d300f21048d062084cec36432cd28c62806a9a6e187eff33b28512ede8269261

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d300f21048d062084cec36432cd28c62806a9a6e187eff33b28512ede8269261.exe
Size

80KB
MD5

49d9ccb6749b44e918f5eb5442ae014e
SHA1

1fbe4c4ed9a27bbe78b202f6d2d61cf087f53a9b
SHA256

d300f21048d062084cec36432cd28c62806a9a6e187eff33b28512ede8269261
SHA512

8c2744c0a352c5bd0e3f0b3068c96fc419d014d98df1f588d4700a1f70f73361132e43d10b0fffd0ba97f65359e70545347300822f861234391e546680d5c0dd
SSDEEP

768:WOOMBYp6C+AEOgPw9mpqfe5uGpPTKLRL1YQOgsGeEmEwLjV/6ojCeYnkv7RUCWdU:O6CjfFHf8uFLGEALuCegjFeJuqnhCN

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbfkbhpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocnjidkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afoeiklb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dedkdcie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmgfda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnlaml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdgljmcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmfmmcbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncdgcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhkapp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghlcnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qfcfml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klqcioba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dogogcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Foabofnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gododflk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kepelfam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocdqjceo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjdkjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkoggkjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmhale32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnlaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ageolo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okloegjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahkobekf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbbkaako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlbgha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmpijp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fckajehi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdlnbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oddmdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekemhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hbnjmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfankifm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpcfkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmngqdpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcojkhap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipknlb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mplhql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Clpgpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbaemi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Flceckoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpnlpnih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aejfpjne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bahmfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eofbch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Migjoaaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcijeb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Danecp32.exe

Executes dropped EXE 64 IoCs

pid	Process
828	Okeieh32.exe
3672	Oqbamo32.exe
3896	Ocqnij32.exe
3064	Onfbfc32.exe
2820	Odpjcm32.exe
4164	Ogogoi32.exe
4768	Onholckc.exe
824	Ocegdjij.exe
3556	Okloegjl.exe
2224	Onklabip.exe
952	Oqihnn32.exe
4664	Ogcpjhoq.exe
1836	Ojalgcnd.exe
2072	Obidhaog.exe
4112	Oqkdcn32.exe
1652	Pjdilcla.exe
4500	Peimil32.exe
724	Pkceffcd.exe
1640	Pbmncp32.exe
1120	Pcojkhap.exe
2000	Pbpjhp32.exe
4520	Pabkdmpi.exe
3776	Pjkombfj.exe
3124	Pbbgnpgl.exe
4128	Pcccfh32.exe
4548	Pjmlbbdg.exe
4332	Qjpiha32.exe
1348	Qbgqio32.exe
2104	Qchmagie.exe
4168	Qloebdig.exe
3368	Qbimoo32.exe
3952	Acjjfggb.exe
8	Ajdbcano.exe
1548	Aanjpk32.exe
3764	Aejfpjne.exe
4324	Ahhblemi.exe
1412	Anbkio32.exe
908	Aelcfilb.exe
676	Ahkobekf.exe
3352	Abpcon32.exe
1004	Aacckjaf.exe
3288	Alhhhcal.exe
640	Angddopp.exe
2760	Aaepqjpd.exe
3724	Aealah32.exe
5112	Ahoimd32.exe
1708	Abemjmgg.exe
4420	Bahmfj32.exe
2832	Bhaebcen.exe
4220	Bjpaooda.exe
432	Bajjli32.exe
3284	Bdhfhe32.exe
2348	Bnnjen32.exe
1896	Balfaiil.exe
1376	Bdkcmdhp.exe
4948	Bjdkjo32.exe
2272	Bblckl32.exe
2268	Bejogg32.exe
3140	Bhikcb32.exe
1616	Bobcpmfc.exe
2976	Bhkhibmc.exe
4688	Cbqlfkmi.exe
3784	Ceoibflm.exe
4276	Chmeobkq.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Fbpnkama.exe	Foabofnn.exe
File created	C:\Windows\SysWOW64\Oflgep32.exe	Ocnjidkf.exe
File created	C:\Windows\SysWOW64\Jpgmha32.exe	Jmhale32.exe
File created	C:\Windows\SysWOW64\Jbeidl32.exe	Jpgmha32.exe
File created	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cmiflbel.exe
File opened for modification	C:\Windows\SysWOW64\Dmgbnq32.exe	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Bhaebcen.exe	Bahmfj32.exe
File opened for modification	C:\Windows\SysWOW64\Fljcmlfd.exe	Ehnglm32.exe
File created	C:\Windows\SysWOW64\Hecmijim.exe	Hbeqmoji.exe
File created	C:\Windows\SysWOW64\Ccdlci32.dll	Pdpmpdbd.exe
File opened for modification	C:\Windows\SysWOW64\Cjinkg32.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Dalchnkg.dll	Onklabip.exe
File created	C:\Windows\SysWOW64\Fgcqbd32.dll	Pbpjhp32.exe
File created	C:\Windows\SysWOW64\Nhgaocmg.dll	Kfckahdj.exe
File opened for modification	C:\Windows\SysWOW64\Hckjacjg.exe	Hkdbpe32.exe
File created	C:\Windows\SysWOW64\Kfankifm.exe	Kdcbom32.exe
File opened for modification	C:\Windows\SysWOW64\Kmkfhc32.exe	Kipkhdeq.exe
File created	C:\Windows\SysWOW64\Mdhdajea.exe	Mplhql32.exe
File created	C:\Windows\SysWOW64\Ndfqbhia.exe	Nloiakho.exe
File created	C:\Windows\SysWOW64\Olfobjbg.exe	Ojgbfocc.exe
File created	C:\Windows\SysWOW64\Pglcddpd.dll	Helfik32.exe
File created	C:\Windows\SysWOW64\Mgdjapoo.dll	Ipbdmaah.exe
File opened for modification	C:\Windows\SysWOW64\Cdabcm32.exe	Cenahpha.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	Cjmgfgdf.exe
File opened for modification	C:\Windows\SysWOW64\Aacckjaf.exe	Abpcon32.exe
File created	C:\Windows\SysWOW64\Jbaqqh32.dll	Olhlhjpd.exe
File opened for modification	C:\Windows\SysWOW64\Ocpgod32.exe	Odmgcgbi.exe
File created	C:\Windows\SysWOW64\Kmfjodai.dll	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Hkmgakaf.dll	Odpjcm32.exe
File created	C:\Windows\SysWOW64\Kmfmmcbo.exe	Kepelfam.exe
File opened for modification	C:\Windows\SysWOW64\Ngdmod32.exe	Ndfqbhia.exe
File created	C:\Windows\SysWOW64\Lbabpnmn.dll	Dkkcge32.exe
File opened for modification	C:\Windows\SysWOW64\Hmabdibj.exe	Gdjjckag.exe
File created	C:\Windows\SysWOW64\Pfolbmje.exe	Pdmpje32.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Doilmc32.exe
File created	C:\Windows\SysWOW64\Fojlngce.exe	Fllpbldb.exe
File created	C:\Windows\SysWOW64\Lpnlpnih.exe	Llcpoo32.exe
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Jlpkba32.exe	Jianff32.exe
File created	C:\Windows\SysWOW64\Mgimcebb.exe	Mcmabg32.exe
File created	C:\Windows\SysWOW64\Dlgnafam.dll	Dekhneap.exe
File opened for modification	C:\Windows\SysWOW64\Klljnp32.exe	Kimnbd32.exe
File created	C:\Windows\SysWOW64\Bmfpfmmm.dll	Ofnckp32.exe
File created	C:\Windows\SysWOW64\Fjbodfcj.dll	Agoabn32.exe
File created	C:\Windows\SysWOW64\Anmnemcc.dll	Aejfpjne.exe
File created	C:\Windows\SysWOW64\Anbkio32.exe	Ahhblemi.exe
File opened for modification	C:\Windows\SysWOW64\Hobkfd32.exe	Hihbijhn.exe
File created	C:\Windows\SysWOW64\Ocpgod32.exe	Odmgcgbi.exe
File created	C:\Windows\SysWOW64\Ldjicq32.dll	Gdeqhl32.exe
File created	C:\Windows\SysWOW64\Gkaejf32.exe	Gdhmnlcj.exe
File opened for modification	C:\Windows\SysWOW64\Icplcpgo.exe	Ilidbbgl.exe
File created	C:\Windows\SysWOW64\Pkajcp32.dll	Pcojkhap.exe
File opened for modification	C:\Windows\SysWOW64\Cajcbgml.exe	Ckpjfm32.exe
File created	C:\Windows\SysWOW64\Bobcpmfc.exe	Bhikcb32.exe
File created	C:\Windows\SysWOW64\Becbkfdh.dll	Ckpjfm32.exe
File opened for modification	C:\Windows\SysWOW64\Eefhjc32.exe	Echknh32.exe
File created	C:\Windows\SysWOW64\Okokppbk.dll	Kmncnb32.exe
File created	C:\Windows\SysWOW64\Debdld32.dll	Odmgcgbi.exe
File created	C:\Windows\SysWOW64\Mgjpndjd.dll	Acjjfggb.exe
File opened for modification	C:\Windows\SysWOW64\Ahoimd32.exe	Aealah32.exe
File created	C:\Windows\SysWOW64\Ipnjab32.exe	Ikbnacmd.exe
File created	C:\Windows\SysWOW64\Madnnmem.dll	Lmppcbjd.exe
File opened for modification	C:\Windows\SysWOW64\Ocnjidkf.exe	Oponmilc.exe
File created	C:\Windows\SysWOW64\Pkejdahi.dll	Anogiicl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11040	10892	WerFault.exe	518

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Klljnp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qmmnjfnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihjahg32.dll"	Gdcdbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gkaejf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Himldi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jmpgldhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lpnlpnih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Clpgpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhoholen.dll"	Ehimanbq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhccdhqf.dll"	Kfankifm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pqknig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnbmefbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odmkog32.dll"	Ekemhj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gbdgfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qghlmgij.dll"	Ghaliknf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gkoiefmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Llgjjnlj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lmgfda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cffdpghg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncnkogdb.dll"	Bnnjen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eofbch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpnaemnl.dll"	Hcdmga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfaklh32.dll"	Kmdqgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbabpnmn.dll"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hodgkc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oflgep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdhhdlid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Olfobjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmannhhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmfhig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilkojc32.dll"	Peimil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgoilo32.dll"	Abemjmgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gdeqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Neeqea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Daaicfgd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jfhlejnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ageolo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajdbcano.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoglcqao.dll"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiaefcan.dll"	Dhnnep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nloiakho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ofnckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qmkadgpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkifae32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hckjacjg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Immapg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Medgncoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clncadfb.dll"	Ocdqjceo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elocna32.dll"	Pnlaml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcjlcn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnnjen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckijjqka.dll"	Mbfkbhpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mmnldp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnjlpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ckpjfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlajgl32.dll"	Cajcbgml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpjgop32.dll"	Ekhjmiad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qddina32.dll"	Hofdacke.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 828	4960	d300f21048d062084cec36432cd28c62806a9a6e187eff33b28512ede8269261.exe	85
PID 4960 wrote to memory of 828	4960	d300f21048d062084cec36432cd28c62806a9a6e187eff33b28512ede8269261.exe	85
PID 4960 wrote to memory of 828	4960	d300f21048d062084cec36432cd28c62806a9a6e187eff33b28512ede8269261.exe	85
PID 828 wrote to memory of 3672	828	Okeieh32.exe	86
PID 828 wrote to memory of 3672	828	Okeieh32.exe	86
PID 828 wrote to memory of 3672	828	Okeieh32.exe	86
PID 3672 wrote to memory of 3896	3672	Oqbamo32.exe	87
PID 3672 wrote to memory of 3896	3672	Oqbamo32.exe	87
PID 3672 wrote to memory of 3896	3672	Oqbamo32.exe	87
PID 3896 wrote to memory of 3064	3896	Ocqnij32.exe	88
PID 3896 wrote to memory of 3064	3896	Ocqnij32.exe	88
PID 3896 wrote to memory of 3064	3896	Ocqnij32.exe	88
PID 3064 wrote to memory of 2820	3064	Onfbfc32.exe	89
PID 3064 wrote to memory of 2820	3064	Onfbfc32.exe	89
PID 3064 wrote to memory of 2820	3064	Onfbfc32.exe	89
PID 2820 wrote to memory of 4164	2820	Odpjcm32.exe	90
PID 2820 wrote to memory of 4164	2820	Odpjcm32.exe	90
PID 2820 wrote to memory of 4164	2820	Odpjcm32.exe	90
PID 4164 wrote to memory of 4768	4164	Ogogoi32.exe	91
PID 4164 wrote to memory of 4768	4164	Ogogoi32.exe	91
PID 4164 wrote to memory of 4768	4164	Ogogoi32.exe	91
PID 4768 wrote to memory of 824	4768	Onholckc.exe	92
PID 4768 wrote to memory of 824	4768	Onholckc.exe	92
PID 4768 wrote to memory of 824	4768	Onholckc.exe	92
PID 824 wrote to memory of 3556	824	Ocegdjij.exe	93
PID 824 wrote to memory of 3556	824	Ocegdjij.exe	93
PID 824 wrote to memory of 3556	824	Ocegdjij.exe	93
PID 3556 wrote to memory of 2224	3556	Okloegjl.exe	95
PID 3556 wrote to memory of 2224	3556	Okloegjl.exe	95
PID 3556 wrote to memory of 2224	3556	Okloegjl.exe	95
PID 2224 wrote to memory of 952	2224	Onklabip.exe	96
PID 2224 wrote to memory of 952	2224	Onklabip.exe	96
PID 2224 wrote to memory of 952	2224	Onklabip.exe	96
PID 952 wrote to memory of 4664	952	Oqihnn32.exe	97
PID 952 wrote to memory of 4664	952	Oqihnn32.exe	97
PID 952 wrote to memory of 4664	952	Oqihnn32.exe	97
PID 4664 wrote to memory of 1836	4664	Ogcpjhoq.exe	98
PID 4664 wrote to memory of 1836	4664	Ogcpjhoq.exe	98
PID 4664 wrote to memory of 1836	4664	Ogcpjhoq.exe	98
PID 1836 wrote to memory of 2072	1836	Ojalgcnd.exe	99
PID 1836 wrote to memory of 2072	1836	Ojalgcnd.exe	99
PID 1836 wrote to memory of 2072	1836	Ojalgcnd.exe	99
PID 2072 wrote to memory of 4112	2072	Obidhaog.exe	100
PID 2072 wrote to memory of 4112	2072	Obidhaog.exe	100
PID 2072 wrote to memory of 4112	2072	Obidhaog.exe	100
PID 4112 wrote to memory of 1652	4112	Oqkdcn32.exe	101
PID 4112 wrote to memory of 1652	4112	Oqkdcn32.exe	101
PID 4112 wrote to memory of 1652	4112	Oqkdcn32.exe	101
PID 1652 wrote to memory of 4500	1652	Pjdilcla.exe	102
PID 1652 wrote to memory of 4500	1652	Pjdilcla.exe	102
PID 1652 wrote to memory of 4500	1652	Pjdilcla.exe	102
PID 4500 wrote to memory of 724	4500	Peimil32.exe	103
PID 4500 wrote to memory of 724	4500	Peimil32.exe	103
PID 4500 wrote to memory of 724	4500	Peimil32.exe	103
PID 724 wrote to memory of 1640	724	Pkceffcd.exe	104
PID 724 wrote to memory of 1640	724	Pkceffcd.exe	104
PID 724 wrote to memory of 1640	724	Pkceffcd.exe	104
PID 1640 wrote to memory of 1120	1640	Pbmncp32.exe	106
PID 1640 wrote to memory of 1120	1640	Pbmncp32.exe	106
PID 1640 wrote to memory of 1120	1640	Pbmncp32.exe	106
PID 1120 wrote to memory of 2000	1120	Pcojkhap.exe	107
PID 1120 wrote to memory of 2000	1120	Pcojkhap.exe	107
PID 1120 wrote to memory of 2000	1120	Pcojkhap.exe	107
PID 2000 wrote to memory of 4520	2000	Pbpjhp32.exe	108

C:\Users\Admin\AppData\Local\Temp\d300f21048d062084cec36432cd28c62806a9a6e187eff33b28512ede8269261.exe
"C:\Users\Admin\AppData\Local\Temp\d300f21048d062084cec36432cd28c62806a9a6e187eff33b28512ede8269261.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\SysWOW64\Okeieh32.exe
  C:\Windows\system32\Okeieh32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\SysWOW64\Oqbamo32.exe
    C:\Windows\system32\Oqbamo32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\Windows\SysWOW64\Ocqnij32.exe
      C:\Windows\system32\Ocqnij32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3896
    - - C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3064
      - C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2820
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4164
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:824
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3556
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:952
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1836
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:724
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1120
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        23⤵
        Executes dropped EXE
        
        PID:4520
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        24⤵
        Executes dropped EXE
        
        PID:3776
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        25⤵
        Executes dropped EXE
        
        PID:3124
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        26⤵
        Executes dropped EXE
        
        PID:4128
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        27⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        28⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        29⤵
        Executes dropped EXE
        
        PID:1348
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        30⤵
        Executes dropped EXE
        
        PID:2104
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        31⤵
        Executes dropped EXE
        
        PID:4168
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        32⤵
        Executes dropped EXE
        
        PID:3368
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3952
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:8
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        35⤵
        Executes dropped EXE
        
        PID:1548
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3764
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4324
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        38⤵
        Executes dropped EXE
        
        PID:1412
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        39⤵
        Executes dropped EXE
        
        PID:908
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:676
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3352
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        42⤵
        Executes dropped EXE
        
        PID:1004
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        43⤵
        Executes dropped EXE
        
        PID:3288
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        44⤵
        Executes dropped EXE
        
        PID:640
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        45⤵
        Executes dropped EXE
        
        PID:2760
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3724
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        47⤵
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1708
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4420
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        50⤵
        Executes dropped EXE
        
        PID:2832
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        51⤵
        Executes dropped EXE
        
        PID:4220
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        52⤵
        Executes dropped EXE
        
        PID:432
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        53⤵
        Executes dropped EXE
        
        PID:3284
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2348
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        55⤵
        Executes dropped EXE
        
        PID:1896
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        56⤵
        Executes dropped EXE
        
        PID:1376
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4948
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        58⤵
        Executes dropped EXE
        
        PID:2272
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        59⤵
        Executes dropped EXE
        
        PID:2268
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3140
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        61⤵
        Executes dropped EXE
        
        PID:1616
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        62⤵
        Executes dropped EXE
        
        PID:2976
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        63⤵
        Executes dropped EXE
        
        PID:4688
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        64⤵
        Executes dropped EXE
        
        PID:3784
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        65⤵
        Executes dropped EXE
        
        PID:4276
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        66⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        67⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        68⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        69⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        70⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        71⤵
        
        PID:772
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        72⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:924
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        73⤵
        Modifies registry class
        
        PID:3056
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4912
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        75⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        76⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        77⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        78⤵
        Drops file in System32 directory
        
        PID:1044
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        79⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        80⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        81⤵
        Modifies registry class
        
        PID:4916
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        82⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5044
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        84⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        85⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4360
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        87⤵
        
        PID:4076
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        88⤵
        Modifies registry class
        
        PID:4508
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        89⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        90⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        91⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        92⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        93⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4764
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        95⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5172
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        97⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        98⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        99⤵
        Drops file in System32 directory
        
        PID:5328
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        100⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        101⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        102⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        103⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        104⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        105⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        106⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5720
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        108⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        109⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        110⤵
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        111⤵
        Modifies registry class
        
        PID:5952
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        112⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        113⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        114⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        116⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        117⤵
        Drops file in System32 directory
        
        PID:5280
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        118⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        119⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        120⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        121⤵
        Drops file in System32 directory
        
        PID:5616
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        122⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        123⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        124⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        125⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        126⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        127⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        128⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        129⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        130⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5568
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        132⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5908
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5996
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6132
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        136⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        137⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        138⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5932
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        140⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5416
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5824
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        143⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        144⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        145⤵
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        146⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        147⤵
        Modifies registry class
        
        PID:6184
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        148⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        149⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        150⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6312
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        151⤵
        Modifies registry class
        
        PID:6352
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        152⤵
        Modifies registry class
        
        PID:6392
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        153⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        154⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        155⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        156⤵
        Drops file in System32 directory
        
        PID:6576
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        157⤵
        Modifies registry class
        
        PID:6620
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        158⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        159⤵
        Drops file in System32 directory
        
        PID:6704
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        160⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        161⤵
        Drops file in System32 directory
        
        PID:6792
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        162⤵
        Modifies registry class
        
        PID:6828
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6876
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        164⤵
        Drops file in System32 directory
        
        PID:6916
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        165⤵
        Drops file in System32 directory
        
        PID:6956
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        166⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        167⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        168⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        169⤵
        Modifies registry class
        
        PID:7128
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        170⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        171⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        172⤵
        Modifies registry class
        
        PID:6220
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        173⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        174⤵
        Modifies registry class
        
        PID:6344
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        175⤵
        Drops file in System32 directory
        
        PID:6424
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        176⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        177⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        178⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        179⤵
        Modifies registry class
        
        PID:6692
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        180⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        181⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        182⤵
        Modifies registry class
        
        PID:6896
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6964
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        184⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        185⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        186⤵
        Drops file in System32 directory
        
        PID:1668
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        187⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        188⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        189⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        190⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        191⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        192⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        193⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        194⤵
        Drops file in System32 directory
        
        PID:6936
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        195⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        196⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        197⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        198⤵
        Drops file in System32 directory
        
        PID:6540
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        199⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6932
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        201⤵
        Drops file in System32 directory
        
        PID:7136
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        202⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        203⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        204⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        205⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        206⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        207⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        208⤵
        Drops file in System32 directory
        
        PID:7188
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        209⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        210⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        211⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        212⤵
        Modifies registry class
        
        PID:7352
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7392
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        214⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        215⤵
        Modifies registry class
        
        PID:7472
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        216⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        217⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        218⤵
        Modifies registry class
        
        PID:7604
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        219⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7692
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7728
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        222⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        223⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        224⤵
        Drops file in System32 directory
        
        PID:7856
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        225⤵
        Modifies registry class
        
        PID:7896
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        226⤵
        Drops file in System32 directory
        
        PID:7936
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7976
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        228⤵
        Drops file in System32 directory
        
        PID:8012
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        229⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        230⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        231⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        232⤵
        Drops file in System32 directory
        
        PID:8188
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        233⤵
        Modifies registry class
        
        PID:7216
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        234⤵
        Drops file in System32 directory
        
        PID:7260
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7340
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7424
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        237⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        238⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        239⤵
        Drops file in System32 directory
        
        PID:7640
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        240⤵
        Drops file in System32 directory
        
        PID:7712
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7764
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        242⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        243⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        244⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        245⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        246⤵
        Modifies registry class
        
        PID:8108
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8176
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        248⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        249⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7452
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        251⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        252⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        253⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        254⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        255⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        256⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7272
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        258⤵
        Modifies registry class
        
        PID:7532
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        259⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        260⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        261⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        262⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        263⤵
        Modifies registry class
        
        PID:7552
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7864
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        265⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        266⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8048
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        268⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        269⤵
        Drops file in System32 directory
        
        PID:7516
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        270⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8212
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        272⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        273⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        274⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        275⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        276⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        277⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        278⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8548
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        280⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        281⤵
        Modifies registry class
        
        PID:8636
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        282⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        283⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        284⤵
        Modifies registry class
        
        PID:8760
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        285⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8800
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        286⤵
        Drops file in System32 directory
        
        PID:8840
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        287⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8924
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        289⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        290⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        291⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        292⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        293⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        294⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        295⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        296⤵
        Drops file in System32 directory
        
        PID:8256
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8344
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        298⤵
        Modifies registry class
        
        PID:8412
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        299⤵
        Drops file in System32 directory
        
        PID:8536
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        300⤵
        Modifies registry class
        
        PID:8572
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        301⤵
        Drops file in System32 directory
        
        PID:8716
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        302⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        303⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8864
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8968
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        305⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        306⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        307⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        308⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8444
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        310⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        311⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8904
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        313⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        314⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8024
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        316⤵
        Modifies registry class
        
        PID:8600
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8784
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        318⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        319⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        320⤵
        Modifies registry class
        
        PID:8556
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        321⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        322⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        323⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        324⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        325⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        326⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        327⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        328⤵
        Modifies registry class
        
        PID:9344
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        329⤵
        Drops file in System32 directory
        
        PID:9384
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        330⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        331⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        332⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        333⤵
        Drops file in System32 directory
        
        PID:9552
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        334⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        335⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        336⤵
        Modifies registry class
        
        PID:9680
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        337⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9764
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        339⤵
        Modifies registry class
        
        PID:9804
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        340⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        341⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9924
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        343⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        344⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        345⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10096
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        347⤵
        Drops file in System32 directory
        
        PID:10148
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        348⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        349⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        350⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        351⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        352⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9376
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        353⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        354⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        355⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        356⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2060
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        358⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        359⤵
        
        PID:672
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        360⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        361⤵
        Drops file in System32 directory
        
        PID:9892
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        362⤵
        Modifies registry class
        
        PID:9960
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        363⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        364⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        365⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10232
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        367⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9364
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        369⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        370⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2184
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        372⤵
        Modifies registry class
        
        PID:9732
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        373⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        374⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10080
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10168
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        377⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        378⤵
        Modifies registry class
        
        PID:9392
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        379⤵
        Drops file in System32 directory
        
        PID:9628
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9708
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        381⤵
        Drops file in System32 directory
        
        PID:9816
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        382⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        383⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        384⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        385⤵
        Drops file in System32 directory
        
        PID:232
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        386⤵
        Modifies registry class
        
        PID:9868
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9164
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        388⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        389⤵
        Drops file in System32 directory
        
        PID:10064
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        390⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        391⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        392⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        393⤵
        Drops file in System32 directory
        
        PID:10280
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10320
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10380
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        396⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        397⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        398⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        399⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        400⤵
        Modifies registry class
        
        PID:10596
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        401⤵
        Modifies registry class
        
        PID:10636
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        402⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        403⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        404⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        405⤵
        Drops file in System32 directory
        
        PID:10796
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        406⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10880
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        408⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        409⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        410⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        411⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        412⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        413⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        414⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        415⤵
        Modifies registry class
        
        PID:11228
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        416⤵
        Drops file in System32 directory
        
        PID:9488
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        417⤵
        Modifies registry class
        
        PID:10300
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        418⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        419⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        420⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10524
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10604
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10656
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        423⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        424⤵
        Drops file in System32 directory
        
        PID:10836
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        425⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10892 -s 416
        426⤵
        Program crash
        
        PID:11040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 10892 -ip 10892
1⤵
PID:5320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acjjfggb.exe

Filesize
80KB

MD5
3ca6dbd0e94696f45c3aaab33ac09298

SHA1
d87b9ce28428460dbad39c3eb47d6488e1c4a736

SHA256
9d3c33e25d1b00b2ee50419ef0899ba5f60b9644a70218570f81cb112ceb3486

SHA512
25bbbf6782c0b9d77e81d7b69687e6c8a48aca2ce4181dba4934e6fecead4abffa30624d7f8498f7d01d932241a2bc4f37e66bee19f22674dd5c761d6e79721e

Download Submit
C:\Windows\SysWOW64\Afmhck32.exe

Filesize
80KB

MD5
31d78a85c634d34e7fde5d03b159b4c3

SHA1
520985e0d649034d53c41ea756ca55e2d23e51a7

SHA256
9daf2f9a6a30946ddfbf3ac031ecc6d6f7b2fcecce005bfd63fb46cad1d97390

SHA512
131365bf2a87529b10a97ad0b3a9a407bfffe03ab4bb166653dc4fefe5506a41e62b9314fd6fbdc4ffd9eb84f68d9e5972621d8527afc4ea5d486cad605dda45

Download Submit
C:\Windows\SysWOW64\Alhhhcal.exe

Filesize
80KB

MD5
5ed7b20fa68adf84291d65369619642c

SHA1
0256203daeee43ff1bcaca791b035d56e65c9b0f

SHA256
8771a1e91a1fdb797850fb494204abda8408308f65b186f38f5584d2e2f163ef

SHA512
5b1a485e12c0f9d0da0aaffe658009c8539740c866bb53211f628a64a738dda931ff56a7f980f86276dd05c5640090c5a437a7ce311074669e52ab1ddfeb4881

Download Submit
C:\Windows\SysWOW64\Kjmidh32.dll

Filesize
7KB

MD5
f1fa9473de836935e55dec5c30d5ec88

SHA1
1acad732f744d3a9b0ead3b2cdd7790ca4dcdfae

SHA256
a03e9f461c6571db1ee5667ab47b544e5b49f74e44550d9c1fde201d229188b1

SHA512
437be4f2bb16626f8fd6fa151d8aed2ef3cdcddbc693b2aa91db5b2d39d771526df43ded3d954be3545b1a10616641ca4e12aedfc2e2c350061cdbe870051b50

Download Submit
C:\Windows\SysWOW64\Lfkaag32.exe

Filesize
80KB

MD5
eb39fc38335ec281d4e4b40099cb35b0

SHA1
324623e64392f2bffe11ef7ed4b382280819bec1

SHA256
c1f28aa7ffcdd463b96169d10488a645e12c1798078d1af471bf3205c4d93389

SHA512
d558ebedef27c11373410953a28802846ab23225833030f3c55c7093df84bf0a19cb286778e08cc92f80aa86430e1bcf63bd87e4a8e012bd5a93823ae278b8ce

Download Submit
C:\Windows\SysWOW64\Ngmgne32.exe

Filesize
80KB

MD5
54380a272ebfb0ef6b198551e36d0c21

SHA1
0ad856069f97cd05d3c99329770667a3a0b10c9c

SHA256
8f679a41566388acd7e0a08d62f01ecc513994fe8cf14339f2e3a5e204be8b1a

SHA512
43f37f75b004d0abaf0b60d58ce7b9a835a7bfba166b611eae7e27d41a1fbd559628f218674529f602e5eac07cb130f66504fbded55559afbbddbfc98c3f0eeb

Download Submit
C:\Windows\SysWOW64\Obidhaog.exe

Filesize
80KB

MD5
e3d93fc03ac5b5224be39ab5530870f5

SHA1
440deb717b47db0f07e4974758345a17a4e87895

SHA256
b6a8a6bce2647af480d69ca5181d9a155964f6bd43cc6fcca8670a8341afc1bb

SHA512
6ab25f9397000be1087def6157b4cd0c96d6883d9dc0e6f05f6d9c2330c6c042bcb33538967cc483071ca4467ea28a0d5af032a6e2ef8f89c645421cb10e26f3

Download Submit
C:\Windows\SysWOW64\Ocegdjij.exe

Filesize
80KB

MD5
fc993ac7d76cfae1ec020107444af277

SHA1
c816989c423562d5d763dccdb2780e61fe164b02

SHA256
36f61724546451ff98a9c973ea4b4665b523d178b365b347a2562c2bd20b56e2

SHA512
f55ad69f30f8520a2102274a5c83231035d79822f26ee5f2b0cfb5031cf701a4814ff61311b532a45297c463e5dfab4c79c34b2883eef73a1a9133678570f6ae

Download Submit
C:\Windows\SysWOW64\Ocqnij32.exe

Filesize
80KB

MD5
10bf0a81c4e4c5644ecefed5c5fb4b9e

SHA1
53ed280b6c77be11de261c81634382afa5d3f360

SHA256
33b5c7f7da7115682e4513721bae5e0cbdf0325fb4a920e1d2049aee6c1a81f3

SHA512
0f106b0d4e59171e50a544dbc6690211188d51cb4ebae5e694f0b14133071ffa82688098d8eb2fd9a901770be8a55b36a0b9e49ec1992d9196afec1066f0cf8f

Download Submit
C:\Windows\SysWOW64\Odpjcm32.exe

Filesize
80KB

MD5
d21467e8b72b44eece0ac6873c43bd4d

SHA1
89cba1d4b2d0774959fdb24487ccc4617be8978c

SHA256
f9fd70d21ea734426697ae9a2c29b063a7a361b1dd4e10e4d22aefac51eecc07

SHA512
ba053ac760ea5debe71d16efd3281aadf199991a1dbd5087bab5eaceaec791223fa1b8bdee65b4b19dc4e7b3d3f237ac57952feb8d6437482b667d301b84a754

Download Submit
C:\Windows\SysWOW64\Ogcpjhoq.exe

Filesize
80KB

MD5
c412e6d920c89852ca149251d8e259b1

SHA1
496f54b3a1f44aaf627ee3fddf578b02b1900a15

SHA256
61a16d3b9d48b08f9acbbd8c5efcd56843a5d46a27ca06fb8413ea16fb3fea69

SHA512
ac5d5bdd0585549304ad7681b7b2964a0af96b934dbd2ba0cfad5b78514f2aab44178f72328a568b8340963a127770dcebd65276a0626f1cf17a01ba19f2b815

Download Submit
C:\Windows\SysWOW64\Ogogoi32.exe

Filesize
80KB

MD5
fdc82f363cee67b1f36679bdd838bf6d

SHA1
575b3fc1930fde093229337436d167a8268e29e2

SHA256
d4068afb9ef49bba7778436c029fae6391181a4cd6a49dd0879f322ed4ddba76

SHA512
681eaaf6f7a0c6a5a80e0df4ca432c5ab71e1763e6436e344f20242466af7a20d9015765750da8f7200e71688674e1fca038f697fcecdec23433c7afcc002b69

Download Submit
C:\Windows\SysWOW64\Ojalgcnd.exe

Filesize
80KB

MD5
f419fc185c4eb804d13ff68745d6c203

SHA1
3570819cef0a88f1daac8f1369e89049526387ca

SHA256
e7a1d36a599b465ffa79f97590424f40958a133c9430b0ba8c70576adcbc347c

SHA512
7d29613de61515256316f1273335b344210504e43ed1bd883c653368a745fe18e401151089102f1eac7e3757749a444e665c601f6f99a2440888392fe16ea59e

Download Submit
C:\Windows\SysWOW64\Okeieh32.exe

Filesize
80KB

MD5
1d718e8fd2599bf13b567073d46b5aed

SHA1
658cbf597c0ddb2032d358df052ded72da6c36ea

SHA256
b7b38e9d21f9d62a5fabc6fce0942a184e528a9329ac3e182460af18a68a1418

SHA512
3efce0ccad05bd17363c42dd7a087ff6e8147490e4a8488baf9d36b14f85e032c469a708e74400dd67a218fcf39f7f9a01b341a9717159ed2e1ea8e3fab99bfa

Download Submit
C:\Windows\SysWOW64\Okloegjl.exe

Filesize
80KB

MD5
32cf4a4b3ee8abd5c7e14084f4c1f1da

SHA1
0730ee35876fd1d7234ead8a73de225d97bb77cc

SHA256
48a6dd9a098c9d6121b251b865ccabb60cb1055b0b4152b45c2ff2275376bdef

SHA512
8200be58e6b306bb1414f36ac4ddd6e46fd50b291958ee1c1336e48fc4d14653a242f4765fd7b54d4c683f2e59a27becf68263bf1b3f18612a9e446767856b28

Download Submit
C:\Windows\SysWOW64\Onfbfc32.exe

Filesize
80KB

MD5
97545942aaa2ed9d75998d19be20b5cd

SHA1
246a4daf5553c0aac988f63e3d2e7bc9d8267699

SHA256
c0db5b5d487b46a9e2211faa352abb7c72e1ab3ad8c948cbc2b188a3db5237cd

SHA512
99f61152cb85bc420db92c716f7e04ca351d250e5d0777768605224a8acce2a0689354ba9b5723f40a2a1dcbb974ff4eb8c60df9d3d1f7e7f476d9ae28231f64

Download Submit
C:\Windows\SysWOW64\Onholckc.exe

Filesize
80KB

MD5
cb322b0d9f0a935bab2b6eeb5d04210e

SHA1
a5f9ca34de8a4f5a63f242dc06a009d07c6cfbc2

SHA256
5de7616cb4b14e5e29db82098658322e8fb6313ebe1632164106238f359a19a5

SHA512
54a9a2fbfb78a9cd1537590f79eed5ef9451e7dba67343f3dee11878e32977d7e5991cd21f33149b2fcf337d96de8590f944aff8519ada364a30ffa49ad4a272

Download Submit
C:\Windows\SysWOW64\Onklabip.exe

Filesize
80KB

MD5
70d7524db0828a49de743cd15fcf2062

SHA1
8ca14925b84755bb282b2efdcc6bdbbe8d86a839

SHA256
995262f077a94f180049f894d9c129e918c92d47d586054142478f9e202498d9

SHA512
0477f4b77e57648aa69f01905bb5f860ec612c9fda30f5acfe7008e8d9a4b73bce7669fa07472a9dcd331e3fa12c4fa5bcea3ba7e313ca3dde84a074054be7e6

Download Submit
C:\Windows\SysWOW64\Oqbamo32.exe

Filesize
80KB

MD5
c29c938a7af336cb876a016852953e58

SHA1
8cadf7de49672b04a361202e3214a489b809d021

SHA256
eb8a616d5b81e22ffefdcd7d3c431aab5445f9feeb7ad29ac2ce656f3c0b3841

SHA512
758133419eb744255a248e5274c1a7b9f540610962f6e4625ee46d0b24af15b0ed5c0dbe6407130ca55913d14a2c91dbb356feeeb755ac7d32d005931b4f62df

Download Submit
C:\Windows\SysWOW64\Oqihnn32.exe

Filesize
80KB

MD5
fd9ab41386963f0c44b6991a55c8a7fc

SHA1
7a2615829de33d3f192f22c46ca489ba288d0ee1

SHA256
b91328d6c9f66859718803f1471d65f2b5634842a80193b0cac4bba58e2f0123

SHA512
54c69de10c33f57d69dc7ad45b68846ec7b541ebf35657ab0cfb0094f7d69e669f594fbc50d0c2139bc868f018981cfcc9a191a703c1ad75c35de00d3578872e

Download Submit
C:\Windows\SysWOW64\Oqkdcn32.exe

Filesize
80KB

MD5
31f89751afe0d7dfe7b1716036d00172

SHA1
6b46ccea96374a532315bfd559a4916b86293e69

SHA256
1d867c97e950d5643d0c74eb59ed2f1244c5124dce72148e5f27099a39821898

SHA512
e7feb2e9413ede6d17289db6dd64ffbc555f27c6a43426a348b1766acc2be22902386de880d78431a862c3bf70afac9c2204f3d6b327f7d97ef08f383d840215

Download Submit
C:\Windows\SysWOW64\Pabkdmpi.exe

Filesize
80KB

MD5
65a0afaf6b81222016929899b2a5ee5b

SHA1
e28ee4b9c823af702e52fb5c010dec3b64f7de76

SHA256
dc43fd76ffb60f4826bece466249204aa89ea612c20f26821bdb53bb2b5a8783

SHA512
cd0cd5a6fc67e1ef40d1fb158b67bd6f2ac0e4a4903161fc1af41c07e9dca5ab4c37a4ecb8d9071543c61dd282418a073b185774224d9a9f729e5c3ed2fd20d9

Download Submit
C:\Windows\SysWOW64\Pbbgnpgl.exe

Filesize
80KB

MD5
5e5e4c90d3ba27f929aaccf77c4205fc

SHA1
65a1cc729ba9586547e988cc8a7a4c20f63da605

SHA256
b68259e89cdbd27355343aac7edb89887011fcecb6a4f4ca152ae90fefdf138d

SHA512
31b681566425196183185f842f893954fd32ea4b6b774ed128c029c1dc5dacd58b978551ed6f51edc5bbc2fb3c472c9d89462f60448bb7b59a04f1b5efb84683

Download Submit
C:\Windows\SysWOW64\Pbmncp32.exe

Filesize
80KB

MD5
f6ff5d752f20186b37380ea82126ff40

SHA1
8ef49ea8d1bcc2c0c2ec0110fc76f68725dd71ac

SHA256
9992facd55540448baa5fd75555bb395ebe2ce8896fdc53ee0318b40f442d6ce

SHA512
cb6a62aa3ee70059fc771212a4521cc13437ab2fe6ccc0f772bb1de8d3c7a8bea7f60e9ca890ff27a09d35a8b2eac3b1b7f406bb3422dd49e9dc72abb018c23b

Download Submit
C:\Windows\SysWOW64\Pbpjhp32.exe

Filesize
80KB

MD5
cc214254ef7d87380f60367ea5f87323

SHA1
536222bef73d358e1556e2b863db5a2590e4f890

SHA256
b679661efb047d3b6c14e521377233a541844a41816d3b068377421f06a2b9cc

SHA512
d3b9917c86182dc48d246ee2ee10ff5fc741f60aeff93d786b5a63d30845b5c2b9e24c30e4f6fd1c86a0ce84db9b971b3afd8db324972971324760f713fd6289

Download Submit
C:\Windows\SysWOW64\Pcccfh32.exe

Filesize
80KB

MD5
dfc979d5181816d249fcc7ddc7c43467

SHA1
9d859f0fac09688e5aa21fd341b2da300fc75007

SHA256
8183d9103d58e2223cb1d793bf27ccb9e65f67f47bed655c8a3da67bc4aef3a0

SHA512
84a51ab8f35c9753a1ea17a87edfaed666f48fa469eb8ab8ce5877d7064b34a0d239a58ec846a6688914e7615618c673a0200777c247c9974a9398458e9fb026

Download Submit
C:\Windows\SysWOW64\Pcojkhap.exe

Filesize
80KB

MD5
5d3ab56b5ea3ebd7000ea50d85d01fd9

SHA1
6f9d6a10b7edf9780a8739441b4f0c08685a66e0

SHA256
ef7f2b11223051a49dda22dd319e5f704bb4d70613afad29420a80c1230c6410

SHA512
e24b7d6d9ca373be219da7d968130cb42710b55f738523722b97f7bff098262f780b686a1f2cdea0e009260f928c5856e0a42d1bd4f76e7a750f439279a103fc

Download Submit
C:\Windows\SysWOW64\Peimil32.exe

Filesize
80KB

MD5
c2a1fd23284cc249111bc2b913fa7ea1

SHA1
e413b95419811601d4a9ff93862acba7c83b01c9

SHA256
0bcb441fde2bff56a4cdfd65101df9451e5a1ca25adad44103dd8a0268a5955b

SHA512
2f73b3c6f4f90e76372243caa7edcc3baa4b8cbb78d3316938a4f2ff8fc67453559a9006be11089e1e72837ff9720bb32bb99873d09dd0fc45be5839fd156e05

Download Submit
C:\Windows\SysWOW64\Pjdilcla.exe

Filesize
80KB

MD5
7ddfd54ae1e8f243370e682cb5f9a397

SHA1
867a4d8a186be16e3c2699ab7ccd4075d2cfee92

SHA256
2602add45b2af025a02af37b7aa96af19282c2bf096abe10cbd61b7522607e1a

SHA512
6f0242cea3a3adfb025f2afdf799e6d08af962f2dc97d6f146d1d80aea5f4ed32c0c4b78e6bbda7e2bc658590e7fe33d41e896d4375fe32b3606c5db7fad2f02

Download Submit
C:\Windows\SysWOW64\Pjdilcla.exe

Filesize
80KB

MD5
ca4326cbc57c5581ee4bc0c9a16f658f

SHA1
0e3eb45df54029c7f8fce4f4bda8b0fb2f41dc09

SHA256
1a17668b46e4efa7e5759d17eb05b414f83e4e3dc660a27211b7a470503ac9b3

SHA512
cc236e1df0e6de66d5d0337bde72e9338c30229c644fe52ab6d116673b07e572fafe2a9750291377d9f39766c9d8c05cad2c2c01cf0c680165a2a2bfdabf593e

Download Submit
C:\Windows\SysWOW64\Pjkombfj.exe

Filesize
80KB

MD5
ed2be7b4f513880a7e866289fc910e09

SHA1
2c5e0e716b549545da7a2128251bebe90a86c184

SHA256
fc677c4047132a14b33ac2fe7f8aed04c0349b192d860b99ae2844464b5f7779

SHA512
09c643de77279f48be66ad3c73ad445dffec297e56c71d34dd90fd331ba68169b95bfa17bb4fc7fff1c33586437f2d39d89d5ba1dd74c6de6c0876259e32d194

Download Submit
C:\Windows\SysWOW64\Pjmlbbdg.exe

Filesize
80KB

MD5
a4f8855cd875a172fbc9b3f47a3f658f

SHA1
c7cd868a22203e727e374208c8395367e8649fcc

SHA256
4f47e3fab1fbc7e67549a81bac134868c802aedf2c3f553340945717afaa6ff4

SHA512
8fccd9b803346279fed3c3a17d8d12c6a8ec19bd97328253bcbba9ab43c3120eaaed2d43b0d6d6a0e9eba84a52bda9ee793f379c3774128efa5c0553a4308a7e

Download Submit
C:\Windows\SysWOW64\Pkceffcd.exe

Filesize
80KB

MD5
2369dfe4e524ede3ec81fd50ffdcc461

SHA1
3d4b9764cb54894cdbeb62c7f3a49fa3d51e5e0b

SHA256
c38f395a51b954775f34e9bb06ea0f7ce962cf3ba3fb568537527069caa20a52

SHA512
d978f731a966ee0f3fd7603f59ac1631b26058f294341ec20275b320ea87b5b259636c4ae42a44eb9a9200b3fe5ba43923dbb3fa5a3f996e81f41cfeec1d7a1a

Download Submit
C:\Windows\SysWOW64\Qbgqio32.exe

Filesize
80KB

MD5
addc8640f6d1ec54547db62f091488a3

SHA1
877bfa2e685d8870ad0c0642e41850689ad6b489

SHA256
aa53488348fab3869db52ba1bdd15de97f13ed80eef66769d87aa6865886ea33

SHA512
65bff5e5acf557388dacf4677bb3a07ebd4a32202696292d4cbb599d67f115d3f629c8c6a79c46d380496e3b1c7092014005f333515283862aa98fecdb29d1f9

Download Submit
C:\Windows\SysWOW64\Qbimoo32.exe

Filesize
80KB

MD5
285e34608b2f447bd2ac7489d7ca4cd7

SHA1
e278940ee65b2f140a57f0ed91db2d6dc3fa772c

SHA256
27522e14c8fd0cd30ee2a2ab7c12c82aa4aede72f20aa5fa6e2086d21e6d7561

SHA512
ac7731ece539789e726b053e9f6efbfdcfc420e25aa57fc87e54b6a99e513d7ab9d88c05053487ee37b1f1dd53ccdeda09ccae0465def23bd2e209e634ba2851

Download Submit
C:\Windows\SysWOW64\Qchmagie.exe

Filesize
80KB

MD5
89cf93f6e569cbec9ad81b7e07c67797

SHA1
af2d315803be5b8d69509f0a1978f38eea83517e

SHA256
5951e638fb197e997b76d503a92ed159902db34a3060ea1f71ac791f25f6a63d

SHA512
80983ddd6d5c77d8bdb904230061d53aef04ffd6fea1b304c68cde5590b431535ecd67d75fb30605beb7d63aafa9c27247744a70caf83bf42af59a5b5be83abc

Download Submit
C:\Windows\SysWOW64\Qjpiha32.exe

Filesize
80KB

MD5
de3df5744c31a8cca3e9020f077e1d05

SHA1
7dbaf90a9d398668397ff40e70642f8458a062ad

SHA256
b110223ad12366ea20025d9dc4d9dfc4fff13e48f3c8344b0cafe2ed56321f3d

SHA512
95d782905f15f0ebae7ea450daef019fe34f68113ffb1b4fa1d79df344517c2c9e370e31ae1339fd5761436a10700b4506fcbf9e44d5854472141874cc733095

Download Submit
C:\Windows\SysWOW64\Qloebdig.exe

Filesize
80KB

MD5
d5aee37794af8fa19627030ae88a3b10

SHA1
46ea6f37d3b17177ac4f3a9d0bc5c2f3b6c84ac2

SHA256
52b669f7f7be5636d111e56e8dfb41814472bb3000789ec2c6767fe455bc35a7

SHA512
f44f03d0463744c7994211504b5b6f336fea6e320201a2321a35d87d26e2e850fde8b05dacd4463c75ce023d26374b5acf59f37d92d441546e671e7f9c71b7e0

Download Submit
memory/8-262-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/432-374-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/640-325-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/676-298-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/724-148-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/824-64-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/828-7-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/908-292-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/952-93-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1004-310-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1120-160-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1348-224-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1376-398-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1412-286-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1548-268-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1616-424-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1640-152-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1652-128-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1708-350-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1836-111-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1896-388-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2000-167-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2072-117-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2104-231-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2224-80-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2268-416-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2272-406-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2348-382-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2760-328-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2820-40-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2832-362-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2976-430-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3064-31-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3124-196-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3140-422-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3284-376-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3288-320-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3352-308-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3368-248-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3556-76-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3672-20-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3724-334-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3764-278-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3776-188-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3784-442-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3896-24-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3952-256-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4112-119-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4128-204-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4164-52-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4168-244-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4220-364-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4324-284-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4332-216-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4420-356-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4500-136-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4520-175-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4548-207-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4664-95-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4688-436-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4768-55-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4948-402-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4960-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5112-340-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads