da43c912ee3553be9d5880b8845653a441407737f01e7fc029a0d4900289362d

Analysis

max time kernel
141s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13695e278df773031e475f54a3a88de2.exe
Size

174KB
MD5

13695e278df773031e475f54a3a88de2
SHA1

7a628c4e3ee90624475c3b986e542f3b07b62e21
SHA256

da43c912ee3553be9d5880b8845653a441407737f01e7fc029a0d4900289362d
SHA512

e291047c69fa4e7d51686e30f6b8a921faa7533ce97cd1257c57df64eb567785c6fa9b86cada7c392108340e299fd514a626c9d1fda4a519d506ffe96ae82ca6
SSDEEP

3072:EVUy6nFP8lutw01N6KVO4UMBfhRX82CU8nMNGXwQJv8iiG9XGXTawAXDXhG:EqyKkMBPpVluWN+Jv8iiG9GmE

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1636	cmd.exe

Executes dropped EXE 64 IoCs

pid	Process
2288	EXPL0RER.EXE
2804	EXPL0RER.EXE
2792	EXPL0RER.EXE
2668	EXPL0RER.EXE
2832	EXPL0RER.EXE
2284	EXPL0RER.EXE
1532	EXPL0RER.EXE
624	EXPL0RER.EXE
464	EXPL0RER.EXE
1384	EXPL0RER.EXE
1972	EXPL0RER.EXE
1112	EXPL0RER.EXE
2736	EXPL0RER.EXE
512	EXPL0RER.EXE
2308	EXPL0RER.EXE
1796	EXPL0RER.EXE
1628	EXPL0RER.EXE
112	EXPL0RER.EXE
2220	EXPL0RER.EXE
3044	EXPL0RER.EXE
2024	EXPL0RER.EXE
2176	EXPL0RER.EXE
2732	EXPL0RER.EXE
2796	EXPL0RER.EXE
2808	EXPL0RER.EXE
1432	EXPL0RER.EXE
2660	EXPL0RER.EXE
2532	EXPL0RER.EXE
2880	EXPL0RER.EXE
2136	EXPL0RER.EXE
1208	EXPL0RER.EXE
1592	EXPL0RER.EXE
2824	EXPL0RER.EXE
2500	EXPL0RER.EXE
1956	EXPL0RER.EXE
1492	EXPL0RER.EXE
2064	EXPL0RER.EXE
2268	EXPL0RER.EXE
1012	EXPL0RER.EXE
2112	EXPL0RER.EXE
1368	EXPL0RER.EXE
2252	EXPL0RER.EXE
1884	EXPL0RER.EXE
2144	EXPL0RER.EXE
1600	EXPL0RER.EXE
1616	EXPL0RER.EXE
2748	EXPL0RER.EXE
2784	EXPL0RER.EXE
2716	EXPL0RER.EXE
2568	EXPL0RER.EXE
1736	EXPL0RER.EXE
2588	EXPL0RER.EXE
1696	EXPL0RER.EXE
2132	EXPL0RER.EXE
764	EXPL0RER.EXE
1188	EXPL0RER.EXE
1356	EXPL0RER.EXE
2324	EXPL0RER.EXE
2416	EXPL0RER.EXE
2444	EXPL0RER.EXE
1604	EXPL0RER.EXE
368	EXPL0RER.EXE
2920	EXPL0RER.EXE
1304	EXPL0RER.EXE

Loads dropped DLL 64 IoCs

pid	Process
2640	regsvr32.exe
2504	13695e278df773031e475f54a3a88de2.exe
2504	13695e278df773031e475f54a3a88de2.exe
2388	regsvr32.exe
2288	EXPL0RER.EXE
2288	EXPL0RER.EXE
1432	regsvr32.exe
2804	EXPL0RER.EXE
2804	EXPL0RER.EXE
2560	regsvr32.exe
2792	EXPL0RER.EXE
2792	EXPL0RER.EXE
1736	regsvr32.exe
2668	EXPL0RER.EXE
2668	EXPL0RER.EXE
3028	regsvr32.exe
2832	EXPL0RER.EXE
2832	EXPL0RER.EXE
108	regsvr32.exe
2284	EXPL0RER.EXE
2284	EXPL0RER.EXE
1908	regsvr32.exe
1532	EXPL0RER.EXE
1532	EXPL0RER.EXE
584	regsvr32.exe
624	EXPL0RER.EXE
624	EXPL0RER.EXE
1328	regsvr32.exe
464	EXPL0RER.EXE
464	EXPL0RER.EXE
1980	regsvr32.exe
1384	EXPL0RER.EXE
1384	EXPL0RER.EXE
1484	regsvr32.exe
1972	EXPL0RER.EXE
1972	EXPL0RER.EXE
2424	regsvr32.exe
1112	EXPL0RER.EXE
1112	EXPL0RER.EXE
988	regsvr32.exe
2736	EXPL0RER.EXE
2736	EXPL0RER.EXE
1012	EXPL0RER.EXE
512	EXPL0RER.EXE
512	EXPL0RER.EXE
1776	regsvr32.exe
2308	EXPL0RER.EXE
2308	EXPL0RER.EXE
964	regsvr32.exe
1796	EXPL0RER.EXE
1796	EXPL0RER.EXE
656	regsvr32.exe
1628	EXPL0RER.EXE
1628	EXPL0RER.EXE
1560	regsvr32.exe
112	EXPL0RER.EXE
112	EXPL0RER.EXE
2436	regsvr32.exe
2220	EXPL0RER.EXE
2220	EXPL0RER.EXE
3032	regsvr32.exe
3044	EXPL0RER.EXE
3044	EXPL0RER.EXE
2188	regsvr32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	cmd.exe
File created	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	cmd.exe
File created	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	cmd.exe
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	Process not Found
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	conhost.exe
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	cmd.exe
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule64.DLL	cmd.exe
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	conhost.exe
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXE	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\SysModule64.DLL	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	cmd.exe
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\EXPL0RER.EXEabc	EXPL0RER.EXE
File created	C:\Windows\SysWOW64\SysModule32.DLL	EXPL0RER.EXE

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	cmd.exe
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	cmd.exe
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	cmd.exe
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	cmd.exe
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	regsvr32.exe
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	conhost.exe
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	regsvr32.exe
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File created	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE
File opened for modification	C:\Windows\MFCD3O.DLL	EXPL0RER.EXE

Program crash 11 IoCs

pid	pid_target	Process	procid_target
2984	2252	WerFault.exe	111
1536	1600	WerFault.exe	117
2568	2444	WerFault.exe	147
2724	1604	WerFault.exe	149
3004	1172	WerFault.exe	193
2528	2696	WerFault.exe	195
1608	364	WerFault.exe	203
3276	2560	WerFault.exe	229
3360	1740	WerFault.exe	281
3388	1520	WerFault.exe	285
2288	2924	WerFault.exe	430

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ = "C:\\Windows\\SysWow64\\SysModule64.DLL"	EXPL0RER.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ = "C:\\Windows\\SysWow64\\SysModule64.DLL"	EXPL0RER.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid\ = "{081FE200-A103-11D7-A46D-C770E4459F2F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID\ = "SysModule64.classname"	EXPL0RER.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ = "C:\\Windows\\SysWow64\\SysModule64.DLL"	EXPL0RER.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ = "hookmir"	EXPL0RER.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid\ = "{081FE200-A103-11D7-A46D-C770E4459F2F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ = "hookmir"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ThreadingModel = "Apartment"	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}	conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid\ = "{081FE200-A103-11D7-A46D-C770E4459F2F}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid\ = "{081FE200-A103-11D7-A46D-C770E4459F2F}"	conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ThreadingModel = "Apartment"	EXPL0RER.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ = "hookmir"	EXPL0RER.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ = "C:\\Windows\\SysWow64\\SysModule64.DLL"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32	EXPL0RER.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID	EXPL0RER.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\ = "hookmir"	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID	EXPL0RER.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ = "C:\\Windows\\SysWow64\\SysModule64.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname	EXPL0RER.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid	conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ = "hookmir"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ThreadingModel = "Apartment"	EXPL0RER.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid	EXPL0RER.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID	conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ = "C:\\Windows\\SysWow64\\SysModule64.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ = "hookmir"	conhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ProgID\ = "SysModule64.classname"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\ = "hookmir"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32	EXPL0RER.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ = "hookmir"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid\ = "{081FE200-A103-11D7-A46D-C770E4459F2F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}	EXPL0RER.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}	EXPL0RER.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\ = "hookmir"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid\ = "{081FE200-A103-11D7-A46D-C770E4459F2F}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\ = "hookmir"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}	EXPL0RER.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SysModule64.classname\Clsid\ = "{081FE200-A103-11D7-A46D-C770E4459F2F}"	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ = "C:\\Windows\\SysWow64\\SysModule64.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\ = "hookmir"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{081FE200-A103-11D7-A46D-C770E4459F2F}\InprocServer32\ = "C:\\Windows\\SysWow64\\SysModule64.DLL"	regsvr32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2640	2504	13695e278df773031e475f54a3a88de2.exe	28
PID 2504 wrote to memory of 2640	2504	13695e278df773031e475f54a3a88de2.exe	28
PID 2504 wrote to memory of 2640	2504	13695e278df773031e475f54a3a88de2.exe	28
PID 2504 wrote to memory of 2640	2504	13695e278df773031e475f54a3a88de2.exe	28
PID 2504 wrote to memory of 2640	2504	13695e278df773031e475f54a3a88de2.exe	28
PID 2504 wrote to memory of 2640	2504	13695e278df773031e475f54a3a88de2.exe	28
PID 2504 wrote to memory of 2640	2504	13695e278df773031e475f54a3a88de2.exe	28
PID 2504 wrote to memory of 2288	2504	13695e278df773031e475f54a3a88de2.exe	29
PID 2504 wrote to memory of 2288	2504	13695e278df773031e475f54a3a88de2.exe	29
PID 2504 wrote to memory of 2288	2504	13695e278df773031e475f54a3a88de2.exe	29
PID 2504 wrote to memory of 2288	2504	13695e278df773031e475f54a3a88de2.exe	29
PID 2288 wrote to memory of 2388	2288	EXPL0RER.EXE	30
PID 2288 wrote to memory of 2388	2288	EXPL0RER.EXE	30
PID 2288 wrote to memory of 2388	2288	EXPL0RER.EXE	30
PID 2288 wrote to memory of 2388	2288	EXPL0RER.EXE	30
PID 2288 wrote to memory of 2388	2288	EXPL0RER.EXE	30
PID 2288 wrote to memory of 2388	2288	EXPL0RER.EXE	30
PID 2288 wrote to memory of 2388	2288	EXPL0RER.EXE	30
PID 2288 wrote to memory of 2804	2288	EXPL0RER.EXE	31
PID 2288 wrote to memory of 2804	2288	EXPL0RER.EXE	31
PID 2288 wrote to memory of 2804	2288	EXPL0RER.EXE	31
PID 2288 wrote to memory of 2804	2288	EXPL0RER.EXE	31
PID 2804 wrote to memory of 1432	2804	EXPL0RER.EXE	32
PID 2804 wrote to memory of 1432	2804	EXPL0RER.EXE	32
PID 2804 wrote to memory of 1432	2804	EXPL0RER.EXE	32
PID 2804 wrote to memory of 1432	2804	EXPL0RER.EXE	32
PID 2804 wrote to memory of 1432	2804	EXPL0RER.EXE	32
PID 2804 wrote to memory of 1432	2804	EXPL0RER.EXE	32
PID 2804 wrote to memory of 1432	2804	EXPL0RER.EXE	32
PID 2804 wrote to memory of 2792	2804	EXPL0RER.EXE	33
PID 2804 wrote to memory of 2792	2804	EXPL0RER.EXE	33
PID 2804 wrote to memory of 2792	2804	EXPL0RER.EXE	33
PID 2804 wrote to memory of 2792	2804	EXPL0RER.EXE	33
PID 2792 wrote to memory of 2560	2792	EXPL0RER.EXE	34
PID 2792 wrote to memory of 2560	2792	EXPL0RER.EXE	34
PID 2792 wrote to memory of 2560	2792	EXPL0RER.EXE	34
PID 2792 wrote to memory of 2560	2792	EXPL0RER.EXE	34
PID 2792 wrote to memory of 2560	2792	EXPL0RER.EXE	34
PID 2792 wrote to memory of 2560	2792	EXPL0RER.EXE	34
PID 2792 wrote to memory of 2560	2792	EXPL0RER.EXE	34
PID 2792 wrote to memory of 2668	2792	EXPL0RER.EXE	35
PID 2792 wrote to memory of 2668	2792	EXPL0RER.EXE	35
PID 2792 wrote to memory of 2668	2792	EXPL0RER.EXE	35
PID 2792 wrote to memory of 2668	2792	EXPL0RER.EXE	35
PID 2668 wrote to memory of 1736	2668	EXPL0RER.EXE	36
PID 2668 wrote to memory of 1736	2668	EXPL0RER.EXE	36
PID 2668 wrote to memory of 1736	2668	EXPL0RER.EXE	36
PID 2668 wrote to memory of 1736	2668	EXPL0RER.EXE	36
PID 2668 wrote to memory of 1736	2668	EXPL0RER.EXE	36
PID 2668 wrote to memory of 1736	2668	EXPL0RER.EXE	36
PID 2668 wrote to memory of 1736	2668	EXPL0RER.EXE	36
PID 2668 wrote to memory of 2832	2668	EXPL0RER.EXE	37
PID 2668 wrote to memory of 2832	2668	EXPL0RER.EXE	37
PID 2668 wrote to memory of 2832	2668	EXPL0RER.EXE	37
PID 2668 wrote to memory of 2832	2668	EXPL0RER.EXE	37
PID 2832 wrote to memory of 3028	2832	EXPL0RER.EXE	38
PID 2832 wrote to memory of 3028	2832	EXPL0RER.EXE	38
PID 2832 wrote to memory of 3028	2832	EXPL0RER.EXE	38
PID 2832 wrote to memory of 3028	2832	EXPL0RER.EXE	38
PID 2832 wrote to memory of 3028	2832	EXPL0RER.EXE	38
PID 2832 wrote to memory of 3028	2832	EXPL0RER.EXE	38
PID 2832 wrote to memory of 3028	2832	EXPL0RER.EXE	38
PID 2832 wrote to memory of 2284	2832	EXPL0RER.EXE	39
PID 2832 wrote to memory of 2284	2832	EXPL0RER.EXE	39

C:\Users\Admin\AppData\Local\Temp\13695e278df773031e475f54a3a88de2.exe
"C:\Users\Admin\AppData\Local\Temp\13695e278df773031e475f54a3a88de2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
  2⤵
  - Loads dropped DLL
  PID:2640
- C:\Windows\SysWOW64\EXPL0RER.EXE
  C:\Windows\system32\EXPL0RER.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
    3⤵
    - Loads dropped DLL
    PID:2388
- - C:\Windows\SysWOW64\EXPL0RER.EXE
    C:\Windows\system32\EXPL0RER.EXE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
      4⤵
      Loads dropped DLL
      PID:1432
  - - C:\Windows\SysWOW64\EXPL0RER.EXE
      C:\Windows\system32\EXPL0RER.EXE
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2792
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:2560
    - - C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2668
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        6⤵
        Loads dropped DLL
        
        PID:1736
      - C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        7⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:3028
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2284
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        8⤵
        Loads dropped DLL
        
        PID:108
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:1532
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        9⤵
        Loads dropped DLL
        
        PID:1908
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:624
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        10⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:584
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:464
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        11⤵
        Loads dropped DLL
        
        PID:1328
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:1384
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        12⤵
        Loads dropped DLL
        
        PID:1980
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1972
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        13⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:1484
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:1112
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        14⤵
        Loads dropped DLL
        
        PID:2424
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2736
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        15⤵
        Loads dropped DLL
        
        PID:988
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:512
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        16⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2308
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        17⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:1776
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1796
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        18⤵
        Loads dropped DLL
        
        PID:964
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:1628
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        19⤵
        
        PID:656
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:112
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        20⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:1560
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2220
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        21⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:2436
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3044
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        22⤵
        Loads dropped DLL
        
        PID:3032
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        22⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2024
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        23⤵
        Loads dropped DLL
        
        PID:2188
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2176
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        24⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        24⤵
        Executes dropped EXE
        
        PID:2732
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        25⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        25⤵
        Executes dropped EXE
        
        PID:2796
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        26⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:2808
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        27⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1432
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        28⤵
        Modifies registry class
        
        PID:2788
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        28⤵
        Executes dropped EXE
        
        PID:2660
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        29⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        29⤵
        Executes dropped EXE
        
        PID:2532
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        30⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        30⤵
        Executes dropped EXE
        
        PID:2880
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        31⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        31⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2136
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        32⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        32⤵
        Executes dropped EXE
        
        PID:1208
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        33⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:1592
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        34⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        34⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2824
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        35⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        35⤵
        Executes dropped EXE
        
        PID:2500
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        36⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1956
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        37⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        37⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1492
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        38⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        38⤵
        Executes dropped EXE
        
        PID:2064
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        39⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        39⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2268
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        40⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        40⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Windows directory
        Modifies registry class
        
        PID:1012
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        41⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        41⤵
        Executes dropped EXE
        
        PID:2112
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        42⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1368
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        43⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:656
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        43⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2252
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        44⤵
        Modifies registry class
        
        PID:2976
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1884
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        45⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        45⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2144
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        46⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        46⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1600
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        47⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        47⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1616
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        48⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        48⤵
        Executes dropped EXE
        Drops file in Windows directory
        Modifies registry class
        
        PID:2748
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        49⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2784
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        50⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        50⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:2716
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        51⤵
        Modifies registry class
        
        PID:1804
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:2568
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        52⤵
        Modifies registry class
        
        PID:1812
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1736
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        53⤵
        Modifies registry class
        
        PID:2908
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        53⤵
        Executes dropped EXE
        
        PID:2588
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        54⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        54⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1696
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        55⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        55⤵
        Executes dropped EXE
        
        PID:2132
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        56⤵
        
        PID:680
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        56⤵
        Executes dropped EXE
        
        PID:764
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        57⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        57⤵
        Executes dropped EXE
        
        PID:1188
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        58⤵
        Modifies registry class
        
        PID:2052
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        58⤵
        Executes dropped EXE
        
        PID:1356
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        59⤵
        
        PID:668
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        59⤵
        Executes dropped EXE
        
        PID:2324
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        60⤵
        Modifies registry class
        
        PID:1104
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:2416
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        61⤵
        
        PID:772
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        61⤵
        Executes dropped EXE
        
        PID:2444
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        62⤵
        
        PID:280
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        62⤵
        Executes dropped EXE
        Drops file in Windows directory
        
        PID:1604
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        63⤵
        
        PID:760
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        63⤵
        Executes dropped EXE
        
        PID:368
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        64⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        64⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        65⤵
        Modifies registry class
        
        PID:2396
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Modifies registry class
        
        PID:1304
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        66⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        66⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        67⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        67⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        68⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        68⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        69⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        69⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        70⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        70⤵
        Drops file in Windows directory
        
        PID:2576
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        71⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        71⤵
        Drops file in Windows directory
        
        PID:3012
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        72⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        72⤵
        Drops file in System32 directory
        
        PID:2848
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        73⤵
        
        PID:364
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        73⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:2380
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        74⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        74⤵
        Drops file in System32 directory
        
        PID:3048
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        75⤵
        
        PID:588
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        75⤵
        
        PID:544
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        76⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        76⤵
        Modifies registry class
        
        PID:1756
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        77⤵
        
        PID:572
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        77⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        78⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        78⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        79⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        79⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        80⤵
        
        PID:480
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        80⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        81⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        81⤵
        
        PID:456
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        82⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        82⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        83⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        83⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        84⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        84⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        85⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        85⤵
        Drops file in System32 directory
        
        PID:2696
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        86⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        86⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:2664
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        87⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        87⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        88⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        88⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        89⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        89⤵
        Drops file in Windows directory
        Modifies registry class
        
        PID:364
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        90⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        90⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:1908
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        91⤵
        
        PID:520
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        91⤵
        
        PID:680
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        92⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        92⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        93⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        93⤵
        Drops file in System32 directory
        
        PID:1656
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        94⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        94⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        95⤵
        
        PID:240
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        95⤵
        Drops file in Windows directory
        Modifies registry class
        
        PID:772
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        96⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        96⤵
        Drops file in Windows directory
        
        PID:1392
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        97⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        97⤵
        Modifies registry class
        
        PID:2972
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        98⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        98⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        99⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        99⤵
        Drops file in System32 directory
        
        PID:876
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        100⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        100⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        101⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        101⤵
        Drops file in Windows directory
        Modifies registry class
        
        PID:2708
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        102⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        102⤵
        Drops file in Windows directory
        Modifies registry class
        
        PID:2560
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        103⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        103⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        104⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        104⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        105⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        105⤵
        Drops file in Windows directory
        
        PID:3016
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        106⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        106⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:1332
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        107⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        107⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:2060
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        108⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        108⤵
        
        PID:2728
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        109⤵
        
        PID:904
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        109⤵
        Drops file in System32 directory
        
        PID:1544
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        110⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        110⤵
        Drops file in System32 directory
        
        PID:2184
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        111⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        111⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        112⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        112⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        113⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        113⤵
        Modifies registry class
        
        PID:1612
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        114⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        114⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        115⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        115⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2600
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        116⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        116⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        117⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        117⤵
        Drops file in System32 directory
        
        PID:584
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        118⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        118⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        119⤵
        
        PID:832
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        119⤵
        Drops file in Windows directory
        
        PID:1572
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        120⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        120⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:2328
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        121⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        121⤵
        Drops file in Windows directory
        Modifies registry class
        
        PID:2116
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        122⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        122⤵
        Drops file in System32 directory
        
        PID:1740
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        123⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        123⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        124⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        124⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:1680
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        125⤵
        Modifies registry class
        
        PID:2320
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        125⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        126⤵
        
        PID:520
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        126⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        127⤵
        
        PID:948
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        127⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:3052
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        128⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        128⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        129⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        129⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        130⤵
        
        PID:2548
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        130⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        131⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        131⤵
        Drops file in System32 directory
        
        PID:1296
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        132⤵
        
        PID:988
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        132⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        133⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        133⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:520
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        134⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        134⤵
        Drops file in System32 directory
        
        PID:1548
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        135⤵
        Modifies registry class
        
        PID:1924
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        135⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:3040
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        136⤵
        Modifies registry class
        
        PID:964
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        136⤵
        Drops file in Windows directory
        
        PID:2384
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        137⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        137⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        138⤵
        
        PID:464
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        138⤵
        Drops file in Windows directory
        
        PID:2924
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        139⤵
        
        PID:280
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        139⤵
        Drops file in Windows directory
        
        PID:2480
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        140⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        140⤵
        Drops file in System32 directory
        
        PID:2000
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        141⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        141⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        142⤵
        Modifies registry class
        
        PID:2692
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        142⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        143⤵
        Drops file in Windows directory
        Modifies registry class
        
        PID:544
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        143⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        144⤵
        
        PID:388
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        144⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        145⤵
        Modifies registry class
        
        PID:1132
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        145⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        146⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        146⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:1516
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        147⤵
        Modifies registry class
        
        PID:3204
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        147⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        148⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        148⤵
        Drops file in System32 directory
        
        PID:2440
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        149⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        149⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        150⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        150⤵
        Drops file in System32 directory
        
        PID:3596
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        151⤵
        Modifies registry class
        
        PID:3708
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        151⤵
        Drops file in System32 directory
        
        PID:2512
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        152⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        152⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:3848
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        153⤵
        Modifies registry class
        
        PID:3908
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        153⤵
        Drops file in Windows directory
        
        PID:3916
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        154⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        154⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        155⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        155⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        156⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        156⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:3556
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        157⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        157⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32.exe /s C:\Windows\system32\SysModule64.DLL
        158⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\EXPL0RER.EXE
        
        C:\Windows\system32\EXPL0RER.EXE
        158⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        158⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        157⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        156⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        155⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        154⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        153⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        152⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        151⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        150⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        149⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        148⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        147⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        146⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        145⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        144⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        143⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        142⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        141⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        140⤵
        Drops file in System32 directory
        
        PID:1492
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 144
        139⤵
        Program crash
        
        PID:2288
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        138⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        137⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        136⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        135⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        134⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        133⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        132⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        131⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        130⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        129⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        128⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        127⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        126⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        125⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 144
        124⤵
        Program crash
        
        PID:3388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 144
        123⤵
        Program crash
        
        PID:3360
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        122⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        121⤵
        
        PID:3124
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        120⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        119⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        118⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        117⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        116⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        115⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        114⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        113⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        112⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        111⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        110⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        109⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        108⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        107⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        106⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        105⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        104⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2560 -s 144
        103⤵
        Program crash
        
        PID:3276
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        102⤵
        
        PID:3268
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        101⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        100⤵
        
        PID:3212
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        99⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        98⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        97⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        96⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:1892
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        95⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        94⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        93⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        92⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:2868
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        91⤵
        
        PID:888
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 144
        90⤵
        Program crash
        
        PID:1608
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        89⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        88⤵
        Drops file in System32 directory
        
        PID:2492
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        87⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 144
        86⤵
        Program crash
        
        PID:2528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 144
        85⤵
        Program crash
        
        PID:3004
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        84⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        83⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        82⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        81⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        80⤵
        
        PID:280
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        79⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        78⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        77⤵
        
        PID:2544
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        76⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        75⤵
        
        PID:464
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        74⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        73⤵
        Modifies registry class
        
        PID:2756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        72⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:368
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        71⤵
        Drops file in System32 directory
        
        PID:1012
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        70⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        69⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        68⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        67⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        66⤵
        
        PID:820
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        65⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        64⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 144
        63⤵
        Program crash
        
        PID:2724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 144
        62⤵
        Program crash
        
        PID:2568
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        61⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        60⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        59⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        58⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        57⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        56⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        55⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        54⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        53⤵
        
        PID:804
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        52⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        51⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        50⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        49⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        48⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 144
        47⤵
        Program crash
        
        PID:1536
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        46⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        45⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 144
        44⤵
        Program crash
        
        PID:2984
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        43⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        42⤵
        
        PID:512
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        41⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        40⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        39⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        38⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        37⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        36⤵
        
        PID:480
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        35⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        34⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        33⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        32⤵
        
        PID:112
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        31⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        30⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        29⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        28⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        27⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        26⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        25⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        24⤵
        
        PID:464
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        23⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        22⤵
        Modifies registry class
        
        PID:2424
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        21⤵
        Modifies registry class
        
        PID:1968
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        20⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        19⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        18⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        17⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        16⤵
        Modifies registry class
        
        PID:2516
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        15⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        14⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        13⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        12⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        11⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        10⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        9⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        8⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        7⤵
        
        PID:2744
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        6⤵
        
        PID:2188
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c C:\Windows\SysWOW64\$$336699.bat
        5⤵
        
        PID:2228
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\SysWOW64\$$336699.bat
      4⤵
      PID:1148
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Windows\SysWOW64\$$336699.bat
    3⤵
    PID:1440
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\$$336699.bat
  2⤵
  - Deletes itself
  PID:1636

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "33773168019127711541458972974-6024846561398371735-1721423126-6116022291960288334"
1⤵
PID:2040

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "27726207-233397842-10775134716987827581573566829-6792988741429192767345282643"
1⤵
- Modifies registry class
PID:2584

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "6589884751796543021-16246614541728384516-20527464681756293724-133132259-1614576082"
1⤵
PID:1088

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-9903250551562324253-881233191-730375636-2007878929772287029-1033417190-473966451"
1⤵
PID:668

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "946385100-100723301218238775551224098333-45371970614407741181133080979-182597711"
1⤵
PID:2388

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1908790023-1070843583-308959411285691218-1970166579-52351998317912436701028706309"
1⤵
- Modifies registry class
PID:280

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-2798060001239102015725845489-156318098742202674-698174007-139125021701286410"
1⤵
PID:2744

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "130911429216515115781059665945-52765514983605226820302788081118028811963460254"
1⤵
PID:1508

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-933869431419630080-307196839707252521-1456766439-9696253731134441849-528211094"
1⤵
- Modifies registry class
PID:1256

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1532

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "15711312011845411213-605419728-499413096-16083341441610782381-671341428692495417"
1⤵
PID:904

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-16326059962124232850-1210727343-2044275319-1788045719-4138115142466737971104130378"
1⤵
PID:2828

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-38014188213518750041021898112212631070-1447647640688793815851605151-117790527"
1⤵
PID:988

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "10391345211937058629701915609-1766537490107449977-20078946881871359270-128994639"
1⤵
- Modifies registry class
PID:1716

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "263230183-6854261441829505179-19969678678796801161606939767555837047298726922"
1⤵
PID:588

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1473318515-548403018-338196889-328172053986894774-18874351011106490800-1379919615"
1⤵
PID:2548

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "3223020551508439596-12748965401984267781-1431701182148490084018324775651089851360"
1⤵
- Drops file in System32 directory
PID:1720

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-5375522181135758738-5866958321590133310-476996530-1956559906-1076307104-958046709"
1⤵
- Modifies registry class
PID:948

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "14085945521174360276-1444547184-15871671071649740854109361163-17966502751050149589"
1⤵
PID:2264

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-783638343-175592529361082870-660591368-403744364-20472415441570062831-686425621"
1⤵
- Drops file in Windows directory
PID:1476

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "311367963-20137482323346328181409850081-5750718258113943601481534293310623810"
1⤵
- Modifies registry class
PID:2372

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-163694047984931363252818078-115655452019520288611571797216792685714682519083"
1⤵
- Drops file in System32 directory
PID:2360

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1325995034-8339240031328872654-20593101621191234086-936944641881901391-1647396356"
1⤵
PID:456

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-827058489-755301260-1342056910-1940543626-2035658018-54748736510541424671424190207"
1⤵
PID:240

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1715791213-388966132-164242291410229458381858276988603341505-16562017021731421961"
1⤵
PID:1192

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1320440740483800665-131300946319904430561587067448276390409-1197450578-369953014"
1⤵
PID:2972

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "651539540-8276953891842483425-1174602981-2078520105489320730-917012354-274730251"
1⤵
PID:2120

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-955662788-1663378695260716940-13550960412039845194-33326976214499366491047177523"
1⤵
- Modifies registry class
PID:3824

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1134523198-1271991866-831096137-1441851418166968396498258011551995948991761365"
1⤵
PID:2796

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1842584946-387929507825323996597853163-527979070-314948232-10299082411630443638"
1⤵
PID:3080

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-11632223255731286251401814636240426197-872301540-184735284-11068516251856349256"
1⤵
PID:3284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\$$336699.bat

Filesize
231B

MD5
ea1926db990d7ef4e1403ba9e769d980

SHA1
1dea24f92036b0b97d4838908546630e1f3d43a5

SHA256
22bd6c6191e396b103c1ba2635d554ac5de26d2faf197909dd59bfcb704b4dac

SHA512
962c98e06fab54e429370caedd51deb84f96749646d3c9179b23e71f2c345b36409fa3cbefc18575cb25daf6ee95c73705495fcb684cb7032f3187bd815e8437

Download Submit
C:\Windows\SysWOW64\$$336699.bat

Filesize
141B

MD5
e3efc16ca26ae31f9885ee9549ff1f82

SHA1
4321f47a61712ffbbad7a39691359474db4b947c

SHA256
a03f261cc17b929ef96c2faeef03b77af3b62ab84bbb73a79beb84878b1bfa61

SHA512
f376e9be088782e394d21958bcdb5e7f00605b05290eff1320d64d5a76bfa619c260c8b5d971e7015bb118f0dd13ad73033f76e55b717611bc1a7d876f8e62ab

Download Submit
C:\Windows\SysWOW64\EXPL0RER.EXE

Filesize
174KB

MD5
13695e278df773031e475f54a3a88de2

SHA1
7a628c4e3ee90624475c3b986e542f3b07b62e21

SHA256
da43c912ee3553be9d5880b8845653a441407737f01e7fc029a0d4900289362d

SHA512
e291047c69fa4e7d51686e30f6b8a921faa7533ce97cd1257c57df64eb567785c6fa9b86cada7c392108340e299fd514a626c9d1fda4a519d506ffe96ae82ca6

Download Submit
C:\Windows\SysWOW64\SysModule32.DLL

Filesize
49KB

MD5
80cdcab6c2947250e4e538a0a3fd9ad2

SHA1
b67acc78525e645ca5d81d35576f11b0475e274c

SHA256
b116a4659f14427e155a5bc7b14bfcaca866bb3817b6414b394bc3f7f077cd3e

SHA512
9b84d71bf516046bf78d27a02312ff5daeb8bf010bfbfdfbe729d539f9420bf0ffce1528de9e714878a14db5f5b9bb72ef1d6f92c0a40a6c88b1ac9b70dc0cd0

Download Submit
C:\Windows\SysWOW64\SysModule64.DLL

Filesize
65KB

MD5
ce0264955b0d93729cae5837ad4c4ad7

SHA1
8aa9b81e0285eb0c92c1e144716fa4337d578bc1

SHA256
b8832481e2a34ee6360653aaa3591fefcd002183f3487ce4f1cbe00056d5dbbc

SHA512
baca61d5b91ff09953c36f076dfb9f3d03eb5e9dbc13eab329e03439529c13b299fbcbe59a72b12ab369d332c598230fbd6897ce96f5696b088df5feb9eebc4d

Download Submit
memory/112-723-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/464-634-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/584-144-0x00000000001C0000-0x00000000001D6000-memory.dmp

Filesize
88KB

Download
memory/624-633-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/656-511-0x0000000000140000-0x0000000000156000-memory.dmp

Filesize
88KB

Download
memory/656-248-0x0000000000100000-0x0000000000116000-memory.dmp

Filesize
88KB

Download
memory/680-656-0x00000000002B0000-0x00000000002C6000-memory.dmp

Filesize
88KB

Download
memory/1432-49-0x0000000000180000-0x0000000000196000-memory.dmp

Filesize
88KB

Download
memory/1484-182-0x00000000001B0000-0x00000000001C6000-memory.dmp

Filesize
88KB

Download
memory/1532-632-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1628-716-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1736-82-0x0000000000130000-0x0000000000146000-memory.dmp

Filesize
88KB

Download
memory/1748-398-0x0000000000240000-0x0000000000256000-memory.dmp

Filesize
88KB

Download
memory/1776-226-0x00000000001F0000-0x0000000000206000-memory.dmp

Filesize
88KB

Download
memory/1796-715-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1904-420-0x0000000000110000-0x0000000000126000-memory.dmp

Filesize
88KB

Download
memory/2024-730-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2084-484-0x0000000000150000-0x0000000000166000-memory.dmp

Filesize
88KB

Download
memory/2216-334-0x00000000000D0000-0x00000000000E6000-memory.dmp

Filesize
88KB

Download
memory/2220-724-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2284-631-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2288-496-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2388-33-0x00000000000C0000-0x00000000000D6000-memory.dmp

Filesize
88KB

Download
memory/2504-489-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2536-409-0x0000000000430000-0x0000000000446000-memory.dmp

Filesize
88KB

Download
memory/2640-14-0x0000000000170000-0x0000000000186000-memory.dmp

Filesize
88KB

Download
memory/2668-500-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2672-323-0x00000000002F0000-0x0000000000306000-memory.dmp

Filesize
88KB

Download
memory/2792-499-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2804-498-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2832-630-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3044-725-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download