1d8457308e26f871547aa1bbe6cb2c3367bd7af6c2b8f538921488ae9f254e22

Analysis

max time kernel
129s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-03-2024 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d8457308e26f871547aa1bbe6cb2c3367bd7af6c2b8f538921488ae9f254e22.exe
Size

224KB
MD5

dd72cb919530c4a5e60ef31106f2c25a
SHA1

149865567089ffec97009361e75e9ca6305803c8
SHA256

1d8457308e26f871547aa1bbe6cb2c3367bd7af6c2b8f538921488ae9f254e22
SHA512

f48eadc65a9e6b02a2e0e4da8c0ba07b490e60ed2452e4ea65f8d187de9ba0f06892d9423a26eb639d4b3720c0d597e482829fceff9995b35b697307c4158de4
SSDEEP

6144:beDM6k+HME4f9FIUpOVw86CmOJfTo9FIUIhrcflDML:63aAD6RrI1+lDML

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dhcnke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eodlho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gqfooodg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qlpllkmc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeacko32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpjmee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dpjflb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecmlcmhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdhbec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbggce32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qiappono.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahkflk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cakjmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebploj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bbljeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Laefdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ccjfgphj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Coagla32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fckhdk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hikfip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kpccnefa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lpcmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ecphimfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdjfcecp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgphpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Debeijoc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjlfbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ppgobjia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Apndbici.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fjnjqfij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fifdgblo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fodeolof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aeoffo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbqefhpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aldegj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbcakg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdemhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pihmjqfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fmmfmbhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Plifll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pimfep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Blennh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bpcgdfaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjjmog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Peonoaln.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chbedh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icgqggce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ijdeiaio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jagqlj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Majopeii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ahkflk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Debeijoc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifjfnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmqgnhmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mpaifalo.exe

Executes dropped EXE 64 IoCs

pid	Process
840	Oiagia32.exe
3944	Olocem32.exe
4808	Onnoah32.exe
3724	Oalknd32.exe
2636	Oiccoa32.exe
3144	Olapkmic.exe
4548	Pnplghhf.exe
5104	Paohccgj.exe
952	Piepdahl.exe
4192	Ppphak32.exe
4040	Pbndmf32.exe
4264	Paaeiceg.exe
3156	Pihmjqfj.exe
3432	Phkmem32.exe
872	Pneebg32.exe
3128	Peonoaln.exe
2344	Pijjpp32.exe
2720	Phmjkmka.exe
2696	Plifll32.exe
816	Ppdbljkd.exe
2388	Pbbnhfjh.exe
3728	Paendb32.exe
2220	Pimfep32.exe
3684	Phpfqmio.exe
2840	Plkbak32.exe
4676	Ppgobjia.exe
2532	Pniomgpl.exe
1188	Pahkjbop.exe
1400	Piockppb.exe
3140	Phbcfl32.exe
3744	Plmogkoe.exe
3644	Qpikgj32.exe
3624	Qbggce32.exe
4804	Qajhobmm.exe
3204	Qefdpq32.exe
1632	Qiappono.exe
448	Qlpllkmc.exe
1124	Qamdda32.exe
2200	Qiclfo32.exe
4240	Albibj32.exe
4312	Apndbici.exe
4616	Aaoaja32.exe
844	Aldegj32.exe
3292	Ahkflk32.exe
4556	Aeoffo32.exe
768	Ahncbk32.exe
2944	Aogkoedl.exe
1836	Aeacko32.exe
5100	Alkkhi32.exe
876	Aedpaoif.exe
5052	Blnhni32.exe
5004	Bakqfp32.exe
624	Bhdibj32.exe
3936	Bpladg32.exe
1052	Bbjmpb32.exe
3208	Bidemmnj.exe
4956	Blbaihmn.exe
2428	Bbljeb32.exe
4308	Bekfan32.exe
4220	Blennh32.exe
5076	Bpqjofcd.exe
4868	Baaggo32.exe
2296	Biiohl32.exe
1012	Blgkdg32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nphqml32.dll	Jkfkfohj.exe
File opened for modification	C:\Windows\SysWOW64\Mkgmcjld.exe	Mcpebmkb.exe
File opened for modification	C:\Windows\SysWOW64\Pihmjqfj.exe	Paaeiceg.exe
File created	C:\Windows\SysWOW64\Fokbim32.exe	Fmmfmbhn.exe
File created	C:\Windows\SysWOW64\Piockppb.exe	Pecgja32.exe
File created	C:\Windows\SysWOW64\Qamdda32.exe	Qlpllkmc.exe
File opened for modification	C:\Windows\SysWOW64\Lkdggmlj.exe	Lcmofolg.exe
File opened for modification	C:\Windows\SysWOW64\Mdfofakp.exe	Mpkbebbf.exe
File opened for modification	C:\Windows\SysWOW64\Oiccoa32.exe	Oalknd32.exe
File opened for modification	C:\Windows\SysWOW64\Gjclbc32.exe	Gfhqbe32.exe
File created	C:\Windows\SysWOW64\Mdemcacc.dll	Lnepih32.exe
File created	C:\Windows\SysWOW64\Fijmbb32.exe	Fflaff32.exe
File created	C:\Windows\SysWOW64\Kgdbkohf.exe	Kdffocib.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Ndidbn32.exe
File opened for modification	C:\Windows\SysWOW64\Qajhobmm.exe	Qbggce32.exe
File created	C:\Windows\SysWOW64\Iabgaklg.exe	Iikopmkd.exe
File created	C:\Windows\SysWOW64\Lnjjdgee.exe	Lcdegnep.exe
File opened for modification	C:\Windows\SysWOW64\Mpkbebbf.exe	Mjqjih32.exe
File opened for modification	C:\Windows\SysWOW64\Ndidbn32.exe	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Blgkdg32.exe	Biiohl32.exe
File opened for modification	C:\Windows\SysWOW64\Jagqlj32.exe	Jjmhppqd.exe
File created	C:\Windows\SysWOW64\Lcmofolg.exe	Ldkojb32.exe
File created	C:\Windows\SysWOW64\Jpgeph32.dll	Laefdf32.exe
File created	C:\Windows\SysWOW64\Fcdjjo32.dll	Nacbfdao.exe
File created	C:\Windows\SysWOW64\Nnolfdcn.exe	Ngedij32.exe
File opened for modification	C:\Windows\SysWOW64\Pnplghhf.exe	Olapkmic.exe
File created	C:\Windows\SysWOW64\Dcfebonm.exe	Dphifcoi.exe
File created	C:\Windows\SysWOW64\Ecbenm32.exe	Eofinnkf.exe
File opened for modification	C:\Windows\SysWOW64\Liggbi32.exe	Lkdggmlj.exe
File opened for modification	C:\Windows\SysWOW64\Qlpllkmc.exe	Qiappono.exe
File created	C:\Windows\SysWOW64\Bekfan32.exe	Bbljeb32.exe
File created	C:\Windows\SysWOW64\Jcgaen32.dll	Ehonfc32.exe
File created	C:\Windows\SysWOW64\Bbbjnidp.dll	Jmnaakne.exe
File created	C:\Windows\SysWOW64\Bpqnnk32.dll	Iabgaklg.exe
File created	C:\Windows\SysWOW64\Nngcpm32.dll	Lkgdml32.exe
File created	C:\Windows\SysWOW64\Nbhkac32.exe	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Onnoah32.exe	Olocem32.exe
File opened for modification	C:\Windows\SysWOW64\Pbbnhfjh.exe	Ppdbljkd.exe
File opened for modification	C:\Windows\SysWOW64\Pimfep32.exe	Paendb32.exe
File opened for modification	C:\Windows\SysWOW64\Gbcakg32.exe	Gcpapkgp.exe
File created	C:\Windows\SysWOW64\Ehhgfdho.exe	Efikji32.exe
File created	C:\Windows\SysWOW64\Fmclmabe.exe	Fckhdk32.exe
File created	C:\Windows\SysWOW64\Ipmack32.dll	Ibccic32.exe
File opened for modification	C:\Windows\SysWOW64\Laefdf32.exe	Lnjjdgee.exe
File created	C:\Windows\SysWOW64\Djlddi32.exe	Dcalgo32.exe
File created	C:\Windows\SysWOW64\Omccgkde.dll	Dcdimopp.exe
File created	C:\Windows\SysWOW64\Pihmjqfj.exe	Paaeiceg.exe
File created	C:\Windows\SysWOW64\Bcnoenkc.dll	Bpqjofcd.exe
File created	C:\Windows\SysWOW64\Cccpfa32.exe	Cpedjf32.exe
File created	C:\Windows\SysWOW64\Gmlfmg32.dll	Hbeghene.exe
File opened for modification	C:\Windows\SysWOW64\Gmhfhp32.exe	Gbcakg32.exe
File opened for modification	C:\Windows\SysWOW64\Iabgaklg.exe	Iikopmkd.exe
File created	C:\Windows\SysWOW64\Jifkeoll.dll	Lmqgnhmp.exe
File created	C:\Windows\SysWOW64\Liggbi32.exe	Lkdggmlj.exe
File created	C:\Windows\SysWOW64\Bebboiqi.dll	Mjjmog32.exe
File opened for modification	C:\Windows\SysWOW64\Phbcfl32.exe	Piockppb.exe
File opened for modification	C:\Windows\SysWOW64\Bpcgdfaa.exe	Blgkdg32.exe
File created	C:\Windows\SysWOW64\Eckonn32.exe	Elagacbk.exe
File created	C:\Windows\SysWOW64\Jjcfkp32.dll	Hpgkkioa.exe
File created	C:\Windows\SysWOW64\Hmjdia32.dll	Hbanme32.exe
File created	C:\Windows\SysWOW64\Ijaida32.exe	Iffmccbi.exe
File created	C:\Windows\SysWOW64\Kaemnhla.exe	Kinemkko.exe
File created	C:\Windows\SysWOW64\Odegmceb.dll	Mjeddggd.exe
File created	C:\Windows\SysWOW64\Eofinnkf.exe	Efneehef.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8336	8224	WerFault.exe	370

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Iakaql32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fifdgblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fldggfbc.dll"	Lcdegnep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aldegj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jknmmijf.dll"	Biiohl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eqbmje32.dll"	Lpappc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kohgjl32.dll"	Ppgobjia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Badcln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fopfdhej.dll"	Cpgqpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	1d8457308e26f871547aa1bbe6cb2c3367bd7af6c2b8f538921488ae9f254e22.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpckhigh.dll"	Gbcakg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfnnkfbe.dll"	Ahncbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogdimilg.dll"	Kpmfddnf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Coagla32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Diihojkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhddbjig.dll"	Phmjkmka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Badcln32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gfhqbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Habnjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpqnnk32.dll"	Iabgaklg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Molpnchg.dll"	Ahkflk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qlpllkmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pihmjqfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdcfcpdf.dll"	Eofinnkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gmkbnp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Paaeiceg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aedpaoif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpcbnd32.dll"	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnohlokp.dll"	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ahncbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aaoaja32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Baaggo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Blgkdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpgeph32.dll"	Laefdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Phbcfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpqikhah.dll"	Chphoh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oalknd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cefemliq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gfcgge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ijaida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqjfoc32.dll"	Kdaldd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Blbaihmn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kaemnhla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibmndm32.dll"	Bbjmpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oddojp32.dll"	Aogkoedl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dpacfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Offdjb32.dll"	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pihmjqfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jkfkfohj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kdhbec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Laefdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipkobd32.dll"	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dacdmi32.dll"	Dphifcoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chnlihnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fbqefhpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gqfooodg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oiccoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mjjmog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Legdcg32.dll"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkeang32.dll"	Nnjbke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmelmhjn.dll"	Pahkjbop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 840	2292	1d8457308e26f871547aa1bbe6cb2c3367bd7af6c2b8f538921488ae9f254e22.exe	91
PID 2292 wrote to memory of 840	2292	1d8457308e26f871547aa1bbe6cb2c3367bd7af6c2b8f538921488ae9f254e22.exe	91
PID 2292 wrote to memory of 840	2292	1d8457308e26f871547aa1bbe6cb2c3367bd7af6c2b8f538921488ae9f254e22.exe	91
PID 840 wrote to memory of 3944	840	Oiagia32.exe	92
PID 840 wrote to memory of 3944	840	Oiagia32.exe	92
PID 840 wrote to memory of 3944	840	Oiagia32.exe	92
PID 3944 wrote to memory of 4808	3944	Olocem32.exe	93
PID 3944 wrote to memory of 4808	3944	Olocem32.exe	93
PID 3944 wrote to memory of 4808	3944	Olocem32.exe	93
PID 4808 wrote to memory of 3724	4808	Onnoah32.exe	94
PID 4808 wrote to memory of 3724	4808	Onnoah32.exe	94
PID 4808 wrote to memory of 3724	4808	Onnoah32.exe	94
PID 3724 wrote to memory of 2636	3724	Oalknd32.exe	95
PID 3724 wrote to memory of 2636	3724	Oalknd32.exe	95
PID 3724 wrote to memory of 2636	3724	Oalknd32.exe	95
PID 2636 wrote to memory of 3144	2636	Oiccoa32.exe	96
PID 2636 wrote to memory of 3144	2636	Oiccoa32.exe	96
PID 2636 wrote to memory of 3144	2636	Oiccoa32.exe	96
PID 3144 wrote to memory of 4548	3144	Olapkmic.exe	97
PID 3144 wrote to memory of 4548	3144	Olapkmic.exe	97
PID 3144 wrote to memory of 4548	3144	Olapkmic.exe	97
PID 4548 wrote to memory of 5104	4548	Pnplghhf.exe	98
PID 4548 wrote to memory of 5104	4548	Pnplghhf.exe	98
PID 4548 wrote to memory of 5104	4548	Pnplghhf.exe	98
PID 5104 wrote to memory of 952	5104	Paohccgj.exe	99
PID 5104 wrote to memory of 952	5104	Paohccgj.exe	99
PID 5104 wrote to memory of 952	5104	Paohccgj.exe	99
PID 952 wrote to memory of 4192	952	Piepdahl.exe	100
PID 952 wrote to memory of 4192	952	Piepdahl.exe	100
PID 952 wrote to memory of 4192	952	Piepdahl.exe	100
PID 4192 wrote to memory of 4040	4192	Ppphak32.exe	101
PID 4192 wrote to memory of 4040	4192	Ppphak32.exe	101
PID 4192 wrote to memory of 4040	4192	Ppphak32.exe	101
PID 4040 wrote to memory of 4264	4040	Pbndmf32.exe	102
PID 4040 wrote to memory of 4264	4040	Pbndmf32.exe	102
PID 4040 wrote to memory of 4264	4040	Pbndmf32.exe	102
PID 4264 wrote to memory of 3156	4264	Paaeiceg.exe	103
PID 4264 wrote to memory of 3156	4264	Paaeiceg.exe	103
PID 4264 wrote to memory of 3156	4264	Paaeiceg.exe	103
PID 3156 wrote to memory of 3432	3156	Pihmjqfj.exe	104
PID 3156 wrote to memory of 3432	3156	Pihmjqfj.exe	104
PID 3156 wrote to memory of 3432	3156	Pihmjqfj.exe	104
PID 3432 wrote to memory of 872	3432	Phkmem32.exe	105
PID 3432 wrote to memory of 872	3432	Phkmem32.exe	105
PID 3432 wrote to memory of 872	3432	Phkmem32.exe	105
PID 872 wrote to memory of 3128	872	Pneebg32.exe	106
PID 872 wrote to memory of 3128	872	Pneebg32.exe	106
PID 872 wrote to memory of 3128	872	Pneebg32.exe	106
PID 3128 wrote to memory of 2344	3128	Peonoaln.exe	107
PID 3128 wrote to memory of 2344	3128	Peonoaln.exe	107
PID 3128 wrote to memory of 2344	3128	Peonoaln.exe	107
PID 2344 wrote to memory of 2720	2344	Pijjpp32.exe	108
PID 2344 wrote to memory of 2720	2344	Pijjpp32.exe	108
PID 2344 wrote to memory of 2720	2344	Pijjpp32.exe	108
PID 2720 wrote to memory of 2696	2720	Phmjkmka.exe	109
PID 2720 wrote to memory of 2696	2720	Phmjkmka.exe	109
PID 2720 wrote to memory of 2696	2720	Phmjkmka.exe	109
PID 2696 wrote to memory of 816	2696	Plifll32.exe	110
PID 2696 wrote to memory of 816	2696	Plifll32.exe	110
PID 2696 wrote to memory of 816	2696	Plifll32.exe	110
PID 816 wrote to memory of 2388	816	Ppdbljkd.exe	111
PID 816 wrote to memory of 2388	816	Ppdbljkd.exe	111
PID 816 wrote to memory of 2388	816	Ppdbljkd.exe	111
PID 2388 wrote to memory of 3728	2388	Pbbnhfjh.exe	112

C:\Users\Admin\AppData\Local\Temp\1d8457308e26f871547aa1bbe6cb2c3367bd7af6c2b8f538921488ae9f254e22.exe
"C:\Users\Admin\AppData\Local\Temp\1d8457308e26f871547aa1bbe6cb2c3367bd7af6c2b8f538921488ae9f254e22.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\Oiagia32.exe
  C:\Windows\system32\Oiagia32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\SysWOW64\Olocem32.exe
    C:\Windows\system32\Olocem32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Windows\SysWOW64\Onnoah32.exe
      C:\Windows\system32\Onnoah32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4808
    - - C:\Windows\SysWOW64\Oalknd32.exe
        
        C:\Windows\system32\Oalknd32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3724
      - C:\Windows\SysWOW64\Oiccoa32.exe
        
        C:\Windows\system32\Oiccoa32.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2636
        
        C:\Windows\SysWOW64\Olapkmic.exe
        
        C:\Windows\system32\Olapkmic.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Windows\SysWOW64\Pnplghhf.exe
        
        C:\Windows\system32\Pnplghhf.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\Paohccgj.exe
        
        C:\Windows\system32\Paohccgj.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5104
        
        C:\Windows\SysWOW64\Piepdahl.exe
        
        C:\Windows\system32\Piepdahl.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:952
        
        C:\Windows\SysWOW64\Ppphak32.exe
        
        C:\Windows\system32\Ppphak32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4192
        
        C:\Windows\SysWOW64\Pbndmf32.exe
        
        C:\Windows\system32\Pbndmf32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\SysWOW64\Paaeiceg.exe
        
        C:\Windows\system32\Paaeiceg.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4264
        
        C:\Windows\SysWOW64\Pihmjqfj.exe
        
        C:\Windows\system32\Pihmjqfj.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3156
        
        C:\Windows\SysWOW64\Phkmem32.exe
        
        C:\Windows\system32\Phkmem32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\SysWOW64\Pneebg32.exe
        
        C:\Windows\system32\Pneebg32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:872
        
        C:\Windows\SysWOW64\Peonoaln.exe
        
        C:\Windows\system32\Peonoaln.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\SysWOW64\Pijjpp32.exe
        
        C:\Windows\system32\Pijjpp32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\SysWOW64\Phmjkmka.exe
        
        C:\Windows\system32\Phmjkmka.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\SysWOW64\Plifll32.exe
        
        C:\Windows\system32\Plifll32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\SysWOW64\Ppdbljkd.exe
        
        C:\Windows\system32\Ppdbljkd.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:816
        
        C:\Windows\SysWOW64\Pbbnhfjh.exe
        
        C:\Windows\system32\Pbbnhfjh.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\SysWOW64\Paendb32.exe
        
        C:\Windows\system32\Paendb32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3728
        
        C:\Windows\SysWOW64\Pimfep32.exe
        
        C:\Windows\system32\Pimfep32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2220
        
        C:\Windows\SysWOW64\Phpfqmio.exe
        
        C:\Windows\system32\Phpfqmio.exe
        25⤵
        Executes dropped EXE
        
        PID:3684
        
        C:\Windows\SysWOW64\Plkbak32.exe
        
        C:\Windows\system32\Plkbak32.exe
        26⤵
        Executes dropped EXE
        
        PID:2840
        
        C:\Windows\SysWOW64\Ppgobjia.exe
        
        C:\Windows\system32\Ppgobjia.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4676
        
        C:\Windows\SysWOW64\Pniomgpl.exe
        
        C:\Windows\system32\Pniomgpl.exe
        28⤵
        Executes dropped EXE
        
        PID:2532
        
        C:\Windows\SysWOW64\Pahkjbop.exe
        
        C:\Windows\system32\Pahkjbop.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1188
        
        C:\Windows\SysWOW64\Pecgja32.exe
        
        C:\Windows\system32\Pecgja32.exe
        30⤵
        Drops file in System32 directory
        
        PID:4492
        
        C:\Windows\SysWOW64\Piockppb.exe
        
        C:\Windows\system32\Piockppb.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1400
        
        C:\Windows\SysWOW64\Phbcfl32.exe
        
        C:\Windows\system32\Phbcfl32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3140
        
        C:\Windows\SysWOW64\Plmogkoe.exe
        
        C:\Windows\system32\Plmogkoe.exe
        33⤵
        Executes dropped EXE
        
        PID:3744
        
        C:\Windows\SysWOW64\Qpikgj32.exe
        
        C:\Windows\system32\Qpikgj32.exe
        34⤵
        Executes dropped EXE
        
        PID:3644
        
        C:\Windows\SysWOW64\Qbggce32.exe
        
        C:\Windows\system32\Qbggce32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3624
        
        C:\Windows\SysWOW64\Qajhobmm.exe
        
        C:\Windows\system32\Qajhobmm.exe
        36⤵
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\Qefdpq32.exe
        
        C:\Windows\system32\Qefdpq32.exe
        37⤵
        Executes dropped EXE
        
        PID:3204
        
        C:\Windows\SysWOW64\Qiappono.exe
        
        C:\Windows\system32\Qiappono.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1632
        
        C:\Windows\SysWOW64\Qlpllkmc.exe
        
        C:\Windows\system32\Qlpllkmc.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:448
        
        C:\Windows\SysWOW64\Qamdda32.exe
        
        C:\Windows\system32\Qamdda32.exe
        40⤵
        Executes dropped EXE
        
        PID:1124
        
        C:\Windows\SysWOW64\Qiclfo32.exe
        
        C:\Windows\system32\Qiclfo32.exe
        41⤵
        Executes dropped EXE
        
        PID:2200
        
        C:\Windows\SysWOW64\Albibj32.exe
        
        C:\Windows\system32\Albibj32.exe
        42⤵
        Executes dropped EXE
        
        PID:4240
        
        C:\Windows\SysWOW64\Apndbici.exe
        
        C:\Windows\system32\Apndbici.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4312
        
        C:\Windows\SysWOW64\Aaoaja32.exe
        
        C:\Windows\system32\Aaoaja32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4616
        
        C:\Windows\SysWOW64\Aldegj32.exe
        
        C:\Windows\system32\Aldegj32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:844
        
        C:\Windows\SysWOW64\Ahkflk32.exe
        
        C:\Windows\system32\Ahkflk32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3292
        
        C:\Windows\SysWOW64\Aeoffo32.exe
        
        C:\Windows\system32\Aeoffo32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4556
        
        C:\Windows\SysWOW64\Ahncbk32.exe
        
        C:\Windows\system32\Ahncbk32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:768
        
        C:\Windows\SysWOW64\Aogkoedl.exe
        
        C:\Windows\system32\Aogkoedl.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2944
        
        C:\Windows\SysWOW64\Aeacko32.exe
        
        C:\Windows\system32\Aeacko32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1836
        
        C:\Windows\SysWOW64\Alkkhi32.exe
        
        C:\Windows\system32\Alkkhi32.exe
        51⤵
        Executes dropped EXE
        
        PID:5100
        
        C:\Windows\SysWOW64\Aedpaoif.exe
        
        C:\Windows\system32\Aedpaoif.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:876
        
        C:\Windows\SysWOW64\Blnhni32.exe
        
        C:\Windows\system32\Blnhni32.exe
        53⤵
        Executes dropped EXE
        
        PID:5052
        
        C:\Windows\SysWOW64\Bakqfp32.exe
        
        C:\Windows\system32\Bakqfp32.exe
        54⤵
        Executes dropped EXE
        
        PID:5004
        
        C:\Windows\SysWOW64\Bhdibj32.exe
        
        C:\Windows\system32\Bhdibj32.exe
        55⤵
        Executes dropped EXE
        
        PID:624
        
        C:\Windows\SysWOW64\Bpladg32.exe
        
        C:\Windows\system32\Bpladg32.exe
        56⤵
        Executes dropped EXE
        
        PID:3936
        
        C:\Windows\SysWOW64\Bbjmpb32.exe
        
        C:\Windows\system32\Bbjmpb32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1052
        
        C:\Windows\SysWOW64\Bidemmnj.exe
        
        C:\Windows\system32\Bidemmnj.exe
        58⤵
        Executes dropped EXE
        
        PID:3208
        
        C:\Windows\SysWOW64\Blbaihmn.exe
        
        C:\Windows\system32\Blbaihmn.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4956
        
        C:\Windows\SysWOW64\Bbljeb32.exe
        
        C:\Windows\system32\Bbljeb32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2428
        
        C:\Windows\SysWOW64\Bekfan32.exe
        
        C:\Windows\system32\Bekfan32.exe
        61⤵
        Executes dropped EXE
        
        PID:4308
        
        C:\Windows\SysWOW64\Blennh32.exe
        
        C:\Windows\system32\Blennh32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4220
        
        C:\Windows\SysWOW64\Bpqjofcd.exe
        
        C:\Windows\system32\Bpqjofcd.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5076
        
        C:\Windows\SysWOW64\Baaggo32.exe
        
        C:\Windows\system32\Baaggo32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4868
        
        C:\Windows\SysWOW64\Biiohl32.exe
        
        C:\Windows\system32\Biiohl32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2296
        
        C:\Windows\SysWOW64\Blgkdg32.exe
        
        C:\Windows\system32\Blgkdg32.exe
        66⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1012
        
        C:\Windows\SysWOW64\Bpcgdfaa.exe
        
        C:\Windows\system32\Bpcgdfaa.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4976
        
        C:\Windows\SysWOW64\Bbacqape.exe
        
        C:\Windows\system32\Bbacqape.exe
        68⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Badcln32.exe
        
        C:\Windows\system32\Badcln32.exe
        69⤵
        Modifies registry class
        
        PID:3756
        
        C:\Windows\SysWOW64\Chnlihnl.exe
        
        C:\Windows\system32\Chnlihnl.exe
        70⤵
        Modifies registry class
        
        PID:1328
        
        C:\Windows\SysWOW64\Cpedjf32.exe
        
        C:\Windows\system32\Cpedjf32.exe
        71⤵
        Drops file in System32 directory
        
        PID:4596
        
        C:\Windows\SysWOW64\Cccpfa32.exe
        
        C:\Windows\system32\Cccpfa32.exe
        72⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\Ceblbm32.exe
        
        C:\Windows\system32\Ceblbm32.exe
        73⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Chphoh32.exe
        
        C:\Windows\system32\Chphoh32.exe
        74⤵
        Modifies registry class
        
        PID:3192
        
        C:\Windows\SysWOW64\Cpgqpe32.exe
        
        C:\Windows\system32\Cpgqpe32.exe
        75⤵
        Modifies registry class
        
        PID:1560
        
        C:\Windows\SysWOW64\Cedihl32.exe
        
        C:\Windows\system32\Cedihl32.exe
        76⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\Chbedh32.exe
        
        C:\Windows\system32\Chbedh32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2120
        
        C:\Windows\SysWOW64\Cpjmee32.exe
        
        C:\Windows\system32\Cpjmee32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4972
        
        C:\Windows\SysWOW64\Cakjmm32.exe
        
        C:\Windows\system32\Cakjmm32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1036
        
        C:\Windows\SysWOW64\Cefemliq.exe
        
        C:\Windows\system32\Cefemliq.exe
        80⤵
        Modifies registry class
        
        PID:5136
        
        C:\Windows\SysWOW64\Clqnjf32.exe
        
        C:\Windows\system32\Clqnjf32.exe
        81⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Ccjfgphj.exe
        
        C:\Windows\system32\Ccjfgphj.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5228
        
        C:\Windows\SysWOW64\Ceibclgn.exe
        
        C:\Windows\system32\Ceibclgn.exe
        83⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Chgoogfa.exe
        
        C:\Windows\system32\Chgoogfa.exe
        84⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Coagla32.exe
        
        C:\Windows\system32\Coagla32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5352
        
        C:\Windows\SysWOW64\Cekohk32.exe
        
        C:\Windows\system32\Cekohk32.exe
        86⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Dpacfd32.exe
        
        C:\Windows\system32\Dpacfd32.exe
        87⤵
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Dabpnlkp.exe
        
        C:\Windows\system32\Dabpnlkp.exe
        88⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Diihojkb.exe
        
        C:\Windows\system32\Diihojkb.exe
        89⤵
        Modifies registry class
        
        PID:5532
        
        C:\Windows\SysWOW64\Dlgdkeje.exe
        
        C:\Windows\system32\Dlgdkeje.exe
        90⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Dpcpkc32.exe
        
        C:\Windows\system32\Dpcpkc32.exe
        91⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Dcalgo32.exe
        
        C:\Windows\system32\Dcalgo32.exe
        92⤵
        Drops file in System32 directory
        
        PID:5656
        
        C:\Windows\SysWOW64\Djlddi32.exe
        
        C:\Windows\system32\Djlddi32.exe
        93⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Dljqpd32.exe
        
        C:\Windows\system32\Dljqpd32.exe
        94⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Dcdimopp.exe
        
        C:\Windows\system32\Dcdimopp.exe
        95⤵
        Drops file in System32 directory
        
        PID:5792
        
        C:\Windows\SysWOW64\Debeijoc.exe
        
        C:\Windows\system32\Debeijoc.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5836
        
        C:\Windows\SysWOW64\Dhqaefng.exe
        
        C:\Windows\system32\Dhqaefng.exe
        97⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Dphifcoi.exe
        
        C:\Windows\system32\Dphifcoi.exe
        98⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5916
        
        C:\Windows\SysWOW64\Dcfebonm.exe
        
        C:\Windows\system32\Dcfebonm.exe
        99⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Dhcnke32.exe
        
        C:\Windows\system32\Dhcnke32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6000
        
        C:\Windows\SysWOW64\Dpjflb32.exe
        
        C:\Windows\system32\Dpjflb32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6044
        
        C:\Windows\SysWOW64\Dchbhn32.exe
        
        C:\Windows\system32\Dchbhn32.exe
        102⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Efgodj32.exe
        
        C:\Windows\system32\Efgodj32.exe
        103⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Ejbkehcg.exe
        
        C:\Windows\system32\Ejbkehcg.exe
        104⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Elagacbk.exe
        
        C:\Windows\system32\Elagacbk.exe
        105⤵
        Drops file in System32 directory
        
        PID:5164
        
        C:\Windows\SysWOW64\Eckonn32.exe
        
        C:\Windows\system32\Eckonn32.exe
        106⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Efikji32.exe
        
        C:\Windows\system32\Efikji32.exe
        107⤵
        Drops file in System32 directory
        
        PID:5332
        
        C:\Windows\SysWOW64\Ehhgfdho.exe
        
        C:\Windows\system32\Ehhgfdho.exe
        108⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Epopgbia.exe
        
        C:\Windows\system32\Epopgbia.exe
        109⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Ecmlcmhe.exe
        
        C:\Windows\system32\Ecmlcmhe.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5564
        
        C:\Windows\SysWOW64\Ebploj32.exe
        
        C:\Windows\system32\Ebploj32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5648
        
        C:\Windows\SysWOW64\Eodlho32.exe
        
        C:\Windows\system32\Eodlho32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5696
        
        C:\Windows\SysWOW64\Ecphimfb.exe
        
        C:\Windows\system32\Ecphimfb.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5776
        
        C:\Windows\SysWOW64\Efneehef.exe
        
        C:\Windows\system32\Efneehef.exe
        114⤵
        Drops file in System32 directory
        
        PID:5852
        
        C:\Windows\SysWOW64\Eofinnkf.exe
        
        C:\Windows\system32\Eofinnkf.exe
        115⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Ecbenm32.exe
        
        C:\Windows\system32\Ecbenm32.exe
        116⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Ehonfc32.exe
        
        C:\Windows\system32\Ehonfc32.exe
        117⤵
        Drops file in System32 directory
        
        PID:6080
        
        C:\Windows\SysWOW64\Eqfeha32.exe
        
        C:\Windows\system32\Eqfeha32.exe
        118⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Ecdbdl32.exe
        
        C:\Windows\system32\Ecdbdl32.exe
        119⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Fjnjqfij.exe
        
        C:\Windows\system32\Fjnjqfij.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5376
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Fokbim32.exe
        
        C:\Windows\system32\Fokbim32.exe
        122⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Fjqgff32.exe
        
        C:\Windows\system32\Fjqgff32.exe
        123⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Fcikolnh.exe
        
        C:\Windows\system32\Fcikolnh.exe
        124⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        125⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\Fjcclf32.exe
        
        C:\Windows\system32\Fjcclf32.exe
        126⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Fifdgblo.exe
        
        C:\Windows\system32\Fifdgblo.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5620
        
        C:\Windows\SysWOW64\Fqmlhpla.exe
        
        C:\Windows\system32\Fqmlhpla.exe
        128⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Fckhdk32.exe
        
        C:\Windows\system32\Fckhdk32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1724
        
        C:\Windows\SysWOW64\Fmclmabe.exe
        
        C:\Windows\system32\Fmclmabe.exe
        130⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        131⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Fflaff32.exe
        
        C:\Windows\system32\Fflaff32.exe
        133⤵
        Drops file in System32 directory
        
        PID:5996
        
        C:\Windows\SysWOW64\Fijmbb32.exe
        
        C:\Windows\system32\Fijmbb32.exe
        134⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6176
        
        C:\Windows\SysWOW64\Gcpapkgp.exe
        
        C:\Windows\system32\Gcpapkgp.exe
        136⤵
        Drops file in System32 directory
        
        PID:6220
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6264
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        138⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Gcbnejem.exe
        
        C:\Windows\system32\Gcbnejem.exe
        139⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6400
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        141⤵
        Modifies registry class
        
        PID:6440
        
        C:\Windows\SysWOW64\Gqfooodg.exe
        
        C:\Windows\system32\Gqfooodg.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6476
        
        C:\Windows\SysWOW64\Gfcgge32.exe
        
        C:\Windows\system32\Gfcgge32.exe
        143⤵
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        144⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Gfedle32.exe
        
        C:\Windows\system32\Gfedle32.exe
        145⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        146⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        147⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        148⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6744
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        149⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        150⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        151⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        152⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Hpbaqj32.exe
        
        C:\Windows\system32\Hpbaqj32.exe
        153⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        154⤵
        Drops file in System32 directory
        
        PID:7012
        
        C:\Windows\SysWOW64\Hfljmdjc.exe
        
        C:\Windows\system32\Hfljmdjc.exe
        155⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Hikfip32.exe
        
        C:\Windows\system32\Hikfip32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7096
        
        C:\Windows\SysWOW64\Habnjm32.exe
        
        C:\Windows\system32\Habnjm32.exe
        157⤵
        Modifies registry class
        
        PID:7128
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        158⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        159⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        160⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        161⤵
        Drops file in System32 directory
        
        PID:6320
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        162⤵
        Drops file in System32 directory
        
        PID:6408
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        163⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        164⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        165⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        166⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        167⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        168⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6872
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        170⤵
        Drops file in System32 directory
        
        PID:6944
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        171⤵
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        172⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        173⤵
        Modifies registry class
        
        PID:7144
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        174⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        175⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6392
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        177⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        178⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6764
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        180⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        181⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        182⤵
        Drops file in System32 directory
        
        PID:7076
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        183⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7164
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        184⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        185⤵
        Drops file in System32 directory
        
        PID:6516
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        186⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        187⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        188⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        189⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        190⤵
        Drops file in System32 directory
        
        PID:6648
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6896
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7152
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        193⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        194⤵
        Drops file in System32 directory
        
        PID:6812
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        195⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        196⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Jjbako32.exe
        
        C:\Windows\system32\Jjbako32.exe
        197⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        198⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7368
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        200⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        201⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        202⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        203⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7548
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7596
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        205⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        206⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        207⤵
        Modifies registry class
        
        PID:7720
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7760
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        209⤵
        Drops file in System32 directory
        
        PID:7808
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        210⤵
        Modifies registry class
        
        PID:7852
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        211⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        212⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        213⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        214⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        215⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        216⤵
        Drops file in System32 directory
        
        PID:8100
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        217⤵
        Modifies registry class
        
        PID:8148
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        218⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        219⤵
        Modifies registry class
        
        PID:6280
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7208
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        221⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        222⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7468
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        224⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7528
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        225⤵
        Drops file in System32 directory
        
        PID:7616
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7664
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7772
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7844
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7916
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        230⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        231⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        232⤵
        Drops file in System32 directory
        
        PID:6108
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        233⤵
        Drops file in System32 directory
        
        PID:7232
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        234⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7512
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        236⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        237⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        238⤵
        Modifies registry class
        
        PID:7904
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        239⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        241⤵
        Drops file in System32 directory
        
        PID:7360
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7456
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        243⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        244⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        245⤵
        Drops file in System32 directory
        
        PID:7356
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        246⤵
        Drops file in System32 directory
        
        PID:7860
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        247⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        248⤵
        Modifies registry class
        
        PID:7588
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7676
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        250⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        251⤵
        Drops file in System32 directory
        
        PID:8216
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        252⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        253⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        254⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        255⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8428
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        257⤵
        Drops file in System32 directory
        
        PID:8468
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        258⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8544
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8584
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        261⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        262⤵
        Modifies registry class
        
        PID:8664
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        263⤵
        Drops file in System32 directory
        
        PID:8716
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        264⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        265⤵
        Modifies registry class
        
        PID:8792
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        266⤵
        Modifies registry class
        
        PID:8836
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        267⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8880
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        268⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8972
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        270⤵
        Drops file in System32 directory
        
        PID:9012
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        271⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9096
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        273⤵
        Drops file in System32 directory
        
        PID:9144
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        274⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        275⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8224 -s 232
        276⤵
        Program crash
        
        PID:8336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8224 -ip 8224
1⤵
PID:8316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Cipnfjmn.dll

Filesize
7KB

MD5
046378df9eebd46f41243ce73ae020dd

SHA1
3a5b9ed1224f25a697ef554ee7046256c3cdec30

SHA256
f62128e08a127e3ddd3e772f7c345ba66e84b440a7d450d67a73c2585d94260f

SHA512
45e8cc133b78eb01d67f6c619df3178c4fc64553577d2b3a7a363b14996e007fe811a4f4b9797d4c85d2800c6c4a8dd0f2799f31a39d241568eea0011ff72de3

Download Submit
C:\Windows\SysWOW64\Ebploj32.exe

Filesize
224KB

MD5
96b8ef60bca1d578ad4aa706b6cbfed8

SHA1
a87dac1528b0a449d5736febc01b094d9f6be42c

SHA256
5b9e1086b1d42016bb06c7e90a92d2e8556f78474dcad73417e429eaf463eb24

SHA512
440e969e66ac130fc560928f6153bc0b528cb10fd8019f39293b12fb20cc20c051b9d1f97fb157483149076b4f492ba048f6a5529669c61fdaed1572efac19ae

Download Submit
C:\Windows\SysWOW64\Kpccnefa.exe

Filesize
224KB

MD5
809c9310b524e2419d6cc8e24e6629af

SHA1
1876b96ffd188434c9f73dce8c2009e136e7dbb2

SHA256
620f146421e6054ac04fa7a1e6b21c7d2165723794300e92507dd2458d172633

SHA512
ec566eff86b17836c8fe5a264727152ae53ba17f80c59a4709f762a6ca2f1b8b82c962e37b66bc1de9f8c416e08f5b674ed68d8cb869e5eb9c578cc36efc2ac0

Download Submit
C:\Windows\SysWOW64\Nbhkac32.exe

Filesize
224KB

MD5
d03854dfb9eb5ec462e65923ef4a03b0

SHA1
5d7413f70bffb9366dd5f4aa956bf7bdae354885

SHA256
b9cef2c2805bd71bbfe4519898072bd6c13905d939e1e77f9c3ae5b165588327

SHA512
0c0d9b00d1c8593f4d66ad90af9c0136e2727c9740a5c7039e550b6cbd41156510e61c715a8c527790ccb58c19e4610865c85d3b23dd4aef2430b8b7a19e155a

Download Submit
C:\Windows\SysWOW64\Nkcmohbg.exe

Filesize
224KB

MD5
ca90c6781872bcfda6d2d367ac2508d0

SHA1
f9fa2132fd8d93798c12d4a0dfc11d0475745962

SHA256
fa01889c99856e0c117e7694ba1b43c4c8a9ba7010d9c928f2c619aaf9782990

SHA512
ac8c19902622320fde6ac390cd937cb325d29d9dd2caec900f79b6a4993718d8960f2ba58f0dfba082c3f999528a42f0caf4d2d3744a28743b71b7bbf04de771

Download Submit
C:\Windows\SysWOW64\Oalknd32.exe

Filesize
224KB

MD5
f5eb4c8073a84c452e20586616411909

SHA1
b4f6b60e32be9cbc63fe89679fdd189d2bf251f5

SHA256
66f64505a8f54a9afd462f94f9e71dbf1ba8ef86d14ebb9e514e9b6f87afae90

SHA512
5909a9443ae2b014efa19e3d5ed91829059d76119b4a4bf4a8539623570c159be67f4b05c35bf54bdd7c96fbe38b28c939693eae95b605eb59453ba6087e77bc

Download Submit
C:\Windows\SysWOW64\Oiagia32.exe

Filesize
224KB

MD5
b0c6778af73b4def4e2113d50c46821f

SHA1
7b37bbefdf8ccfa9db0c4576a6ad71c8c518d75a

SHA256
00288a0bdec29811bfcf441e79d842ec0414c10658d4ff8acde1bec5b698a400

SHA512
4f82a99547d5cea510cbcfc6af34740fc61ef03898236b40a1ad5d462886024fa0a2588cca3d95f966e650df8d71bcd1fba0716086e3d366aa06b45d62427986

Download Submit
C:\Windows\SysWOW64\Oiccoa32.exe

Filesize
224KB

MD5
a244aaf922c088467934f114cd56ae11

SHA1
a0332a06ace7ec0267cabdb6b10d6b26c55693bb

SHA256
a408b240eb0819774fc54a44e3c3e18cb4e618cf52152aae0e2f4068dfed61c2

SHA512
713e6ded6d75b1e5b88bea43b548994b8946b067328ba1846b62618152847e32c014e4051f9d358b07f1e6cda93c9bbcfefec4f60f31b2cda0e07c70dbb1e0c2

Download Submit
C:\Windows\SysWOW64\Olapkmic.exe

Filesize
224KB

MD5
81c013c16fd111ca1cdfc4ab89180d40

SHA1
8bcf4ce868d7efec8c063fabb5d863b7c11d03f9

SHA256
860fc0bfc645e2d4941a3bfa5fa35e8ff2993cc01c09788d201c4202b2bbb555

SHA512
5874316dfe65d2a5ff83347d435b52534a16019447a93c80b5cfc5f7f9167ffa5ab861a4053282a5ced36aee19ab232e92725b8b9f8f6dd5e8302c53b2c64dc5

Download Submit
C:\Windows\SysWOW64\Olocem32.exe

Filesize
224KB

MD5
4f5ccff7a2a1ead315b5707a9ecd0d93

SHA1
5f24673f11214370c4b2f1f0c69fada353e40a8d

SHA256
4a749f91cd85fdf949259d44a7789de9166ac5e948cae8e7504a496a3757d99c

SHA512
677176c0dc336da40dac6cb0dc9fdf11881332a496db35fbdef2ca9c74d96f28a0b23345b607516c879b333f55da6af1624260d29e0cc1fa11f50951b4c898bd

Download Submit
C:\Windows\SysWOW64\Onnoah32.exe

Filesize
224KB

MD5
951785ff99f45cf5c9f1fb6356e1b27c

SHA1
aa5145bb665ea147d8160c68a527f726649f370a

SHA256
96a20c9b5e6f56851138fd1196128b9cdeca07c95e40f85232af5cff78e0cb63

SHA512
836559d9e7b8677d83619daa095b4fd39e161ed2b8497d05bddc4dfe7786c35074dc0fb67d295038344335946846977115e07b2b4cc2d88bdf96c41725112178

Download Submit
C:\Windows\SysWOW64\Paaeiceg.exe

Filesize
224KB

MD5
e1d621e974d0025f270e4b6cc5e082a3

SHA1
2b1c365889a57fa86dc2e05d35e1a903ba27d2b0

SHA256
b0296c263312bb6846ec3df72eef34d0e7a3e8778b5b96087c97bc2f5d94c238

SHA512
fb2ba845e1d6eb610347c43bb0c8f590310ca95d89da3d660bdd10a4c77d149632465b99e0da553a912740f5d6ad5cbde34960d78dc5259d200250962cea0f9d

Download Submit
C:\Windows\SysWOW64\Paendb32.exe

Filesize
224KB

MD5
61e30db66a24957b145a924aed579bc9

SHA1
e07222465018d24f1492444b16a854e43cb557c3

SHA256
b5e3b5ab44bba9600953f2e51e32483f50968d93a37174d848b30649fc6d1dac

SHA512
b46c035d1ab1b8407f0b06b110fb65d869264bff39f67c03be6ea50dbb95a52468c347b4f8151ba5da9e2fa2ff560c12c011b5a4d3ac956d8d49c31024fbc60c

Download Submit
C:\Windows\SysWOW64\Pahkjbop.exe

Filesize
224KB

MD5
897b1d42f84209d3c4f4d505f84f2111

SHA1
3fffcb2fcc0d768ae038a2f2b18e091bb85d67ad

SHA256
188a41bda6e0469156dae00ef85c6dd5264f447c03bc295d2030806739f30951

SHA512
78cd11e7a705f4978e2f2dc947e0067aea98fba0232e567dc1f2cd0279af47e900885ac01eb469035b30004d191fa7bb56b9fa74328b541aa272c5d0d3c86374

Download Submit
C:\Windows\SysWOW64\Paohccgj.exe

Filesize
224KB

MD5
42b2eba4bcc5500b6c60e6dd7a10ea05

SHA1
ea1dd48edbc936d0985155e677d80622ba9ef1d0

SHA256
5ea5b1cb9e6449f89af695c66e4c178e6e460ba8997af23c2ffe4708a76fdcbc

SHA512
34d2babb4ac790353d4d01e8faeee9a65df62f85ac3a3d267aceda5a420c573b99274fa8c283a50f855b8bedd6e419fb2d30680435228d9757c070f9a3bba58a

Download Submit
C:\Windows\SysWOW64\Pbbnhfjh.exe

Filesize
224KB

MD5
d6ac08ca96cbb00ff3083d27d6c89ba4

SHA1
e13a41321b87d04adc068c9674d896bb3e38903c

SHA256
a4aefba838cef7bcbe93e954111899403289163a9c0ccd74b4842ac744099392

SHA512
3e7bd4c0be629371bfd0b7cb380ccf0613e6a2e7f21489d9d402909e8d3269a4ef10d6788ae0d8cb025d6dc685bb575dfadebdc61ccb01b16e07112fff940d9b

Download Submit
C:\Windows\SysWOW64\Pbndmf32.exe

Filesize
224KB

MD5
0ca521770bbb3d414929f694cf4e95ec

SHA1
cfd35492a7e12699b670bc4fa759f83b48c05fd0

SHA256
8e1b25c67787e9d1a7d5b97045d5391d1ffa0851923661b1c366c3a13403f2a8

SHA512
c779b4ab8fd720539ddbd98fd502c7cd91c25d1b3a2c5310eabba148f7bda56c4b14341afd0c7cde4e286e94d240338b2f04390ebd80058164b7b6d245f8ba08

Download Submit
C:\Windows\SysWOW64\Peonoaln.exe

Filesize
224KB

MD5
53e04da43937510662cb15ae8d144d89

SHA1
d46439a6f9ac0a3d501ed258879bde0e669452c4

SHA256
686231bf47948336b0dde607b81db3a24b8db020f051ccaff4c9a76032075632

SHA512
1fd6f89d569a9a05642e60962913f2ead6084c4fc8f6c65b856891f620201fb43af444e5b1a2725f8de779dadc0c834b2b8b0ae12b171f55ce1e0589a2138c77

Download Submit
C:\Windows\SysWOW64\Phbcfl32.exe

Filesize
224KB

MD5
19400af2fe57669cbb735848592a5cf5

SHA1
52b7680b0b19efc780798905606e213b193eea9d

SHA256
b322772f83e520b7433df31bb203a5191bf8a741eb7ab26d0e8d87976b5a6f73

SHA512
362d65100c4c021a736e28aacf9b23f908b70885cdb67bbde821cad22dee489e5609d5239c0611effe9b995372e8c126f6653e927e5be5448d60c2c23ecdc2c2

Download Submit
C:\Windows\SysWOW64\Phkmem32.exe

Filesize
224KB

MD5
bc3dcfe445d93ce8d70ace9f63fcb861

SHA1
0ce98cb0390525166390ca5461378e0e57d6f952

SHA256
3f7b07ca567e1b29950ac6f30550338126fd4645de0798053725bd04042aa0bd

SHA512
f4ec6a1c77901cea127cfd26399e409a8f81cb4ef812ff1b40ed6d3d1226d1f3d75c5cf746b7929d193a6a1f78406e6e26fa5dd99c0a2c74ceac923ef3244b47

Download Submit
C:\Windows\SysWOW64\Phmjkmka.exe

Filesize
224KB

MD5
380100be13d896d70b0ee8d80952da5a

SHA1
3ae8e47a8ba6740296715e8619dcdcfb4bf3b995

SHA256
ce7497c89d39e03b64fab8314869a7de7a62f14cd515ab8a087f7c9924036929

SHA512
9a313a5e477a522605cfb5cfb1c48e346dd3fd720116062b692d69e31dbdd896e25a34eea1b9e25997e2400a24075eac6e061cccebf11afab8414215e11db194

Download Submit
C:\Windows\SysWOW64\Phpfqmio.exe

Filesize
224KB

MD5
cef4bf77a675ac699d82e55713aa3b49

SHA1
69611e4f040fd758347ed9e297437e91fff87645

SHA256
297a1d3814baad4423bbccf45e73772cc7cec830b4be5b95917e2356e95c47de

SHA512
a872e8cbc23f533d11bd7d1e560c08ad369595027962ada485fadfd540246cd8bfbbeaf605926884eb09eddd230f48f2028d71d30ac544f0d2d6e5e329a5a384

Download Submit
C:\Windows\SysWOW64\Piepdahl.exe

Filesize
224KB

MD5
f7d61da25a6f051a64b9d436e201f255

SHA1
04da46d3d4bb4bac0d0d7043b6f991212236086a

SHA256
0adf2dbac7ee1bdc8b5f5a9b95595b4851e1b67f0d39babb6e8d8580b6068681

SHA512
7853979f49d523bcaa4a7527a7658f371eeb146e8246e0e70cd006dba978c4199adb016f24039a997ed7f599646dd96cef6bf4ebe4701835bb95c38fdc116032

Download Submit
C:\Windows\SysWOW64\Pihmjqfj.exe

Filesize
224KB

MD5
6a3b80e9db0c7d900385f179857e4c8e

SHA1
09674dc1bed3a5c37b1e1782a02c5973d8905a54

SHA256
e21cec0473ac42d5cdb1b2bb68165e35fe907cf8d26bdf6aea67c050835154a4

SHA512
303b6801903d755b31403b5de59c105cc7490c6f035e18d3a77b3f9971e24b7d21f9e6eda5fbc8bae316a29d30193f1ccfffb7d72ca5cbdfcecc92d58c3b585a

Download Submit
C:\Windows\SysWOW64\Pijjpp32.exe

Filesize
224KB

MD5
ec8c9888a40d2cab3e7d4f0d15f5c39f

SHA1
d0019d29423ed7df67c00508f6316d6d0c61a1f0

SHA256
8db28091ccecb9ef9f1e985f949bda2b1473f00a1daca9b59077b2a29eb15420

SHA512
09c4c1248e2757200e0310c031ffef2fd9de8c742209249307dc56dd078bf4b6a4f6aca5fb8fca3abf371390b9dc1dd76363d12c7c7cd2e5f6b5ff1d3d514a74

Download Submit
C:\Windows\SysWOW64\Pimfep32.exe

Filesize
224KB

MD5
666580d4f57ac41969325b34c1b20add

SHA1
d7382b286444f1bdf40d23d6731b2768c094dc7a

SHA256
e02fa9f57666ff8b2525974ec4a170822331ba63510d438ae1de532fac451a2e

SHA512
476f0ebfb4883defe6349e6ae16be076031c7aab86404323747928d18258544869000afd11e4a826ae1db10892f7a31d4d262d77a291bb42dd7b11b301415f5f

Download Submit
C:\Windows\SysWOW64\Piockppb.exe

Filesize
224KB

MD5
52a334947e91746404ab5bfc2cb36272

SHA1
51b36849df96148f7e52f1bb96381b35a05c8087

SHA256
281b3e59987e246a08d09689ab85d33f6addd67266b3004f50f5bdbafca04424

SHA512
8b96049cd4b694d30aff3192f0e5c8a08effd2dbc1d4d0daabdf762b978de6fc21d290377cfb23eff0c3fbe84e4f0b322c7b742850b0ab398ff714a46b55890c

Download Submit
C:\Windows\SysWOW64\Plifll32.exe

Filesize
224KB

MD5
ec3c608c44d6b8b00a45d8007a5b8800

SHA1
e82e5eb8e062ad0c201e5e70b96daed478d5efec

SHA256
435532ea968818f1525c26eb1f004bccfe2789f36ba32f0e5ed5e6c3dc5c56cf

SHA512
b4935f2a79523c7be021010a686e357edfce49615b576e2795df5e4c0663acd7ac282a9bfd1aca735d32e085003d401ed148a2901386aaf8811dc4ffb378a7a4

Download Submit
C:\Windows\SysWOW64\Plkbak32.exe

Filesize
224KB

MD5
33484d9e2b572f0f9270052b189373b6

SHA1
72ae472bdc43a508f1801c6b8eac938077ba84d4

SHA256
36fca04ad1f8f502fb87fa4a841c255fee369cc49e300c9bc523c3b5c2955947

SHA512
3211dc205338df1551cdeaee11941d98044743e3e1baaf3cb25368eb7f7cf4a2fbd00cc39e253f0b5113bbe715e547c09d8181605d9def0bbe60e66fcd68065f

Download Submit
C:\Windows\SysWOW64\Plmogkoe.exe

Filesize
224KB

MD5
5bd095e8ca08df28e65c740cd4fb7fa6

SHA1
5563e9762fd1d2f23c625c8c4f87be042f765f01

SHA256
56929321e75ef0401923723e19e9edbfe233f1d73bde11864a1af33b12b9d605

SHA512
3f2b73f93011b409159c9f3dff20b1dffb54096d6416ae9966b6710d165c28f5522d8bff8f4a133a8295c1605c99f6881a193d808855b7291bb3c823cf3d5fb2

Download Submit
C:\Windows\SysWOW64\Pneebg32.exe

Filesize
224KB

MD5
6d96656bfffdd69c7299f810ded05cbe

SHA1
17fe65a63c0594db7d3bc4dd96f67a53f5897db7

SHA256
b1118b1cf658a47c0736a36441890b47d5382dc3c605560ce4933d36e5661655

SHA512
6f25b9ecc2fdf1c6e15368bf357d3f50135978d3cd964aaf9d1841ea589d3fe432aa054c26c1f82038838e5f611da9dfe1a726801affeb51354dd137839084ac

Download Submit
C:\Windows\SysWOW64\Pniomgpl.exe

Filesize
224KB

MD5
20768943dcd4c5a5c60d375a97a00dd7

SHA1
71d60be803f61a730ab742a2edb22ba990d709cb

SHA256
22bf9331dcb955a5b679593cbb33842544c33143a065d7f86dc5fbc1f647bd9c

SHA512
40e8678778bd5f7cef4f7a8f8273311301a83e89c0c93ee8f01926f07b153202288bb8b85a61d83b8772099538a7c9f7bbb81fc007c2295cfe22c08e0e6198dd

Download Submit
C:\Windows\SysWOW64\Pnplghhf.exe

Filesize
224KB

MD5
99d93d5422235fcfc707e8ed4e51a82f

SHA1
66f60e138624e7c2e1f38e352b334fe0a0b148ed

SHA256
2fb92d80401f2bf4d0be262e977155659a0c0f6afbf89a462e7529cd7422855d

SHA512
01105d5aed6686c29ba59827dc30a6aa67bb89159352cc7ac86640f1982efd6bfc3976bfbf8b95f66d8e63c4ba43b740052a2ab1d48662534da7d0bc8e1bb26e

Download Submit
C:\Windows\SysWOW64\Ppdbljkd.exe

Filesize
224KB

MD5
21df748cae9e54b6eb42817968d63035

SHA1
87a284a0c12c51d17412a6a63363d1f69ed614c4

SHA256
a695466257a392e9771956d0af447f19a8e2cb154a11e18cefad898a3b59a92c

SHA512
88b1b93aeb5d6cf69764352e17eec10a3e8998aabd1fdd598cffb7e353f1d590df1b7216ff886df21a9c703ac3533f2cfc652c5ae405f53064891f1bebb33cbb

Download Submit
C:\Windows\SysWOW64\Ppgobjia.exe

Filesize
224KB

MD5
03aaa4dd249af2b85367db8866ccf3a8

SHA1
87ee4189af412e8ae81a300a27846f891f617a49

SHA256
90f2cd4233a603d462b9e87d60083829eb2e5f433f3678d02f299e2aded89369

SHA512
a48255d5dbebe64fc7a614ea4b51ca6a4cb8ac47c8908e249a8f09b3e052b63ca64c56c17008bdc9cdcb2578d9f92e6592c26f5f7f8b663f0d204d2d8ad89e03

Download Submit
C:\Windows\SysWOW64\Ppphak32.exe

Filesize
224KB

MD5
7a91341bad466d3aa7921777b8af6dc7

SHA1
9f5ba694e67c69d2eff711f7ecfe8bbb266dfdae

SHA256
84dc84a8228c9c27c570c879a44409eadd504e2f83b551f24a32cc1af850129e

SHA512
b1cd78da724e374d8965cc5fc81d32a75676acd0186cba9df5bb5d5cb8cadcb96bcd1f970860856522149da98ad91f35e3ac6e55b7c96dba14e11d43e16f464a

Download Submit
C:\Windows\SysWOW64\Qbggce32.exe

Filesize
224KB

MD5
b70cc6be0d318bceed34bf4e4c99f1a6

SHA1
1fa1ee2c61bf45f0f96898974fd63656dd991d0b

SHA256
938bf37e78c8707a2ba6a13c086ecbbd51a377eb023a7ba5f6be8f3ac2fc8c09

SHA512
fb9228588516d77fe37dea767c72d2fdeceff10eeedc76f135a44389674d8dce2421316bb64402b5d3675eeee637b6be094d3428f94cd4357baaffa1537c6af5

Download Submit
C:\Windows\SysWOW64\Qpikgj32.exe

Filesize
224KB

MD5
8244559e9fee69e8a3b167e33cd42a0b

SHA1
870ea0f23278e419e39c0b92b9e1b4a5fae36137

SHA256
b2c760c02b638361feddc72495c3064c26a2f5fed8481d2e830b2a848531947f

SHA512
7902da87d1d9515c67c7025648bcc26ac5d806449e3492d397c53517f4709baa1db95131489eec3305ae6b1db1233ed9acbe439b87c544e1ba876a344875b008

Download Submit
memory/448-332-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/624-383-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/768-356-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/816-277-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/840-14-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/844-348-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/872-325-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/876-365-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/952-109-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1052-395-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1124-337-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1188-305-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1400-311-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1632-324-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1836-363-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2200-339-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2220-290-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2292-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2344-264-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2388-283-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2428-418-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2532-304-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2636-45-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2696-276-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2720-270-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2840-297-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2944-361-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3128-331-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3140-313-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3144-63-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3156-260-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3204-320-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3208-401-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3292-353-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3432-263-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3624-316-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3644-315-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3684-296-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3724-32-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3728-289-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3744-314-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3936-389-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3944-20-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4040-93-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4192-117-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4220-425-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4240-340-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4264-101-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4308-419-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4312-346-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4492-306-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4548-55-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4556-354-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4616-347-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4676-302-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4804-317-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4808-24-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4868-437-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4956-407-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5004-377-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5052-371-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5076-431-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5100-364-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5104-71-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads