogdofo32.exe
File created	C:\Windows\SysWOW64\Qjcdih32.exe	Qhbhapha.exe
File created	C:\Windows\SysWOW64\Obqhpfck.dll	Mphamg32.exe
File created	C:\Windows\SysWOW64\Ojqcnhkl.exe	Objkmkjj.exe
File created	C:\Windows\SysWOW64\Kaioidkh.exe	Knkcmild.exe
File opened for modification	C:\Windows\SysWOW64\Kallod32.exe	Kaioidkh.exe
File created	C:\Windows\SysWOW64\Adcjop32.exe	Ndhgie32.exe
File created	C:\Windows\SysWOW64\Hkglgq32.dll	Pmmlla32.exe
File opened for modification	C:\Windows\SysWOW64\Pgeogb32.exe	Pdgckg32.exe
File opened for modification	C:\Windows\SysWOW64\Aoapcood.exe	Agjhbbob.exe
File created	C:\Windows\SysWOW64\Ehhpge32.exe	Eejcki32.exe
File created	C:\Windows\SysWOW64\Olhacdgi.dll	Ohdlpa32.exe
File created	C:\Windows\SysWOW64\Dafhdj32.dll	Pkgaglpp.exe
File created	C:\Windows\SysWOW64\Phmnfp32.exe	Pdbbfadn.exe
File created	C:\Windows\SysWOW64\Alnjhe32.dll	Bkjpkg32.exe
File created	C:\Windows\SysWOW64\Agimkk32.exe	Pnenchoc.exe
File created	C:\Windows\SysWOW64\Nkjlqd32.exe	Nnfkgp32.exe
File opened for modification	C:\Windows\SysWOW64\Bdlncn32.exe	Bbmbgb32.exe
File created	C:\Windows\SysWOW64\Phbcfe32.dll	Cgejkh32.exe
File opened for modification	C:\Windows\SysWOW64\Odhppclh.exe	Oajccgmd.exe
File created	C:\Windows\SysWOW64\Pelkha32.dll	Kejeebpl.exe
File created	C:\Windows\SysWOW64\Kaqejcep.exe	Kjfmminc.exe
File opened for modification	C:\Windows\SysWOW64\Lhogamih.exe	Leqkeajd.exe
File opened for modification	C:\Windows\SysWOW64\Ohbfeh32.exe	Oediim32.exe
File opened for modification	C:\Windows\SysWOW64\Pdgckg32.exe	Pfdbpjmi.exe
File created	C:\Windows\SysWOW64\Qjeaog32.exe	Qkcackeb.exe
File created	C:\Windows\SysWOW64\Eimelg32.exe	Engaon32.exe
File opened for modification	C:\Windows\SysWOW64\Phcgcqab.exe	Pplobcpp.exe
File opened for modification	C:\Windows\SysWOW64\Bkibgh32.exe	Bhkfkmmg.exe
File created	C:\Windows\SysWOW64\Ocnabm32.exe	Oihmedma.exe
File created	C:\Windows\SysWOW64\Lhogamih.exe	Leqkeajd.exe
File created	C:\Windows\SysWOW64\Plhllf32.dll	Pgbkgmao.exe
File created	C:\Windows\SysWOW64\Ikpnha32.dll	Kdjhkp32.exe
File opened for modification	C:\Windows\SysWOW64\Khhaanop.exe	Kejeebpl.exe
File opened for modification	C:\Windows\SysWOW64\Nnfkgp32.exe	Nglcjfie.exe
File created	C:\Windows\SysWOW64\Pcpnhl32.exe	Aqpika32.exe
File created	C:\Windows\SysWOW64\Bncpjk32.dll	Pfkpiled.exe
File created	C:\Windows\SysWOW64\Efnieaef.dll	Addhbo32.exe
File created	C:\Windows\SysWOW64\Idqogkic.dll	Cgcmeh32.exe
File created	C:\Windows\SysWOW64\Jdoadlje.dll	Fehplggn.exe
File opened for modification	C:\Windows\SysWOW64\Bgpcliao.exe	Odhppclh.exe
File created	C:\Windows\SysWOW64\Egjmiege.dll	Mgpcohcb.exe
File created	C:\Windows\SysWOW64\Aoapcood.exe	Agjhbbob.exe
File opened for modification	C:\Windows\SysWOW64\Pkinmlnm.exe	Ppdjpcng.exe
File opened for modification	C:\Windows\SysWOW64\Abdoqd32.exe	Akjgdjoj.exe
File opened for modification	C:\Windows\SysWOW64\Akopoi32.exe	Agcdnjcl.exe
File created	C:\Windows\SysWOW64\Occmjg32.dll	Pnmopk32.exe
File opened for modification	C:\Windows\SysWOW64\Ppahmb32.exe	Nibbklke.exe
File opened for modification	C:\Windows\SysWOW64\Oihmedma.exe	Ofjqihnn.exe
File opened for modification	C:\Windows\SysWOW64\Kaioidkh.exe	Knkcmild.exe
File created	C:\Windows\SysWOW64\Oogdfc32.exe	Ohnljine.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9652	9556	WerFault.exe	491

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfkpiled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbfjfc32.dll"	Oojalb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfdbpjmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgeogb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glkfdino.dll"	Qbkcek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfjofpjj.dll"	Omgabj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pkgaglpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idqogkic.dll"	Cgcmeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acphqk32.dll"	Dbphcpog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbphcpog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Conanfli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfnafolo.dll"	Mkgfdgpq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qbkcek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfloio32.dll"	Onqdhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlaakbkm.dll"	Pahpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkamdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Knkcmild.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofhcdlgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdmikb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkinmlnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfgomdnj.dll"	Ndhgie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Moeoje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogpfko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcllmi32.dll"	Okiefn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgejkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jponoqjl.dll"	Agmehamp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldhdlnli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pahpee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbmbgb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djipbbne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifoopi32.dll"	Adqeaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljdjpm32.dll"	Oinbgk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pafcofcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odhppclh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kfdklllb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oacdmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oalpigkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eeomfioh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oiccje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocnabm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmhbqbae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dddmqp32.dll"	Nahdapae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Abbiej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odfcjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Medglemj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkhhbbck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maghkogk.dll"	Qghlmbae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pncanhaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plhllf32.dll"	Pgbkgmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aklciimh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnoiqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Elaobdmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Baegibae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcflag32.dll"	Mgngih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjpmae32.dll"	Qomghp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ophjdehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knemellp.dll"	Pkinmlnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bilcol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohpiphlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aepjgm32.dll"	Nceefd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lpgalc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghcfpl32.dll"	Qajlje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qghlmbae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akjgdjoj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 3216	4660	8992bd8fa6a34b58073b53fef125a2d6.exe	24
PID 4660 wrote to memory of 3216	4660	8992bd8fa6a34b58073b53fef125a2d6.exe	24
PID 4660 wrote to memory of 3216	4660	8992bd8fa6a34b58073b53fef125a2d6.exe	24
PID 3216 wrote to memory of 2952	3216	Kfnfjehl.exe	25
PID 3216 wrote to memory of 2952	3216	Kfnfjehl.exe	25
PID 3216 wrote to memory of 2952	3216	Kfnfjehl.exe	25
PID 2952 wrote to memory of 2904	2952	Kgnbdh32.exe	33
PID 2952 wrote to memory of 2904	2952	Kgnbdh32.exe	33
PID 2952 wrote to memory of 2904	2952	Kgnbdh32.exe	33
PID 2904 wrote to memory of 3992	2904	Kngkqbgl.exe	286
PID 2904 wrote to memory of 3992	2904	Kngkqbgl.exe	286
PID 2904 wrote to memory of 3992	2904	Kngkqbgl.exe	286
PID 3992 wrote to memory of 1300	3992	Pfkpiled.exe	290
PID 3992 wrote to memory of 1300	3992	Pfkpiled.exe	290
PID 3992 wrote to memory of 1300	3992	Pfkpiled.exe	290
PID 1300 wrote to memory of 4964	1300	Ohpiphlb.exe	283
PID 1300 wrote to memory of 4964	1300	Ohpiphlb.exe	283
PID 1300 wrote to memory of 4964	1300	Ohpiphlb.exe	283
PID 4964 wrote to memory of 1816	4964	Phneqf32.exe	300
PID 4964 wrote to memory of 1816	4964	Phneqf32.exe	300
PID 4964 wrote to memory of 1816	4964	Phneqf32.exe	300
PID 1816 wrote to memory of 3472	1816	Mphamg32.exe	38
PID 1816 wrote to memory of 3472	1816	Mphamg32.exe	38
PID 1816 wrote to memory of 3472	1816	Mphamg32.exe	38
PID 3472 wrote to memory of 1948	3472	Mjcngpjh.exe	89
PID 3472 wrote to memory of 1948	3472	Mjcngpjh.exe	89
PID 3472 wrote to memory of 1948	3472	Mjcngpjh.exe	89
PID 1948 wrote to memory of 3444	1948	Nfjola32.exe	271
PID 1948 wrote to memory of 3444	1948	Nfjola32.exe	271
PID 1948 wrote to memory of 3444	1948	Nfjola32.exe	271
PID 3444 wrote to memory of 3844	3444	Agobna32.exe	86
PID 3444 wrote to memory of 3844	3444	Agobna32.exe	86
PID 3444 wrote to memory of 3844	3444	Agobna32.exe	86
PID 3844 wrote to memory of 1844	3844	Njmqnobn.exe	85
PID 3844 wrote to memory of 1844	3844	Njmqnobn.exe	85
PID 3844 wrote to memory of 1844	3844	Njmqnobn.exe	85
PID 1844 wrote to memory of 2936	1844	Nceefd32.exe	41
PID 1844 wrote to memory of 2936	1844	Nceefd32.exe	41
PID 1844 wrote to memory of 2936	1844	Nceefd32.exe	41
PID 2936 wrote to memory of 4636	2936	Ojomcopk.exe	42
PID 2936 wrote to memory of 4636	2936	Ojomcopk.exe	42
PID 2936 wrote to memory of 4636	2936	Ojomcopk.exe	42
PID 4636 wrote to memory of 2768	4636	Oaifpi32.exe	84
PID 4636 wrote to memory of 2768	4636	Oaifpi32.exe	84
PID 4636 wrote to memory of 2768	4636	Oaifpi32.exe	84
PID 2768 wrote to memory of 1620	2768	Ojdgnn32.exe	277
PID 2768 wrote to memory of 1620	2768	Ojdgnn32.exe	277
PID 2768 wrote to memory of 1620	2768	Ojdgnn32.exe	277
PID 1620 wrote to memory of 4180	1620	Qdllffpo.exe	270
PID 1620 wrote to memory of 4180	1620	Qdllffpo.exe	270
PID 1620 wrote to memory of 4180	1620	Qdllffpo.exe	270
PID 4180 wrote to memory of 3568	4180	Abgcqjhp.exe	81
PID 4180 wrote to memory of 3568	4180	Abgcqjhp.exe	81
PID 4180 wrote to memory of 3568	4180	Abgcqjhp.exe	81
PID 3568 wrote to memory of 1484	3568	Ofmdio32.exe	275
PID 3568 wrote to memory of 1484	3568	Ofmdio32.exe	275
PID 3568 wrote to memory of 1484	3568	Ofmdio32.exe	275
PID 1484 wrote to memory of 4192	1484	Aoapcood.exe	80
PID 1484 wrote to memory of 4192	1484	Aoapcood.exe	80
PID 1484 wrote to memory of 4192	1484	Aoapcood.exe	80
PID 4192 wrote to memory of 4300	4192	Pmiikh32.exe	44
PID 4192 wrote to memory of 4300	4192	Pmiikh32.exe	44
PID 4192 wrote to memory of 4300	4192	Pmiikh32.exe	44
PID 4300 wrote to memory of 4200	4300	Phonha32.exe	263

C:\Users\Admin\AppData\Local\Temp\8992bd8fa6a34b58073b53fef125a2d6.exe
"C:\Users\Admin\AppData\Local\Temp\8992bd8fa6a34b58073b53fef125a2d6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4660
- C:\Windows\SysWOW64\Kfnfjehl.exe
  C:\Windows\system32\Kfnfjehl.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3216
- - C:\Windows\SysWOW64\Kgnbdh32.exe
    C:\Windows\system32\Kgnbdh32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\Windows\SysWOW64\Kngkqbgl.exe
      C:\Windows\system32\Kngkqbgl.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2904

C:\Windows\SysWOW64\Lnoaaaad.exe
C:\Windows\system32\Lnoaaaad.exe
1⤵
PID:3992
- C:\Windows\SysWOW64\Lopmii32.exe
  C:\Windows\system32\Lopmii32.exe
  2⤵
  PID:1300
- - C:\Windows\SysWOW64\Modgdicm.exe
    C:\Windows\system32\Modgdicm.exe
    3⤵
    PID:4964
  - - C:\Windows\SysWOW64\Mqfpckhm.exe
      C:\Windows\system32\Mqfpckhm.exe
      4⤵
      PID:1816
    - - C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3472
      - C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1948
  - - C:\Windows\SysWOW64\Pfdbpjmi.exe
      C:\Windows\system32\Pfdbpjmi.exe
      4⤵
      Drops file in System32 directory
      Modifies registry class
      PID:6340
- - C:\Windows\SysWOW64\Ogcike32.exe
    C:\Windows\system32\Ogcike32.exe
    3⤵
    PID:7032
  - - C:\Windows\SysWOW64\Oojalb32.exe
      C:\Windows\system32\Oojalb32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Modifies registry class
      PID:3868
- C:\Windows\SysWOW64\Philfgdh.exe
  C:\Windows\system32\Philfgdh.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:6784
- - C:\Windows\SysWOW64\Pkhhbbck.exe
    C:\Windows\system32\Pkhhbbck.exe
    3⤵
    - Modifies registry class
    PID:6888

C:\Windows\SysWOW64\Ojomcopk.exe
C:\Windows\system32\Ojomcopk.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\Oaifpi32.exe
  C:\Windows\system32\Oaifpi32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\Ojdgnn32.exe
    C:\Windows\system32\Ojdgnn32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2768

C:\Windows\SysWOW64\Ohlqcagj.exe
C:\Windows\system32\Ohlqcagj.exe
1⤵
PID:1484
- C:\Windows\SysWOW64\Pmiikh32.exe
  C:\Windows\system32\Pmiikh32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4192
- C:\Windows\SysWOW64\Adnilfnl.exe
  C:\Windows\system32\Adnilfnl.exe
  2⤵
  PID:1116

C:\Windows\SysWOW64\Phonha32.exe
C:\Windows\system32\Phonha32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\Pjmjdm32.exe
  C:\Windows\system32\Pjmjdm32.exe
  2⤵
  PID:4200

C:\Windows\SysWOW64\Pfdjinjo.exe
C:\Windows\system32\Pfdjinjo.exe
1⤵
- Executes dropped EXE
PID:4988
- C:\Windows\SysWOW64\Pplobcpp.exe
  C:\Windows\system32\Pplobcpp.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2096
- - C:\Windows\SysWOW64\Phcgcqab.exe
    C:\Windows\system32\Phcgcqab.exe
    3⤵
    - Executes dropped EXE
    PID:3984
  - - C:\Windows\SysWOW64\Pnmopk32.exe
      C:\Windows\system32\Pnmopk32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      PID:2892

C:\Windows\SysWOW64\Ppolhcnm.exe
C:\Windows\system32\Ppolhcnm.exe
1⤵
PID:3592
- C:\Windows\SysWOW64\Pjdpelnc.exe
  C:\Windows\system32\Pjdpelnc.exe
  2⤵
  PID:368

C:\Windows\SysWOW64\Amjbbfgo.exe
C:\Windows\system32\Amjbbfgo.exe
1⤵
PID:3996
- C:\Windows\SysWOW64\Adcjop32.exe
  C:\Windows\system32\Adcjop32.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- - C:\Windows\SysWOW64\Aknbkjfh.exe
    C:\Windows\system32\Aknbkjfh.exe
    3⤵
    PID:4452

C:\Windows\SysWOW64\Ahmjjoig.exe
C:\Windows\system32\Ahmjjoig.exe
1⤵
- Executes dropped EXE
PID:3548

C:\Windows\SysWOW64\Qmgelf32.exe
C:\Windows\system32\Qmgelf32.exe
1⤵
- Executes dropped EXE
PID:4260

C:\Windows\SysWOW64\Qhjmdp32.exe
C:\Windows\system32\Qhjmdp32.exe
1⤵
- Executes dropped EXE
PID:2908

C:\Windows\SysWOW64\Agimkk32.exe
C:\Windows\system32\Agimkk32.exe
1⤵
- Executes dropped EXE
PID:1796
- C:\Windows\SysWOW64\Amcehdod.exe
  C:\Windows\system32\Amcehdod.exe
  2⤵
  - Executes dropped EXE
  PID:1156

C:\Windows\SysWOW64\Bpdnjple.exe
C:\Windows\system32\Bpdnjple.exe
1⤵
- Executes dropped EXE
PID:556
- C:\Windows\SysWOW64\Bhkfkmmg.exe
  C:\Windows\system32\Bhkfkmmg.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:4856

C:\Windows\SysWOW64\Bkibgh32.exe
C:\Windows\system32\Bkibgh32.exe
1⤵
- Executes dropped EXE
PID:4676
- C:\Windows\SysWOW64\Bmhocd32.exe
  C:\Windows\system32\Bmhocd32.exe
  2⤵
  PID:3772
- - C:\Windows\SysWOW64\Bgpcliao.exe
    C:\Windows\system32\Bgpcliao.exe
    3⤵
    PID:1416
  - - C:\Windows\SysWOW64\Omgabj32.exe
      C:\Windows\system32\Omgabj32.exe
      4⤵
      Drops file in System32 directory
      Modifies registry class
      PID:5204
- - C:\Windows\SysWOW64\Ohdlpa32.exe
    C:\Windows\system32\Ohdlpa32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:3492

C:\Windows\SysWOW64\Bogkmgba.exe
C:\Windows\system32\Bogkmgba.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1388
- C:\Windows\SysWOW64\Baegibae.exe
  C:\Windows\system32\Baegibae.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:1496
- - C:\Windows\SysWOW64\Bhpofl32.exe
    C:\Windows\system32\Bhpofl32.exe
    3⤵
    PID:3492
  - - C:\Windows\SysWOW64\Bknlbhhe.exe
      C:\Windows\system32\Bknlbhhe.exe
      4⤵
      Executes dropped EXE
      PID:1004
    - - C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        5⤵
        Executes dropped EXE
        
        PID:5148
      - C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        6⤵
        Executes dropped EXE
        
        PID:5188
  - - C:\Windows\SysWOW64\Okbhlm32.exe
      C:\Windows\system32\Okbhlm32.exe
      4⤵
      PID:5316

C:\Windows\SysWOW64\Bkphhgfc.exe
C:\Windows\system32\Bkphhgfc.exe
1⤵
- Executes dropped EXE
PID:5228
- C:\Windows\SysWOW64\Bajqda32.exe
  C:\Windows\system32\Bajqda32.exe
  2⤵
  - Executes dropped EXE
  PID:5272
- - C:\Windows\SysWOW64\Cggimh32.exe
    C:\Windows\system32\Cggimh32.exe
    3⤵
    PID:5312
  - - C:\Windows\SysWOW64\Ogpfko32.exe
      C:\Windows\system32\Ogpfko32.exe
      4⤵
      Modifies registry class
      PID:3652
    - - C:\Windows\SysWOW64\Oinbgk32.exe
        
        C:\Windows\system32\Oinbgk32.exe
        5⤵
        Modifies registry class
        
        PID:2156

C:\Windows\SysWOW64\Conanfli.exe
C:\Windows\system32\Conanfli.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:5352
- C:\Windows\SysWOW64\Cammjakm.exe
  C:\Windows\system32\Cammjakm.exe
  2⤵
  - Executes dropped EXE
  PID:5436
- - C:\Windows\SysWOW64\Nblolm32.exe
    C:\Windows\system32\Nblolm32.exe
    3⤵
    PID:5472
  - - C:\Windows\SysWOW64\Nhegig32.exe
      C:\Windows\system32\Nhegig32.exe
      4⤵
      Executes dropped EXE
      PID:5512

C:\Windows\SysWOW64\Bmeandma.exe
C:\Windows\system32\Bmeandma.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:788

C:\Windows\SysWOW64\Qaqegecm.exe
C:\Windows\system32\Qaqegecm.exe
1⤵
PID:1848

C:\Windows\SysWOW64\Qfkqjmdg.exe
C:\Windows\system32\Qfkqjmdg.exe
1⤵
- Executes dropped EXE
PID:3612

C:\Windows\SysWOW64\Ppahmb32.exe
C:\Windows\system32\Ppahmb32.exe
1⤵
- Executes dropped EXE
PID:1676

C:\Windows\SysWOW64\Ppjbmc32.exe
C:\Windows\system32\Ppjbmc32.exe
1⤵
- Executes dropped EXE
PID:3956

C:\Windows\SysWOW64\Ofmdio32.exe
C:\Windows\system32\Ofmdio32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568

C:\Windows\SysWOW64\Opclldhj.exe
C:\Windows\system32\Opclldhj.exe
1⤵
PID:4180
- C:\Windows\SysWOW64\Afboah32.exe
  C:\Windows\system32\Afboah32.exe
  2⤵
  PID:6388

C:\Windows\SysWOW64\Oghghb32.exe
C:\Windows\system32\Oghghb32.exe
1⤵
PID:1620
- C:\Windows\SysWOW64\Agjhbbob.exe
  C:\Windows\system32\Agjhbbob.exe
  2⤵
  - Drops file in System32 directory
  PID:6180

C:\Windows\SysWOW64\Nceefd32.exe
C:\Windows\system32\Nceefd32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\SysWOW64\Njmqnobn.exe
C:\Windows\system32\Njmqnobn.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844

C:\Windows\SysWOW64\Ngndaccj.exe
C:\Windows\system32\Ngndaccj.exe
1⤵
PID:3444
- C:\Windows\SysWOW64\Abgcqjhp.exe
  C:\Windows\system32\Abgcqjhp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4180

C:\Windows\SysWOW64\Nqmojd32.exe
C:\Windows\system32\Nqmojd32.exe
1⤵
- Executes dropped EXE
PID:5556
- C:\Windows\SysWOW64\Nckkfp32.exe
  C:\Windows\system32\Nckkfp32.exe
  2⤵
  PID:5596
- - C:\Windows\SysWOW64\Oajccgmd.exe
    C:\Windows\system32\Oajccgmd.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:5684

C:\Windows\SysWOW64\Njedbjej.exe
C:\Windows\system32\Njedbjej.exe
1⤵
PID:5684
- C:\Windows\SysWOW64\Nmcpoedn.exe
  C:\Windows\system32\Nmcpoedn.exe
  2⤵
  - Executes dropped EXE
  PID:5724
- - C:\Windows\SysWOW64\Noblkqca.exe
    C:\Windows\system32\Noblkqca.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:5768
- C:\Windows\SysWOW64\Odhppclh.exe
  C:\Windows\system32\Odhppclh.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  PID:3772

C:\Windows\SysWOW64\Nbphglbe.exe
C:\Windows\system32\Nbphglbe.exe
1⤵
PID:5808
- C:\Windows\SysWOW64\Nijqcf32.exe
  C:\Windows\system32\Nijqcf32.exe
  2⤵
  PID:5852
- - C:\Windows\SysWOW64\Nodiqp32.exe
    C:\Windows\system32\Nodiqp32.exe
    3⤵
    PID:5904

C:\Windows\SysWOW64\Nfihbk32.exe
C:\Windows\system32\Nfihbk32.exe
1⤵
PID:5644
- C:\Windows\SysWOW64\Pjoknhbe.exe
  C:\Windows\system32\Pjoknhbe.exe
  2⤵
  PID:5772

C:\Windows\SysWOW64\Ojnfihmo.exe
C:\Windows\system32\Ojnfihmo.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5940
- C:\Windows\SysWOW64\Ommceclc.exe
  C:\Windows\system32\Ommceclc.exe
  2⤵
  PID:6000
- - C:\Windows\SysWOW64\Objkmkjj.exe
    C:\Windows\system32\Objkmkjj.exe
    3⤵
    - Drops file in System32 directory
    PID:6064

C:\Windows\SysWOW64\Ojqcnhkl.exe
C:\Windows\system32\Ojqcnhkl.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6104
- C:\Windows\SysWOW64\Oiccje32.exe
  C:\Windows\system32\Oiccje32.exe
  2⤵
  - Modifies registry class
  PID:5132

C:\Windows\SysWOW64\Oonlfo32.exe
C:\Windows\system32\Oonlfo32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5240
- C:\Windows\SysWOW64\Oblhcj32.exe
  C:\Windows\system32\Oblhcj32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  PID:2480
- - C:\Windows\SysWOW64\Ofgdcipq.exe
    C:\Windows\system32\Ofgdcipq.exe
    3⤵
    PID:5344
  - - C:\Windows\SysWOW64\Omalpc32.exe
      C:\Windows\system32\Omalpc32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:5368

C:\Windows\SysWOW64\Oophlo32.exe
C:\Windows\system32\Oophlo32.exe
1⤵
PID:5208
- C:\Windows\SysWOW64\Ockdmmoj.exe
  C:\Windows\system32\Ockdmmoj.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:5256
- - C:\Windows\SysWOW64\Ofjqihnn.exe
    C:\Windows\system32\Ofjqihnn.exe
    3⤵
    - Drops file in System32 directory
    PID:1456

C:\Windows\SysWOW64\Oihmedma.exe
C:\Windows\system32\Oihmedma.exe
1⤵
- Drops file in System32 directory
PID:5444
- C:\Windows\SysWOW64\Ocnabm32.exe
  C:\Windows\system32\Ocnabm32.exe
  2⤵
  - Modifies registry class
  PID:5536
- - C:\Windows\SysWOW64\Ojhiogdd.exe
    C:\Windows\system32\Ojhiogdd.exe
    3⤵
    PID:5632

C:\Windows\SysWOW64\Omfekbdh.exe
C:\Windows\system32\Omfekbdh.exe
1⤵
PID:5704
- C:\Windows\SysWOW64\Ppdbgncl.exe
  C:\Windows\system32\Ppdbgncl.exe
  2⤵
  PID:5804
- - C:\Windows\SysWOW64\Pcpnhl32.exe
    C:\Windows\system32\Pcpnhl32.exe
    3⤵
    PID:5884
  - - C:\Windows\SysWOW64\Pjjfdfbb.exe
      C:\Windows\system32\Pjjfdfbb.exe
      4⤵
      PID:5980
    - - C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        5⤵
        Modifies registry class
        
        PID:6076
- - C:\Windows\SysWOW64\Adkelplc.exe
    C:\Windows\system32\Adkelplc.exe
    3⤵
    PID:5676
  - - C:\Windows\SysWOW64\Akenij32.exe
      C:\Windows\system32\Akenij32.exe
      4⤵
      PID:2000

C:\Windows\SysWOW64\Ppgomnai.exe
C:\Windows\system32\Ppgomnai.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6128
- C:\Windows\SysWOW64\Pbekii32.exe
  C:\Windows\system32\Pbekii32.exe
  2⤵
  PID:2320

C:\Windows\SysWOW64\Pjlcjf32.exe
C:\Windows\system32\Pjlcjf32.exe
1⤵
PID:4248
- C:\Windows\SysWOW64\Pmkofa32.exe
  C:\Windows\system32\Pmkofa32.exe
  2⤵
  PID:3376
- - C:\Windows\SysWOW64\Ppikbm32.exe
    C:\Windows\system32\Ppikbm32.exe
    3⤵
    PID:3388

C:\Windows\SysWOW64\Pbhgoh32.exe
C:\Windows\system32\Pbhgoh32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5460
- C:\Windows\SysWOW64\Pmmlla32.exe
  C:\Windows\system32\Pmmlla32.exe
  2⤵
  - Drops file in System32 directory
  PID:5932

C:\Windows\SysWOW64\Medglemj.exe
C:\Windows\system32\Medglemj.exe
1⤵
- Modifies registry class
PID:6116
- C:\Windows\SysWOW64\Nlnpio32.exe
  C:\Windows\system32\Nlnpio32.exe
  2⤵
  PID:5328
- - C:\Windows\SysWOW64\Bpemkcck.exe
    C:\Windows\system32\Bpemkcck.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:116
  - - C:\Windows\SysWOW64\Eennefib.exe
      C:\Windows\system32\Eennefib.exe
      4⤵
      PID:3204
    - - C:\Windows\SysWOW64\Emeffcid.exe
        
        C:\Windows\system32\Emeffcid.exe
        5⤵
        
        PID:4860
      - C:\Windows\SysWOW64\Jepbodhg.exe
        
        C:\Windows\system32\Jepbodhg.exe
        6⤵
        
        PID:5712

C:\Windows\SysWOW64\Khonkogj.exe
C:\Windows\system32\Khonkogj.exe
1⤵
PID:5716
- C:\Windows\SysWOW64\Knifging.exe
  C:\Windows\system32\Knifging.exe
  2⤵
  PID:5752

C:\Windows\SysWOW64\Kagbdenk.exe
C:\Windows\system32\Kagbdenk.exe
1⤵
PID:6112
- C:\Windows\SysWOW64\Kceoppmo.exe
  C:\Windows\system32\Kceoppmo.exe
  2⤵
  PID:3756
- - C:\Windows\SysWOW64\Kfdklllb.exe
    C:\Windows\system32\Kfdklllb.exe
    3⤵
    - Modifies registry class
    PID:5612

C:\Windows\SysWOW64\Knkcmild.exe
C:\Windows\system32\Knkcmild.exe
1⤵
- Drops file in System32 directory
- Modifies registry class
PID:4784
- C:\Windows\SysWOW64\Kaioidkh.exe
  C:\Windows\system32\Kaioidkh.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  PID:5868
- - C:\Windows\SysWOW64\Kallod32.exe
    C:\Windows\system32\Kallod32.exe
    3⤵
    PID:3220
  - - C:\Windows\SysWOW64\Kdjhkp32.exe
      C:\Windows\system32\Kdjhkp32.exe
      4⤵
      Drops file in System32 directory
      PID:3180
    - - C:\Windows\SysWOW64\Kjdqhjpf.exe
        
        C:\Windows\system32\Kjdqhjpf.exe
        5⤵
        
        PID:5236
      - C:\Windows\SysWOW64\Kanidd32.exe
        
        C:\Windows\system32\Kanidd32.exe
        6⤵
        
        PID:4648

C:\Windows\SysWOW64\Kejeebpl.exe
C:\Windows\system32\Kejeebpl.exe
1⤵
- Drops file in System32 directory
PID:1372
- C:\Windows\SysWOW64\Khhaanop.exe
  C:\Windows\system32\Khhaanop.exe
  2⤵
  PID:948

C:\Windows\SysWOW64\Kjfmminc.exe
C:\Windows\system32\Kjfmminc.exe
1⤵
- Drops file in System32 directory
PID:5548
- C:\Windows\SysWOW64\Kaqejcep.exe
  C:\Windows\system32\Kaqejcep.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:2352
- - C:\Windows\SysWOW64\Ldoafodd.exe
    C:\Windows\system32\Ldoafodd.exe
    3⤵
    PID:3188
  - - C:\Windows\SysWOW64\Lfmnbjcg.exe
      C:\Windows\system32\Lfmnbjcg.exe
      4⤵
      PID:4380

C:\Windows\SysWOW64\Leqkeajd.exe
C:\Windows\system32\Leqkeajd.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:4776
- C:\Windows\SysWOW64\Lhogamih.exe
  C:\Windows\system32\Lhogamih.exe
  2⤵
  PID:5584

C:\Windows\SysWOW64\Lmlpjdgo.exe
C:\Windows\system32\Lmlpjdgo.exe
1⤵
- Drops file in System32 directory
PID:6148
- C:\Windows\SysWOW64\Ldhdlnli.exe
  C:\Windows\system32\Ldhdlnli.exe
  2⤵
  - Modifies registry class
  PID:6224

C:\Windows\SysWOW64\Lhdqml32.exe
C:\Windows\system32\Lhdqml32.exe
1⤵
PID:6268
- C:\Windows\SysWOW64\Lmqiec32.exe
  C:\Windows\system32\Lmqiec32.exe
  2⤵
  PID:6312
- - C:\Windows\SysWOW64\Mehafq32.exe
    C:\Windows\system32\Mehafq32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Drops file in System32 directory
    PID:6356
  - - C:\Windows\SysWOW64\Mejnlpai.exe
      C:\Windows\system32\Mejnlpai.exe
      4⤵
      PID:6396
    - - C:\Windows\SysWOW64\Mhhjhlqm.exe
        
        C:\Windows\system32\Mhhjhlqm.exe
        5⤵
        
        PID:6444

C:\Windows\SysWOW64\Mkgfdgpq.exe
C:\Windows\system32\Mkgfdgpq.exe
1⤵
- Modifies registry class
PID:6480
- C:\Windows\SysWOW64\Mmebpbod.exe
  C:\Windows\system32\Mmebpbod.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:6524
- - C:\Windows\SysWOW64\Meljappg.exe
    C:\Windows\system32\Meljappg.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:6580

C:\Windows\SysWOW64\Mgngih32.exe
C:\Windows\system32\Mgngih32.exe
1⤵
- Modifies registry class
PID:6616
- C:\Windows\SysWOW64\Moeoje32.exe
  C:\Windows\system32\Moeoje32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Modifies registry class
  PID:6668
- - C:\Windows\SysWOW64\Meoggpmd.exe
    C:\Windows\system32\Meoggpmd.exe
    3⤵
    PID:6708
  - - C:\Windows\SysWOW64\Mgpcohcb.exe
      C:\Windows\system32\Mgpcohcb.exe
      4⤵
      Drops file in System32 directory
      PID:6748
    - - C:\Windows\SysWOW64\Moglpedd.exe
        
        C:\Windows\system32\Moglpedd.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6788

C:\Windows\SysWOW64\Mmjlkb32.exe
C:\Windows\system32\Mmjlkb32.exe
1⤵
PID:6832
- C:\Windows\SysWOW64\Mdddhlbl.exe
  C:\Windows\system32\Mdddhlbl.exe
  2⤵
  PID:6880
- - C:\Windows\SysWOW64\Mknlef32.exe
    C:\Windows\system32\Mknlef32.exe
    3⤵
    PID:6920
  - - C:\Windows\SysWOW64\Nahdapae.exe
      C:\Windows\system32\Nahdapae.exe
      4⤵
      Modifies registry class
      PID:6964

C:\Windows\SysWOW64\Nkpijfgf.exe
C:\Windows\system32\Nkpijfgf.exe
1⤵
- Drops file in System32 directory
PID:7044
- C:\Windows\SysWOW64\Nolekd32.exe
  C:\Windows\system32\Nolekd32.exe
  2⤵
  PID:7088
- - C:\Windows\SysWOW64\Najagp32.exe
    C:\Windows\system32\Najagp32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:7136
  - - C:\Windows\SysWOW64\Ndinck32.exe
      C:\Windows\system32\Ndinck32.exe
      4⤵
      PID:4144
    - - C:\Windows\SysWOW64\Namnmp32.exe
        
        C:\Windows\system32\Namnmp32.exe
        5⤵
        
        PID:5144

C:\Windows\SysWOW64\Necqbo32.exe
C:\Windows\system32\Necqbo32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7004

C:\Windows\SysWOW64\Nhffijdm.exe
C:\Windows\system32\Nhffijdm.exe
1⤵
PID:6232
- C:\Windows\SysWOW64\Noqofdlj.exe
  C:\Windows\system32\Noqofdlj.exe
  2⤵
  PID:6300

C:\Windows\SysWOW64\Naokbokn.exe
C:\Windows\system32\Naokbokn.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6352
- C:\Windows\SysWOW64\Ndmgnkja.exe
  C:\Windows\system32\Ndmgnkja.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:6404
- - C:\Windows\SysWOW64\Nglcjfie.exe
    C:\Windows\system32\Nglcjfie.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Drops file in System32 directory
    PID:6460
  - - C:\Windows\SysWOW64\Nnfkgp32.exe
      C:\Windows\system32\Nnfkgp32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Drops file in System32 directory
      PID:6532

C:\Windows\SysWOW64\Nkjlqd32.exe
C:\Windows\system32\Nkjlqd32.exe
1⤵
PID:6588
- C:\Windows\SysWOW64\Onhhmpoo.exe
  C:\Windows\system32\Onhhmpoo.exe
  2⤵
  PID:6656
- - C:\Windows\SysWOW64\Oacdmo32.exe
    C:\Windows\system32\Oacdmo32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Modifies registry class
    PID:6724
  - - C:\Windows\SysWOW64\Ohnljine.exe
      C:\Windows\system32\Ohnljine.exe
      4⤵
      Drops file in System32 directory
      PID:6796
    - - C:\Windows\SysWOW64\Oogdfc32.exe
        
        C:\Windows\system32\Oogdfc32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6844
      - C:\Windows\SysWOW64\Oafacn32.exe
        
        C:\Windows\system32\Oafacn32.exe
        6⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Ohpiphlb.exe
        
        C:\Windows\system32\Ohpiphlb.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1300

C:\Windows\SysWOW64\Oediim32.exe
C:\Windows\system32\Oediim32.exe
1⤵
- Drops file in System32 directory
PID:1672
- C:\Windows\SysWOW64\Ohbfeh32.exe
  C:\Windows\system32\Ohbfeh32.exe
  2⤵
  PID:1736

C:\Windows\SysWOW64\Oolnabal.exe
C:\Windows\system32\Oolnabal.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:6292
- C:\Windows\SysWOW64\Oeffnl32.exe
  C:\Windows\system32\Oeffnl32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:6320

C:\Windows\SysWOW64\Oggbfdog.exe
C:\Windows\system32\Oggbfdog.exe
1⤵
PID:6392
- C:\Windows\SysWOW64\Oookgbpj.exe
  C:\Windows\system32\Oookgbpj.exe
  2⤵
  PID:6472
- - C:\Windows\SysWOW64\Ofhcdlgg.exe
    C:\Windows\system32\Ofhcdlgg.exe
    3⤵
    - Modifies registry class
    PID:6464
  - - C:\Windows\SysWOW64\Ohgopgfj.exe
      C:\Windows\system32\Ohgopgfj.exe
      4⤵
      PID:6612
    - - C:\Windows\SysWOW64\Pfkpiled.exe
        
        C:\Windows\system32\Pfkpiled.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3992

C:\Windows\SysWOW64\Pkjegb32.exe
C:\Windows\system32\Pkjegb32.exe
1⤵
PID:1556
- C:\Windows\SysWOW64\Pbdmdlie.exe
  C:\Windows\system32\Pbdmdlie.exe
  2⤵
  PID:6220
- - C:\Windows\SysWOW64\Phneqf32.exe
    C:\Windows\system32\Phneqf32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4964

C:\Windows\SysWOW64\Phlikg32.exe
C:\Windows\system32\Phlikg32.exe
1⤵
PID:7128

C:\Windows\SysWOW64\Pfmlok32.exe
C:\Windows\system32\Pfmlok32.exe
1⤵
- Drops file in System32 directory
PID:4792

C:\Windows\SysWOW64\Pdgckg32.exe
C:\Windows\system32\Pdgckg32.exe
1⤵
- Drops file in System32 directory
PID:1756
- C:\Windows\SysWOW64\Pgeogb32.exe
  C:\Windows\system32\Pgeogb32.exe
  2⤵
  - Modifies registry class
  PID:4688

C:\Windows\SysWOW64\Qdipag32.exe
C:\Windows\system32\Qdipag32.exe
1⤵
PID:4164
- C:\Windows\SysWOW64\Qghlmbae.exe
  C:\Windows\system32\Qghlmbae.exe
  2⤵
  - Modifies registry class
  PID:5060
- - C:\Windows\SysWOW64\Qbmpjkqk.exe
    C:\Windows\system32\Qbmpjkqk.exe
    3⤵
    - Drops file in System32 directory
    PID:2604

C:\Windows\SysWOW64\Agmehamp.exe
C:\Windows\system32\Agmehamp.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:4200
- C:\Windows\SysWOW64\Aocmio32.exe
  C:\Windows\system32\Aocmio32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:6840
- - C:\Windows\SysWOW64\Abbiej32.exe
    C:\Windows\system32\Abbiej32.exe
    3⤵
    - Modifies registry class
    PID:4896

C:\Windows\SysWOW64\Adqeaf32.exe
C:\Windows\system32\Adqeaf32.exe
1⤵
- Modifies registry class
PID:3696
- C:\Windows\SysWOW64\Agobna32.exe
  C:\Windows\system32\Agobna32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3444

C:\Windows\SysWOW64\Aiqkmd32.exe
C:\Windows\system32\Aiqkmd32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4352
- C:\Windows\SysWOW64\Akogio32.exe
  C:\Windows\system32\Akogio32.exe
  2⤵
  PID:3296
- - C:\Windows\SysWOW64\Anncek32.exe
    C:\Windows\system32\Anncek32.exe
    3⤵
    PID:4952
  - - C:\Windows\SysWOW64\Mphamg32.exe
      C:\Windows\system32\Mphamg32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1816
    - - C:\Windows\SysWOW64\Nibbklke.exe
        
        C:\Windows\system32\Nibbklke.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:368
      - C:\Windows\SysWOW64\Ndhgie32.exe
        
        C:\Windows\system32\Ndhgie32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3996
        
        C:\Windows\SysWOW64\Nalgbi32.exe
        
        C:\Windows\system32\Nalgbi32.exe
        7⤵
        
        PID:4820

C:\Windows\SysWOW64\Aoapcood.exe
C:\Windows\system32\Aoapcood.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484

C:\Windows\SysWOW64\Qdllffpo.exe
C:\Windows\system32\Qdllffpo.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620

C:\Windows\SysWOW64\Qbkcek32.exe
C:\Windows\system32\Qbkcek32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6800

C:\Windows\SysWOW64\Qomghp32.exe
C:\Windows\system32\Qomghp32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:6648

C:\Windows\SysWOW64\Pnfdnnbo.exe
C:\Windows\system32\Pnfdnnbo.exe
1⤵
PID:6996

C:\Windows\SysWOW64\Naqqmieo.exe
C:\Windows\system32\Naqqmieo.exe
1⤵
PID:5244
- C:\Windows\SysWOW64\Ohkijc32.exe
  C:\Windows\system32\Ohkijc32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:5364
- - C:\Windows\SysWOW64\Okiefn32.exe
    C:\Windows\system32\Okiefn32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:1416

C:\Windows\SysWOW64\Ophjdehd.exe
C:\Windows\system32\Ophjdehd.exe
1⤵
- Modifies registry class
PID:3760
- C:\Windows\SysWOW64\Ohobebig.exe
  C:\Windows\system32\Ohobebig.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:5740

C:\Windows\SysWOW64\Omjnhiiq.exe
C:\Windows\system32\Omjnhiiq.exe
1⤵
PID:5452

C:\Windows\SysWOW64\Oiqomj32.exe
C:\Windows\system32\Oiqomj32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:3592
- C:\Windows\SysWOW64\Omlkmign.exe
  C:\Windows\system32\Omlkmign.exe
  2⤵
  PID:4016
- - C:\Windows\SysWOW64\Odfcjc32.exe
    C:\Windows\system32\Odfcjc32.exe
    3⤵
    - Modifies registry class
    PID:1716

C:\Windows\SysWOW64\Ogdofo32.exe
C:\Windows\system32\Ogdofo32.exe
1⤵
- Drops file in System32 directory
PID:5160
- C:\Windows\SysWOW64\Oickbjmb.exe
  C:\Windows\system32\Oickbjmb.exe
  2⤵
  - Executes dropped EXE
  PID:5596

C:\Windows\SysWOW64\Onqdhh32.exe
C:\Windows\system32\Onqdhh32.exe
1⤵
- Modifies registry class
PID:2144
- C:\Windows\SysWOW64\Oalpigkb.exe
  C:\Windows\system32\Oalpigkb.exe
  2⤵
  - Modifies registry class
  PID:2028

C:\Windows\SysWOW64\Pdklebje.exe
C:\Windows\system32\Pdklebje.exe
1⤵
PID:3828
- C:\Windows\SysWOW64\Pgihanii.exe
  C:\Windows\system32\Pgihanii.exe
  2⤵
  PID:5448

C:\Windows\SysWOW64\Pncanhaf.exe
C:\Windows\system32\Pncanhaf.exe
1⤵
- Modifies registry class
PID:5780
- C:\Windows\SysWOW64\Pdmikb32.exe
  C:\Windows\system32\Pdmikb32.exe
  2⤵
  - Modifies registry class
  PID:3012

C:\Windows\SysWOW64\Pkgaglpp.exe
C:\Windows\system32\Pkgaglpp.exe
1⤵
- Drops file in System32 directory
- Modifies registry class
PID:4916
- C:\Windows\SysWOW64\Pnenchoc.exe
  C:\Windows\system32\Pnenchoc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:4452
- - C:\Windows\SysWOW64\Ppdjpcng.exe
    C:\Windows\system32\Ppdjpcng.exe
    3⤵
    - Drops file in System32 directory
    PID:5580

C:\Windows\SysWOW64\Pkinmlnm.exe
C:\Windows\system32\Pkinmlnm.exe
1⤵
- Modifies registry class
PID:5720
- C:\Windows\SysWOW64\Pdbbfadn.exe
  C:\Windows\system32\Pdbbfadn.exe
  2⤵
  - Drops file in System32 directory
  PID:5952
- - C:\Windows\SysWOW64\Phmnfp32.exe
    C:\Windows\system32\Phmnfp32.exe
    3⤵
    - Executes dropped EXE
    PID:5644

C:\Windows\SysWOW64\Pafcofcg.exe
C:\Windows\system32\Pafcofcg.exe
1⤵
- Modifies registry class
PID:6120
- C:\Windows\SysWOW64\Pphckb32.exe
  C:\Windows\system32\Pphckb32.exe
  2⤵
  PID:3400

C:\Windows\SysWOW64\Phpklp32.exe
C:\Windows\system32\Phpklp32.exe
1⤵
PID:6068
- C:\Windows\SysWOW64\Pgbkgmao.exe
  C:\Windows\system32\Pgbkgmao.exe
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  PID:6092

C:\Windows\SysWOW64\Pjahchpb.exe
C:\Windows\system32\Pjahchpb.exe
1⤵
PID:3816
- C:\Windows\SysWOW64\Pahpee32.exe
  C:\Windows\system32\Pahpee32.exe
  2⤵
  - Modifies registry class
  PID:5700

C:\Windows\SysWOW64\Qpkppbho.exe
C:\Windows\system32\Qpkppbho.exe
1⤵
PID:2284
- C:\Windows\SysWOW64\Qhbhapha.exe
  C:\Windows\system32\Qhbhapha.exe
  2⤵
  - Drops file in System32 directory
  PID:1048

C:\Windows\SysWOW64\Qjcdih32.exe
C:\Windows\system32\Qjcdih32.exe
1⤵
PID:4828
- C:\Windows\SysWOW64\Qajlje32.exe
  C:\Windows\system32\Qajlje32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:5472
- - C:\Windows\SysWOW64\Qhddgofo.exe
    C:\Windows\system32\Qhddgofo.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:5464

C:\Windows\SysWOW64\Qkcackeb.exe
C:\Windows\system32\Qkcackeb.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:6056
- C:\Windows\SysWOW64\Qjeaog32.exe
  C:\Windows\system32\Qjeaog32.exe
  2⤵
  PID:5708
- - C:\Windows\SysWOW64\Aqpika32.exe
    C:\Windows\system32\Aqpika32.exe
    3⤵
    - Drops file in System32 directory
    PID:5804

C:\Windows\SysWOW64\Aqbfaa32.exe
C:\Windows\system32\Aqbfaa32.exe
1⤵
PID:1836
- C:\Windows\SysWOW64\Ahinbo32.exe
  C:\Windows\system32\Ahinbo32.exe
  2⤵
  PID:5396
- - C:\Windows\SysWOW64\Akjgdjoj.exe
    C:\Windows\system32\Akjgdjoj.exe
    3⤵
    - Drops file in System32 directory
    - Modifies registry class
    PID:7124
  - - C:\Windows\SysWOW64\Abdoqd32.exe
      C:\Windows\system32\Abdoqd32.exe
      4⤵
      PID:3048
    - - C:\Windows\SysWOW64\Ahngmnnd.exe
        
        C:\Windows\system32\Ahngmnnd.exe
        5⤵
        
        PID:5496
      - C:\Windows\SysWOW64\Aklciimh.exe
        
        C:\Windows\system32\Aklciimh.exe
        6⤵
        Modifies registry class
        
        PID:5592

C:\Windows\SysWOW64\Ajodef32.exe
C:\Windows\system32\Ajodef32.exe
1⤵
PID:4780
- C:\Windows\SysWOW64\Abflfc32.exe
  C:\Windows\system32\Abflfc32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:1168

C:\Windows\SysWOW64\Addhbo32.exe
C:\Windows\system32\Addhbo32.exe
1⤵
- Drops file in System32 directory
PID:1612
- C:\Windows\SysWOW64\Agcdnjcl.exe
  C:\Windows\system32\Agcdnjcl.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  PID:4308

C:\Windows\SysWOW64\Akopoi32.exe
C:\Windows\system32\Akopoi32.exe
1⤵
PID:4556
- C:\Windows\SysWOW64\Anmmkd32.exe
  C:\Windows\system32\Anmmkd32.exe
  2⤵
  PID:5252
- - C:\Windows\SysWOW64\Bqkigp32.exe
    C:\Windows\system32\Bqkigp32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:4796

C:\Windows\SysWOW64\Bdgehobe.exe
C:\Windows\system32\Bdgehobe.exe
1⤵
PID:3600
- C:\Windows\SysWOW64\Bkamdi32.exe
  C:\Windows\system32\Bkamdi32.exe
  2⤵
  - Modifies registry class
  PID:5136
- - C:\Windows\SysWOW64\Bnoiqd32.exe
    C:\Windows\system32\Bnoiqd32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Modifies registry class
    PID:1108

C:\Windows\SysWOW64\Bqnemp32.exe
C:\Windows\system32\Bqnemp32.exe
1⤵
PID:5732
- C:\Windows\SysWOW64\Bhennm32.exe
  C:\Windows\system32\Bhennm32.exe
  2⤵
  PID:2964
- - C:\Windows\SysWOW64\Bkcjjhgp.exe
    C:\Windows\system32\Bkcjjhgp.exe
    3⤵
    PID:5376
  - - C:\Windows\SysWOW64\Bbmbgb32.exe
      C:\Windows\system32\Bbmbgb32.exe
      4⤵
      Drops file in System32 directory
      Modifies registry class
      PID:3888

C:\Windows\SysWOW64\Bdlncn32.exe
C:\Windows\system32\Bdlncn32.exe
1⤵
- Drops file in System32 directory
PID:5524
- C:\Windows\SysWOW64\Bgjjoi32.exe
  C:\Windows\system32\Bgjjoi32.exe
  2⤵
  PID:5628
- - C:\Windows\SysWOW64\Bjhgke32.exe
    C:\Windows\system32\Bjhgke32.exe
    3⤵
    PID:1452

C:\Windows\SysWOW64\Bbpolb32.exe
C:\Windows\system32\Bbpolb32.exe
1⤵
PID:3388
- C:\Windows\SysWOW64\Biigildg.exe
  C:\Windows\system32\Biigildg.exe
  2⤵
  PID:7208
- - C:\Windows\SysWOW64\Bjkcqdje.exe
    C:\Windows\system32\Bjkcqdje.exe
    3⤵
    PID:7248
  - - C:\Windows\SysWOW64\Bbbkbbkg.exe
      C:\Windows\system32\Bbbkbbkg.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:7288
    - - C:\Windows\SysWOW64\Bilcol32.exe
        
        C:\Windows\system32\Bilcol32.exe
        5⤵
        Modifies registry class
        
        PID:7332

C:\Windows\SysWOW64\Bkjpkg32.exe
C:\Windows\system32\Bkjpkg32.exe
1⤵
- Drops file in System32 directory
PID:7372
- C:\Windows\SysWOW64\Bjmpfdhb.exe
  C:\Windows\system32\Bjmpfdhb.exe
  2⤵
  PID:7412
- - C:\Windows\SysWOW64\Cbdhgaid.exe
    C:\Windows\system32\Cbdhgaid.exe
    3⤵
    PID:7452

C:\Windows\SysWOW64\Cebdcmhh.exe
C:\Windows\system32\Cebdcmhh.exe
1⤵
PID:7492
- C:\Windows\SysWOW64\Ckmmpg32.exe
  C:\Windows\system32\Ckmmpg32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:7536
- - C:\Windows\SysWOW64\Ceeaim32.exe
    C:\Windows\system32\Ceeaim32.exe
    3⤵
    PID:7576
  - - C:\Windows\SysWOW64\Cgcmeh32.exe
      C:\Windows\system32\Cgcmeh32.exe
      4⤵
      Drops file in System32 directory
      Modifies registry class
      PID:7620
    - - C:\Windows\SysWOW64\Cnmebblf.exe
        
        C:\Windows\system32\Cnmebblf.exe
        5⤵
        
        PID:7664
      - C:\Windows\SysWOW64\Cegnol32.exe
        
        C:\Windows\system32\Cegnol32.exe
        6⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Cgejkh32.exe
        
        C:\Windows\system32\Cgejkh32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7744

C:\Windows\SysWOW64\Cjdfgc32.exe
C:\Windows\system32\Cjdfgc32.exe
1⤵
PID:7784
- C:\Windows\SysWOW64\Cbknhqbl.exe
  C:\Windows\system32\Cbknhqbl.exe
  2⤵
  PID:7832
- - C:\Windows\SysWOW64\Cejjdlap.exe
    C:\Windows\system32\Cejjdlap.exe
    3⤵
    PID:7868
  - - C:\Windows\SysWOW64\Cghgpgqd.exe
      C:\Windows\system32\Cghgpgqd.exe
      4⤵
      PID:7916

C:\Windows\SysWOW64\Cjfclcpg.exe
C:\Windows\system32\Cjfclcpg.exe
1⤵
PID:7952
- C:\Windows\SysWOW64\Capkim32.exe
  C:\Windows\system32\Capkim32.exe
  2⤵
  PID:7992

C:\Windows\SysWOW64\Cigcjj32.exe
C:\Windows\system32\Cigcjj32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:8036
- C:\Windows\SysWOW64\Cgjcfgoa.exe
  C:\Windows\system32\Cgjcfgoa.exe
  2⤵
  PID:8072
- - C:\Windows\SysWOW64\Djipbbne.exe
    C:\Windows\system32\Djipbbne.exe
    3⤵
    - Modifies registry class
    PID:8120

C:\Windows\SysWOW64\Dbphcpog.exe
C:\Windows\system32\Dbphcpog.exe
1⤵
- Modifies registry class
PID:8156
- C:\Windows\SysWOW64\Dendok32.exe
  C:\Windows\system32\Dendok32.exe
  2⤵
  PID:7192

C:\Windows\SysWOW64\Dgmpkg32.exe
C:\Windows\system32\Dgmpkg32.exe
1⤵
PID:7268
- C:\Windows\SysWOW64\Djklgb32.exe
  C:\Windows\system32\Djklgb32.exe
  2⤵
  PID:7324

C:\Windows\SysWOW64\Dbbdip32.exe
C:\Windows\system32\Dbbdip32.exe
1⤵
PID:7408
- C:\Windows\SysWOW64\Dgomaf32.exe
  C:\Windows\system32\Dgomaf32.exe
  2⤵
  PID:7476
- - C:\Windows\SysWOW64\Djmima32.exe
    C:\Windows\system32\Djmima32.exe
    3⤵
    PID:7564
  - - C:\Windows\SysWOW64\Dbdano32.exe
      C:\Windows\system32\Dbdano32.exe
      4⤵
      PID:7604
    - - C:\Windows\SysWOW64\Diafqi32.exe
        
        C:\Windows\system32\Diafqi32.exe
        5⤵
        
        PID:7684
      - C:\Windows\SysWOW64\Dnnoip32.exe
        
        C:\Windows\system32\Dnnoip32.exe
        6⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Dalkek32.exe
        
        C:\Windows\system32\Dalkek32.exe
        7⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Elaobdmm.exe
        
        C:\Windows\system32\Elaobdmm.exe
        8⤵
        Modifies registry class
        
        PID:7904
        
        C:\Windows\SysWOW64\Eejcki32.exe
        
        C:\Windows\system32\Eejcki32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7988

C:\Windows\SysWOW64\Ehhpge32.exe
C:\Windows\system32\Ehhpge32.exe
1⤵
PID:8044
- C:\Windows\SysWOW64\Ejglcq32.exe
  C:\Windows\system32\Ejglcq32.exe
  2⤵
  PID:8128
- - C:\Windows\SysWOW64\Elfhmc32.exe
    C:\Windows\system32\Elfhmc32.exe
    3⤵
    PID:8188
  - - C:\Windows\SysWOW64\Eeomfioh.exe
      C:\Windows\system32\Eeomfioh.exe
      4⤵
      Modifies registry class
      PID:7244
    - - C:\Windows\SysWOW64\Engaon32.exe
        
        C:\Windows\system32\Engaon32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7444
      - C:\Windows\SysWOW64\Eimelg32.exe
        
        C:\Windows\system32\Eimelg32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7544
        
        C:\Windows\SysWOW64\Eahjqicj.exe
        
        C:\Windows\system32\Eahjqicj.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7628
        
        C:\Windows\SysWOW64\Folkjnbc.exe
        
        C:\Windows\system32\Folkjnbc.exe
        8⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Fefcgh32.exe
        
        C:\Windows\system32\Fefcgh32.exe
        9⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Fhdocc32.exe
        
        C:\Windows\system32\Fhdocc32.exe
        10⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Fehplggn.exe
        
        C:\Windows\system32\Fehplggn.exe
        11⤵
        Drops file in System32 directory
        
        PID:8104
        
        C:\Windows\SysWOW64\Flbhia32.exe
        
        C:\Windows\system32\Flbhia32.exe
        12⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Foqdem32.exe
        
        C:\Windows\system32\Foqdem32.exe
        13⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Faopah32.exe
        
        C:\Windows\system32\Faopah32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7648

C:\Windows\SysWOW64\Focakm32.exe
C:\Windows\system32\Focakm32.exe
1⤵
PID:7820
- C:\Windows\SysWOW64\Faamghko.exe
  C:\Windows\system32\Faamghko.exe
  2⤵
  PID:7828
- - C:\Windows\SysWOW64\Ghmbib32.exe
    C:\Windows\system32\Ghmbib32.exe
    3⤵
    PID:7516
  - - C:\Windows\SysWOW64\Gaffbg32.exe
      C:\Windows\system32\Gaffbg32.exe
      4⤵
      PID:8152
    - - C:\Windows\SysWOW64\Ghpooanf.exe
        
        C:\Windows\system32\Ghpooanf.exe
        5⤵
        
        PID:2900
      - C:\Windows\SysWOW64\Gbecljnl.exe
        
        C:\Windows\system32\Gbecljnl.exe
        6⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Ghbkdald.exe
        
        C:\Windows\system32\Ghbkdald.exe
        7⤵
        
        PID:7532

C:\Windows\SysWOW64\Giahndcf.exe
C:\Windows\system32\Giahndcf.exe
1⤵
PID:7188
- C:\Windows\SysWOW64\Glpdjpbj.exe
  C:\Windows\system32\Glpdjpbj.exe
  2⤵
  PID:8208

C:\Windows\SysWOW64\Gooqfkan.exe
C:\Windows\system32\Gooqfkan.exe
1⤵
PID:8248
- C:\Windows\SysWOW64\Gammbfqa.exe
  C:\Windows\system32\Gammbfqa.exe
  2⤵
  PID:8296
- - C:\Windows\SysWOW64\Giddddad.exe
    C:\Windows\system32\Giddddad.exe
    3⤵
    PID:8336

C:\Windows\SysWOW64\Gclimi32.exe
C:\Windows\system32\Gclimi32.exe
1⤵
PID:8372
- C:\Windows\SysWOW64\Hkgnalep.exe
  C:\Windows\system32\Hkgnalep.exe
  2⤵
  PID:8436
- - C:\Windows\SysWOW64\Hcofbifb.exe
    C:\Windows\system32\Hcofbifb.exe
    3⤵
    PID:8484
  - - C:\Windows\SysWOW64\Hligqnjp.exe
      C:\Windows\system32\Hligqnjp.exe
      4⤵
      PID:8524
    - - C:\Windows\SysWOW64\Hedhoc32.exe
        
        C:\Windows\system32\Hedhoc32.exe
        5⤵
        
        PID:8564
      - C:\Windows\SysWOW64\Hkaqgjme.exe
        
        C:\Windows\system32\Hkaqgjme.exe
        6⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Ijdnka32.exe
        
        C:\Windows\system32\Ijdnka32.exe
        7⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Ieknpb32.exe
        
        C:\Windows\system32\Ieknpb32.exe
        8⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Ikhghi32.exe
        
        C:\Windows\system32\Ikhghi32.exe
        9⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Ijigfaol.exe
        
        C:\Windows\system32\Ijigfaol.exe
        10⤵
        
        PID:8776

C:\Windows\SysWOW64\Ilgcblnp.exe
C:\Windows\system32\Ilgcblnp.exe
1⤵
PID:8824
- C:\Windows\SysWOW64\Iofpnhmc.exe
  C:\Windows\system32\Iofpnhmc.exe
  2⤵
  PID:8868
- - C:\Windows\SysWOW64\Iadljc32.exe
    C:\Windows\system32\Iadljc32.exe
    3⤵
    PID:8912

C:\Windows\SysWOW64\Ihndgmdd.exe
C:\Windows\system32\Ihndgmdd.exe
1⤵
PID:8952
- C:\Windows\SysWOW64\Ikmpcicg.exe
  C:\Windows\system32\Ikmpcicg.exe
  2⤵
  PID:8996

C:\Windows\SysWOW64\Icdhdfcj.exe
C:\Windows\system32\Icdhdfcj.exe
1⤵
PID:9040
- C:\Windows\SysWOW64\Jjnqap32.exe
  C:\Windows\system32\Jjnqap32.exe
  2⤵
  PID:9084
- - C:\Windows\SysWOW64\Jllmml32.exe
    C:\Windows\system32\Jllmml32.exe
    3⤵
    PID:9128
  - - C:\Windows\SysWOW64\Jbieebha.exe
      C:\Windows\system32\Jbieebha.exe
      4⤵
      PID:9172

C:\Windows\SysWOW64\Jhcmbm32.exe
C:\Windows\system32\Jhcmbm32.exe
1⤵
PID:8108
- C:\Windows\SysWOW64\Jchaoe32.exe
  C:\Windows\system32\Jchaoe32.exe
  2⤵
  PID:8260
- - C:\Windows\SysWOW64\Jjbjlpga.exe
    C:\Windows\system32\Jjbjlpga.exe
    3⤵
    PID:8316
  - - C:\Windows\SysWOW64\Jhejgl32.exe
      C:\Windows\system32\Jhejgl32.exe
      4⤵
      PID:8368

C:\Windows\SysWOW64\Joobdfei.exe
C:\Windows\system32\Joobdfei.exe
1⤵
PID:8456
- C:\Windows\SysWOW64\Jbnopbdl.exe
  C:\Windows\system32\Jbnopbdl.exe
  2⤵
  PID:8532
- - C:\Windows\SysWOW64\Jmccnk32.exe
    C:\Windows\system32\Jmccnk32.exe
    3⤵
    PID:8640

C:\Windows\SysWOW64\Joaojf32.exe
C:\Windows\system32\Joaojf32.exe
1⤵
PID:8704
- C:\Windows\SysWOW64\Jflgfpkc.exe
  C:\Windows\system32\Jflgfpkc.exe
  2⤵
  PID:8788
- - C:\Windows\SysWOW64\Jhjcbljf.exe
    C:\Windows\system32\Jhjcbljf.exe
    3⤵
    PID:8876
  - - C:\Windows\SysWOW64\Kfndlphp.exe
      C:\Windows\system32\Kfndlphp.exe
      4⤵
      PID:8936

C:\Windows\SysWOW64\Kilphk32.exe
C:\Windows\system32\Kilphk32.exe
1⤵
PID:9004
- C:\Windows\SysWOW64\Kkkldg32.exe
  C:\Windows\system32\Kkkldg32.exe
  2⤵
  PID:9092
- - C:\Windows\SysWOW64\Kcbded32.exe
    C:\Windows\system32\Kcbded32.exe
    3⤵
    PID:9160
  - - C:\Windows\SysWOW64\Kjlmbnof.exe
      C:\Windows\system32\Kjlmbnof.exe
      4⤵
      PID:9212
    - - C:\Windows\SysWOW64\Kkmijf32.exe
        
        C:\Windows\system32\Kkmijf32.exe
        5⤵
        
        PID:8480
      - C:\Windows\SysWOW64\Kiajck32.exe
        
        C:\Windows\system32\Kiajck32.exe
        6⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Kkdoje32.exe
        
        C:\Windows\system32\Kkdoje32.exe
        7⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Lkflpe32.exe
        
        C:\Windows\system32\Lkflpe32.exe
        8⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Lcndab32.exe
        
        C:\Windows\system32\Lcndab32.exe
        9⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Lpdefc32.exe
        
        C:\Windows\system32\Lpdefc32.exe
        10⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Lcpqgbkj.exe
        
        C:\Windows\system32\Lcpqgbkj.exe
        11⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Limioiia.exe
        
        C:\Windows\system32\Limioiia.exe
        12⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Lpgalc32.exe
        
        C:\Windows\system32\Lpgalc32.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1848
        
        C:\Windows\SysWOW64\Lfqjhmhk.exe
        
        C:\Windows\system32\Lfqjhmhk.exe
        14⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\Mpkkgbmi.exe
        
        C:\Windows\system32\Mpkkgbmi.exe
        15⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\Mfhpilbc.exe
        
        C:\Windows\system32\Mfhpilbc.exe
        16⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Miflehaf.exe
        
        C:\Windows\system32\Miflehaf.exe
        17⤵
        
        PID:8728

C:\Windows\SysWOW64\Mldhacpj.exe
C:\Windows\system32\Mldhacpj.exe
1⤵
PID:8636
- C:\Windows\SysWOW64\Mclpbqal.exe
  C:\Windows\system32\Mclpbqal.exe
  2⤵
  PID:8908
- - C:\Windows\SysWOW64\Mfjlolpp.exe
    C:\Windows\system32\Mfjlolpp.exe
    3⤵
    PID:9152
  - - C:\Windows\SysWOW64\Mihikgod.exe
      C:\Windows\system32\Mihikgod.exe
      4⤵
      PID:6428
    - - C:\Windows\SysWOW64\Mjheejff.exe
        
        C:\Windows\system32\Mjheejff.exe
        5⤵
        
        PID:8464
      - C:\Windows\SysWOW64\Mlialb32.exe
        
        C:\Windows\system32\Mlialb32.exe
        6⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\Mpenmadn.exe
        
        C:\Windows\system32\Mpenmadn.exe
        7⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Mfofjk32.exe
        
        C:\Windows\system32\Mfofjk32.exe
        8⤵
        
        PID:5528

C:\Windows\SysWOW64\Mimbfg32.exe
C:\Windows\system32\Mimbfg32.exe
1⤵
PID:8420
- C:\Windows\SysWOW64\Nlknbb32.exe
  C:\Windows\system32\Nlknbb32.exe
  2⤵
  PID:3520
- - C:\Windows\SysWOW64\Nbefolao.exe
    C:\Windows\system32\Nbefolao.exe
    3⤵
    PID:7984
  - - C:\Windows\SysWOW64\Njmopj32.exe
      C:\Windows\system32\Njmopj32.exe
      4⤵
      PID:4376

C:\Windows\SysWOW64\Nmkkle32.exe
C:\Windows\system32\Nmkkle32.exe
1⤵
PID:9136
- C:\Windows\SysWOW64\Npighq32.exe
  C:\Windows\system32\Npighq32.exe
  2⤵
  PID:8944
- - C:\Windows\SysWOW64\Nfcoekhe.exe
    C:\Windows\system32\Nfcoekhe.exe
    3⤵
    PID:8616

C:\Windows\SysWOW64\Nlphmafm.exe
C:\Windows\system32\Nlphmafm.exe
1⤵
PID:5172
- C:\Windows\SysWOW64\Ndgpnogo.exe
  C:\Windows\system32\Ndgpnogo.exe
  2⤵
  PID:9264
- - C:\Windows\SysWOW64\Nffljjfc.exe
    C:\Windows\system32\Nffljjfc.exe
    3⤵
    PID:9304

C:\Windows\SysWOW64\Nidhffef.exe
C:\Windows\system32\Nidhffef.exe
1⤵
PID:9348
- C:\Windows\SysWOW64\Nlbdba32.exe
  C:\Windows\system32\Nlbdba32.exe
  2⤵
  PID:9392
- - C:\Windows\SysWOW64\Ndjldo32.exe
    C:\Windows\system32\Ndjldo32.exe
    3⤵
    PID:9432

C:\Windows\SysWOW64\Nfhipj32.exe
C:\Windows\system32\Nfhipj32.exe
1⤵
PID:9476
- C:\Windows\SysWOW64\Nifele32.exe
  C:\Windows\system32\Nifele32.exe
  2⤵
  PID:9516

C:\Windows\SysWOW64\Nleaha32.exe
C:\Windows\system32\Nleaha32.exe
1⤵
PID:9556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 9556 -s 400
  2⤵
  - Program crash
  PID:9652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 9556 -ip 9556
1⤵
PID:9624

C:\Windows\SysWOW64\Pkedbmab.exe
C:\Windows\system32\Pkedbmab.exe
1⤵
- Drops file in System32 directory
PID:5220

C:\Windows\SysWOW64\Opfnne32.exe
C:\Windows\system32\Opfnne32.exe
1⤵
- Executes dropped EXE
PID:5312

C:\Windows\SysWOW64\Nhhldc32.exe
C:\Windows\system32\Nhhldc32.exe
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Baegibae.exe

Path C:\Windows\SysWOW64\Baegibae.exe
Size 81KB
SHA256 e49827b4c5508b02fd914da2e3b3faab2ae7fb336416670b822f405ee2c4c5e3
MD5 4ccd8bcf671eaefbb2641d1ec4b11115
SHA1 2c04796575ca04542be18ae129c1e178f513c7f8
SHA512 3ef49f9cbf27b4dae9be453e6427562e5b74823725168aad487aa27d92859963f33fe3fca04cd783bee5f1bf6406c61bb4d523798e413cd285ccc78d8657951a
SSDEEP 1536:MLcBjakdFt7mJt+6bAbQzzpLmZD2LXkS5DUHRbPa9b6i+sI0:McRc6QZLegUS5DSCopsI0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bdgehobe.exe

Path C:\Windows\SysWOW64\Bdgehobe.exe
Size 14KB
SHA256 01d5456b274dd19da19771931c946a24f33c2048ce3f0bf65125cdf6e2ca79c1
MD5 a81144a657b76a35fdb39f7d28d28528
SHA1 93848baa7a9953115ad7fb583179d31e7d4475e9
SHA512 75645f3506bce6abb82b87337f7b72e57416f3562a34d9158e49763e6573d9de581d25a6301332bafdf6f79e6be26e71331ddba9c4deb4c36001e4185fcadf56
SSDEEP 384:LXShOpIeeeblZXmARGUjUI0TFXPawgQ35/GRqR1Ukd:L1pP1X8UyBXCwgQ3lGojd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bhkfkmmg.exe

Path C:\Windows\SysWOW64\Bhkfkmmg.exe
Size 52KB
SHA256 34b32bf8c1bbefd084eddf68386e92e6476823ee601b33a9171c366ff8dd7039
MD5 8302a197177b2cd60fa64eeab04d969e
SHA1 9cb7fe715647ad0ccf3db0ff2fae4a62d6008dd1
SHA512 f449be4e6147b799112151d13f9eb6c4db09fccad12a413c138f3eaeaf8ce40dae4422a46ae88c13aae217f5013c4e4d19f013f8053deb04d24e6bd23486ec37
SSDEEP 1536:zmro3pa7OXpKB7eNNwpXf/7zDx7ZdpY2L43:yM3L5mpPXtZdjK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bilcol32.exe

Path C:\Windows\SysWOW64\Bilcol32.exe
Size 57KB
SHA256 83b55e482acf82fd6b2ac0c127d472110766859cbcf6cb1b1a19f84aa3c0ff1d
MD5 3a3144a4b4c88100af327a197d788de5
SHA1 33bc6bafadc6704046039332e6a492bc8e13a4d8
SHA512 654de824eda1b933cc1347670a6668a35b4b7f775af2718d67b81c8447deab5f9dbfec71785dbc381bea74163270db4dcf3922d43772b8f899eccc8d729eb41b
SSDEEP 768:0mJfGD7CrQFDEYE5sFJ2vcoDO4dx/hD8M9etBl2Z/BWlOHwt6YDEUD2p/1H5bXdn:0/eQFDEZsF09vK2ZUOHnYp2LHS5c
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bknlbhhe.exe

Path C:\Windows\SysWOW64\Bknlbhhe.exe
Size 12KB
SHA256 caec1be6ac2356479af5927c2094543fb6e40b941e3c35fdd70d48cbb238eace
MD5 6529b035c8a350bf6e77af1c0a09737d
SHA1 ee2439a7e9de1f599ac6a3f99c4f5439220bc883
SHA512 b346269a4a536168a7e37c6a6233c4c76863aab60eb05858b89fdccd587de60067073ec173b72e418d57d18cbae0c52a62cf8a1f44a183f4abe3ac22ed08ccdb
SSDEEP 192:zp80yMRn+Lf8lIb4vZh8Y2jmUNq5xiwVVAZLhxzIoRLZkpiDBUL2q3OO3:zGgR+LMARjpM5xiwcZLh53RWL53OO3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Bmhocd32.exe

Path C:\Windows\SysWOW64\Bmhocd32.exe
Size 23KB
SHA256 03c4d585c84cacfb28be59b64084c0cbd3c54ef2dd786a5aeccb7c13a46d8d07
MD5 e867883a6afff2114bb1c36d1d3b6d7d
SHA1 8189d175e0d5599360d1be57d09cc35f94e5c33f
SHA512 92a4bd68fd8bdebaf3bc3f807a4a82e7946d9e5833c8cb2d1c3344997d415753005316b67b6d5313b40c59811e45e36deef98281091f1a523fe889ecfc9a7ade
SSDEEP 384:g3wG4NW+uPoy+XvK4HobshV8BzaYtG8tq2OwImp8Bf8ZE/nA6GQy/Dl9fT5RH2tK:PGKWBPoicobshazasG+q21EY6GZDl1Hn
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cnmebblf.exe

Path C:\Windows\SysWOW64\Cnmebblf.exe
Size 46KB
SHA256 9f893e7acd16a73c3a8e51a67b8c8c4b96ed72f1ae2cff89bd7efdcc996dfd50
MD5 69982996b34da86f0c6ad405eb90bfad
SHA1 3ebe8b89169a3ae01df2d5c33594262f1962dfee
SHA512 12588ca71e5dc2fdc553e4a3aa3ea49b8ab6fa14195981ed8f9fc5421f545e1659bd65d11c2800a053e7462c96fa7000ae6234cbae05594623b1a34445ac3daa
SSDEEP 768:16rYkl1uJRcRcxPD+KCPyKhXL7fpCoDqiLddy/gP/DbvHf2Y:81uJRIMUKSXLuiJdy/gP///2Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Conanfli.exe

Path C:\Windows\SysWOW64\Conanfli.exe
Size 8KB
SHA256 c9fbc3354e3665b1d16c1738a6ec5bd0fff9796eb80f0b893ad351aba1c62294
MD5 9ace3a3b3c2739e5dae338a6df188bb0
SHA1 c426ef7930ff1fb1956d62e254306e65eb32d88c
SHA512 d731ba5313a8b7c3d9b6511557f1b3992bbbdff8583771221a0110e13ed4d47c0e36a36a94fed8da882e6d478a1e55db96bd9dd03e0d1767d46c390e8dd8451a
SSDEEP 192:56qbYurbXKEXDGEtVPVWZffR2/u/KDDV65a20rQ0HK5T69:5ourbXpiiVPaR2WiV6xWQ0HKU9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dbdano32.exe

Path C:\Windows\SysWOW64\Dbdano32.exe
Size 45KB
SHA256 b0b2ec7268e909be9534974bfe57d94020bf0d309e060750cc85ea50f87063d4
MD5 32cbbc4d87079e4d15a3b098e20baad1
SHA1 7a21817430cc3b9b801d7c9b7fcd5b708a223420
SHA512 0d0b6cfda2ecf9b8ef8302d4e0209255035f9ad68f8335b51302b7285b9ce079af4a30abb4eae2786bad63a6350a2c4746170f734714afbef80a6189adb086be
SSDEEP 768:TxYvu9gdpLMT/t5rlslcRZILHJscSV1FZWb1e3LA9LAwlcZagl36uXlOOOOV7rwp:CP47rAU2mcq1zWwLANAwlcZdl3SeLQ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ijdnka32.exe

Path C:\Windows\SysWOW64\Ijdnka32.exe
Size 6KB
SHA256 111dd392d9ed6cd17d9a2de63cadf840711e50aec9180064428bc90c1b1f54f5
MD5 4d8af0ed2b81c176a00ce1e36b18f930
SHA1 3819602c313cc1a746fb5ca28aa47fde13367500
SHA512 23e6d0f73e81b7301f5cc00ab1e61bc2188e32183a6e48ce0840731f170952fe3dddf1b9a72cbacd0c9ce37461baea6dacdec79de22e4ab58f13f9ecc6e8cece
SSDEEP 96:XWG4YD2MkDj/xBNj1q5DryB/xYkRU4wG1eROByo/OGSSIgzVsy:94wgjHNjX5Yf+Mo2GR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kfnfjehl.exe

Path C:\Windows\SysWOW64\Kfnfjehl.exe
Size 199KB
SHA256 9ea06d10d4d0ae7875e44f064079fc380750ba4f67198647e636596f66bee90c
MD5 faae291dbb6fa9d493461f3dd1600d1b
SHA1 44929e6e6c821ee2e4cfe5f24bed94ef43ab2d6e
SHA512 a7c204d85e9be168501169aac07226e2d701675ba48356e111e546e4652b8fb78957d71b499be542d154084a3f74eb96f408fb1bd619103fcce949f2d4cacb73
SSDEEP 6144:MpXJwTqp9wWwa0tU4XWMSZSCZj81+jq4peBK034YOmFz1h:MvhZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kfnfjehl.exe

Path C:\Windows\SysWOW64\Kfnfjehl.exe
Size 91KB
SHA256 6f35d0392dabb41a0eb4f3fff69a6dbda078ac402ef05844a0e3c2721698dac1
MD5 ce03a2c7a21fa52b70797e05007c8444
SHA1 bcd99fd6252c7df516f3242436ff898f4d922fc7
SHA512 9b404a0ae755201ad01f206b86075d9e114548d83d8aaf4e16e64c4f5321ba359e99dae2df743ac7ea4afeaead98473eb6da9945da828256e89c37095c01c498
SSDEEP 1536:DCblgKcstJKQ1eTqp9wWwa0tU4X0UudJVFAxVF2LRSS5DUHRbPa9b6i+sImo7P:GblgKcMJNeTqp9wWwa0tU4XgW2MS5DSf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Mjheejff.exe

Path C:\Windows\SysWOW64\Mjheejff.exe
Size 1KB
SHA256 6f792a770adede1d2391fda69698d4b3efcce3e1c4b0fbd67d3133c2724097cb
MD5 f6f76155e884ded1134786c481d0e17e
SHA1 4e87f00fe7c98c7df568d8d053b458592490dca1
SHA512 39fad7e39e05e17f6803f9768826a1d3ee7f24ba147a420148d741749aab0ef5a7e4b5c18f11ab1916b5b3c854ec9270253ac9ba457b98681d63f268d3365ad6
MD5 SHA1 SHA512

Submit Download

Mpenmadn.exe

Path C:\Windows\SysWOW64\Mpenmadn.exe
Size 1KB
SHA256 3606c2be1fec1c4cd3c64314c65397dca4106ab70ed4301512bb3e155c9d6625
MD5 33dd1aa7fd52a5451c4d9a90fc10b91a
SHA1 e66c5291d51ddf0e104ece1c1dc34c6529989223
SHA512 7f380ccdca9f01e12de44a1960934f0ceb97c8daaf8548c815f10e525d818af89b12ce819124d487f97422efd4f70fb926ada381f2a2ef15c661fd98b275b932
MD5 SHA1 SHA512

Submit Download

Mpkkgbmi.exe

Path C:\Windows\SysWOW64\Mpkkgbmi.exe
Size 4KB
SHA256 8de1086b10010b05d044f62bf4fb1a04545c9d2a1194a6d505bb5242640ab9a0
MD5 b07c4a439b994b8d56d9affa0b27a97a
SHA1 c331f20b31445513ba06d64bce4839e968689afd
SHA512 096bd10bda3818af62df0a079212825b3af7d96038261b869fa7dfec5e2052d627cf09a44e1c80055f866a2099c1012c7e894e2a9a12312fb6b7aad584fcc07d
SSDEEP 96:XzPE/sjzQgdrTQTs9pbdq/vfRzCLfE1o4OpI6FNYF:zE/sjzQSqghMfRzCLBlHQF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjdpelnc.exe

Path C:\Windows\SysWOW64\Pjdpelnc.exe
Size 80KB
SHA256 262819d63a8472baa29b3842c8d1836c1e86ed471b868bfe6fd2259f0cecfe7c
MD5 cccc56e92a8899d1154aaceb32491986
SHA1 c339782b5f33dbfbedf412fa5281ea8106c18a98
SHA512 7f53bac6b65c705e08eaeda251e992390ef993272664140ac739c9be32e3af340abc5ed2b9dfd3342a04f9d170eb20d34d5231f50c6d0a2faa9e710b28b60bc6
SSDEEP 1536:jjF7OWbSDSBTkDLEmZ6CBd7SSSSltnqrm62OFO2LhC/S5DUHRbPa9b6i+sI:Yat2DLEmZ6qd7SSSSltnq7FThC/S5DSX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pjdpelnc.exe

Path C:\Windows\SysWOW64\Pjdpelnc.exe
Size 22KB
SHA256 8656a71a9412d20fb37d5ce5ce9c7a1d40ed857fe562de213222f8ae8519698e
MD5 0f6051f3cda07eaec57ddf3bf65e6815
SHA1 7eff4813aa3c5a33a3d297606aca8ee26c33e879
SHA512 8de223078000da10dc547e47c7cee15b695ab22b2a4cc7e14ea412d0f524e35fd26d2c82b05c127139c3d3ac4cd0680c4678973725543c8357173b46505fdb00
SSDEEP 384:vtlj6xYH5PLxtf2m3HxcMJxyZmWSL9GS42pJMGsxRXnSBQ54I8eTDLEw:Flj6+HF7tXxyIW69G4JMDnSBQGBeTDLb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pkedbmab.exe

Path C:\Windows\SysWOW64\Pkedbmab.exe
Size 199KB
SHA256 2e3e677782ad48516d7bcdbce20eab9f1edf1522ed8aef677f3315b61801bf74
MD5 c6be7def19163101b1e177e84e3af35c
SHA1 9a4579958685c7f6ab04fe917750d9f4468ea697
SHA512 78305e457882863cec74d66507682a0ac2a785a96516992dc34af6547aea9561454d935ff832f1ee34c140f7497e3e8ea685f3a74c80a7c70eb52bad8221dd33
SSDEEP 6144:TbTB8Fw7HkGwP7eSZSCZj81+jq4peBK034YOmFz1h:TKQkGwP3ZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ppahmb32.exe

Path C:\Windows\SysWOW64\Ppahmb32.exe
Size 27KB
SHA256 ad7f82df201c984d4f6c3caf305bbab29795b8b41c2f4192c8e9fae6b8d9e630
MD5 16cc90647bf1ea10fe5503790fbc5f1c
SHA1 0c9d70dba1743c0122afe03399d096ebe5e5c999
SHA512 f9edd455b325bb87751ca64efa99f9a3158aca0459fcd1cbbc0830989ed023e46a2b39d4e2d00f57f012e537570be573a188fd9208dd53e825cef73708d19337
SSDEEP 384:7bKyXFQmnNA/w5jyMbaf8IKIRnEk2dAR5mSBbosk/4UL2fZzGlbKJvQ18DCHwFv4:HJu4AAjyF1KIRnk+dlkL0GR7O9AZl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ppahmb32.exe

Path C:\Windows\SysWOW64\Ppahmb32.exe
Size 45KB
SHA256 c028669264d6c54d6b0021f5fa0c2518126283c263d456ecf41e7fb717aa74c3
MD5 b4d44477d564264c089b9a3c35e1ec7a
SHA1 c22f7ecf813a517848d5f87a03e05336e4baae62
SHA512 a64f54fa56495d5eceb1a8d351ef807c4ab37732239cda79315a965f0a74aaa5878d6ee97b76c87360ad2d0220759eb01ce2a8f208c9f15f696310892ce4f6fb
SSDEEP 768:HJu4AAjyF1KIRnk+dlkL0GR7O9AZQjPz69Uthfv7g:bNmPKgnk+dWJ7Oxz6KXU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ppolhcnm.exe

Path C:\Windows\SysWOW64\Ppolhcnm.exe
Size 199KB
SHA256 2d1be1061de05cd5f5abca9ea0087eae2ee04edbd852be15957b58cbc6d52575
MD5 68d612416bb1bfbe9b2ace9ac750fed9
SHA1 2a7eb18a98809a4251529567ea7d07acf855bf35
SHA512 048ab3fcc12d47c303b6358dc25f7d4d1f4c10a2ccb40b62c83bbc99aaf8f2a9c275818f3fb94bea5ed66382b505400772dc403311dd981bbdf7fe9f68c8938c
SSDEEP 6144:oJMB/BliZ/CSZSCZj81+jq4peBK034YOmFz1h:WMhBWHZSCG1+jheBbOmFxh
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ppolhcnm.exe

Path C:\Windows\SysWOW64\Ppolhcnm.exe
Size 57KB
SHA256 7209570feb189819966032a77ce587f9510fd2738e409b942e7b84c0c61e3ebf
MD5 212420ba42bef64f72d992598221f4a8
SHA1 274cfae1c9bd8048dd0cc48cef1c688efeca80a6
SHA512 6939a0eab3519e9c04d73636bdba72a845f94c1ab2a2863a7b779e4c888706f8377607bcc4cc5beb3e9b31488b429377a4b1dfbbc7eab32128fdfae2fea0a3e2
SSDEEP 1536:oJjLc0WE8nIjuyT5qMVpBp4jyZeyP3TNy2L+bS5f:oJjAB/nIiU5qlyZeyPR/CS5f
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qaqegecm.exe

Path C:\Windows\SysWOW64\Qaqegecm.exe
Size 12KB
SHA256 b6e295f83619feb0546f9e28f098e36a8243b2f8e4709e06cca62c2a05542658
MD5 d5cb1e1921d6de2b00c3c4ebcd835c7c
SHA1 0ac9ea33b1952ba5e03d276d83ae05c27e4a9710
SHA512 20ca7fa828ffd5ab8a0cec4bf81ee9e2e4bc854dfc71327e4a36a5dbbaed26da0e9c76bb655fceebed18999ebb87159d6e06cb7df6cb81be96e1234bfe2ebb93
SSDEEP 192:9ysJKFywSmWIOeVXuICxphHxP/34Uq21MHxz004G+iI+o41pJf/E77hHOHsE0kcN:166t134j5zAG+jafsnhHOMEIpPEcD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qaqegecm.exe

Path C:\Windows\SysWOW64\Qaqegecm.exe
Size 5KB
SHA256 f7b6cad003a2f7f29b4dca812b85d43b210ed2e529e719ac84607b2cf8b303ce
MD5 7a5e651d88b854ae25d7680976ea193a
SHA1 413a49c3b3aa4b785c3b19eb544477ded3f578fd
SHA512 92d23c7c705d741da9035dff8d813c82735b96fe04e5a6e61f1d549c01880cc2edace5ba503a06078cfe6f91f8a047e48d068492c99c925b39c4bc1ff9bcfa16
SSDEEP 96:XNZF7QaOgvJiLFwXwSNpyBsSF+7eVhJQPrs6bfvIhCxphHxP/3T:9ysJKFywSmWIOeVXuICxphHxP/3T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qfkqjmdg.exe

Path C:\Windows\SysWOW64\Qfkqjmdg.exe
Size 88KB
SHA256 79dddd6cf56146a576bb90afa822ee5482e729500fda2f0e11307f5999b003f3
MD5 85d73bbb3abc7900e06101f2f19d05af
SHA1 ac9d39eaacc4e7a01ac610941099f4ee4834c728
SHA512 8dd81e80e56eb3afca7acdeccbaf836d8de92081ebbe7e007f06d18f113e29b8e60942d623f5309f549b67490f87b7780436605b998f0670e9e5648814d81c48
SSDEEP 1536:qPbyeo0hS2XBWapNxD4K8tMymf07r2LFS5DUHRbPa9b6i+sImo6:qye5hJXBWLK86y77IFS5DSCopsImd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qfkqjmdg.exe

Path C:\Windows\SysWOW64\Qfkqjmdg.exe
Size 62KB
SHA256 594200d87d083107f00998ba8bc0cfa1a1d74ab0fa40af03048507f8236152e3
MD5 c8739d4a92a5a83b1bce8f3fd95f21ef
SHA1 9122f5e9a86a937db6ea0264b8ae75ce265f2bb6
SHA512 8db6fa2fb0cacc864611ee6f3ab65aeac99810a2d65acae4cd2b6871ae39fbeb97afb63d91f254183ee63b05bf46c4dc3ffd7e3bac4ceb871ab2a5ee3b0ffff0
SSDEEP 1536:qPbyeo0hS2XBWapNxD4K8tMymf07r2LFS5DUHX:qye5hJXBWLK86y77IFS5D8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Qhjmdp32.exe

Path C:\Windows\SysWOW64\Qhjmdp32.exe
Size 50KB
SHA256 4675e4d978eeb281c746e896587076ac5ff67a4fe48bda62336ab035593919aa
MD5 9121d420b625cc1a514b244d72def5b0
SHA1 ed4f427e7369c2a4a5d79d7b894627effe7a54a6
SHA512 8934a1604662443960bebac9a2f70604a279f225fa36345edf4dd0475d30861d94c43fb0b35802ca2644c90286bdc6bafae49d2cfa500dc3de79bd8972a30027
SSDEEP 1536:Q5ObmdORAkjeZcoVsAcOjPlOKQlksWm1XS1ncZih2L:QobIrkjeZcouijPlOJun76
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/368-233-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/556-318-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/788-316-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1004-366-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1156-306-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1300-41-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1388-352-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1416-344-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1484-154-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1496-354-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1620-130-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1676-242-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1796-304-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1816-56-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1844-98-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1848-258-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/1948-73-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2096-202-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2768-122-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2892-217-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2904-25-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2908-264-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2936-110-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/2952-17-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3216-9-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3444-82-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3472-65-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3492-360-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3548-280-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3568-145-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3592-226-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3612-255-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3772-336-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3844-90-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3956-186-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3984-212-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3992-33-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/3996-282-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4180-138-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4192-161-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4200-178-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4260-275-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4300-170-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4452-294-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4576-288-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4636-114-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4660-0-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4660-81-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4660-1-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4676-330-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4856-324-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4964-48-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/4988-193-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5148-372-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5188-378-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5228-384-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5272-393-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5312-396-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5352-402-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5436-413-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5472-418-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5512-424-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5556-430-0x0000000000400000-0x000000000043E000-memory.dmp

Download

memory/5596-436-0x0000000000400000-0x000000000043E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads