37d246cbe524c0d746d74a2efe3dfa25acaf493c20a7fc845048f94d143f8cfe

Analysis

max time kernel
94s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23abf392ece378b6e4846b01848eaeff.exe
Size

63KB
MD5

23abf392ece378b6e4846b01848eaeff
SHA1

6af7a27dcfeac09439ea5d8abd879589ed93485f
SHA256

37d246cbe524c0d746d74a2efe3dfa25acaf493c20a7fc845048f94d143f8cfe
SHA512

d434a4bf9bf6cc3151977180fd92d6e59e044f5ee173e863f4fef7eac0ed9b3ff96f2b89ca58b331aa2454b8abaa436237ed247507787c94ce1c94542321f17b
SSDEEP

1536:fBsk3Cbv8VUbCakDZdoObpeSng9JuNyxPrdQYCRp/5zeR4DX6fl:JVd0gdoFJKyJdCRHzeRMK9

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dchbhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kaemnhla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcifkp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbnhphbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bidemmnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fokbim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjqgff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpgdbg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffbnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmkbnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipegmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmmhjm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cekohk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcikolnh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmgdgjek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aiolam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bekfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chnlihnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmmhjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibccic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdhine32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lklnhlfb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plkbak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blgkdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nddkgonp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Commqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djpnohej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njljefql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpmfddnf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpolqa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnolfdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elccfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcbnejem.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpgkkioa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nacbfdao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmmocpjk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icjmmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaedgjjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcqjfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Beppmmoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eoapbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfhqbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbioei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffjdqg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fflaff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbjhlfhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkkdan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaoaja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chebighd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcdimopp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kajfig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laciofpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehekqe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ejgdpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfqjafdq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijaida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kajfig32.exe

Executes dropped EXE 64 IoCs

pid	Process
3160	Ppdbljkd.exe
3804	Pbbnhfjh.exe
4612	Peajdajk.exe
4752	Plkbak32.exe
1400	Pbekne32.exe
2084	Pecgja32.exe
932	Phbcfl32.exe
908	Qpikgj32.exe
3280	Qbggce32.exe
4336	Qefdpq32.exe
2756	Qhdpll32.exe
1004	Qpkhmi32.exe
3272	Qbjdiedp.exe
456	Qehqepcc.exe
2964	Qhfmalbg.exe
4516	Apndbici.exe
5052	Aaoaja32.exe
812	Aldegj32.exe
2296	Aaanpa32.exe
4576	Aihfanhg.exe
4312	Algbmjgk.exe
2120	Abqjjd32.exe
1624	Aeoffo32.exe
2220	Aliobieh.exe
2944	Abcgoc32.exe
3488	Aeacko32.exe
3948	Ahppgjjl.exe
2504	Aojhdd32.exe
1384	Aahdqp32.exe
4912	Aiolam32.exe
3420	Bpidngil.exe
2852	Bakqfp32.exe
4512	Bibigmpl.exe
3724	Blpechop.exe
4508	Bammlomg.exe
1780	Bidemmnj.exe
1128	Blbaihmn.exe
3624	Boanecla.exe
3204	Bekfan32.exe
2796	Bhibni32.exe
2580	Blennh32.exe
872	Bockjc32.exe
4768	Bemcgmak.exe
5036	Bhlocipo.exe
4920	Blgkdg32.exe
4424	Boegpc32.exe
3728	Beppmmoi.exe
4672	Chnlihnl.exe
5104	Clihig32.exe
2240	Cafpanem.exe
4660	Cimhckeo.exe
3088	Chphoh32.exe
3244	Cpgqpe32.exe
2532	Caimgncj.exe
2396	Cipehkcl.exe
4892	Clnadfbp.exe
4848	Commqb32.exe
2508	Cchiaqjm.exe
3164	Cefemliq.exe
3752	Chebighd.exe
3432	Cpljkdig.exe
2492	Ccjfgphj.exe
64	Ceibclgn.exe
4040	Cidncj32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fqohnp32.exe	Fihqmb32.exe
File opened for modification	C:\Windows\SysWOW64\Kcifkp32.exe	Kdffocib.exe
File opened for modification	C:\Windows\SysWOW64\Ebeejijj.exe	Ecbenm32.exe
File opened for modification	C:\Windows\SysWOW64\Jbocea32.exe	Jpaghf32.exe
File opened for modification	C:\Windows\SysWOW64\Jibeql32.exe	Jjpeepnb.exe
File created	C:\Windows\SysWOW64\Ogaodjbe.dll	Fhajlc32.exe
File opened for modification	C:\Windows\SysWOW64\Jbfpobpb.exe	Jpgdbg32.exe
File created	C:\Windows\SysWOW64\Enbofg32.dll	Kbapjafe.exe
File opened for modification	C:\Windows\SysWOW64\Dcdimopp.exe	Dpemacql.exe
File created	C:\Windows\SysWOW64\Kgfoan32.exe	Kpmfddnf.exe
File created	C:\Windows\SysWOW64\Gddfpk32.dll	Fcikolnh.exe
File created	C:\Windows\SysWOW64\Lmmcfa32.dll	Kpccnefa.exe
File created	C:\Windows\SysWOW64\Dhnepfpj.exe	Djlddi32.exe
File created	C:\Windows\SysWOW64\Npckna32.dll	Nacbfdao.exe
File created	C:\Windows\SysWOW64\Nqfbaq32.exe	Nacbfdao.exe
File created	C:\Windows\SysWOW64\Fcikolnh.exe	Fjqgff32.exe
File created	C:\Windows\SysWOW64\Lgpagm32.exe	Lgpagm32.exe
File opened for modification	C:\Windows\SysWOW64\Aihfanhg.exe	Aaanpa32.exe
File opened for modification	C:\Windows\SysWOW64\Eleplc32.exe	Ejgdpg32.exe
File created	C:\Windows\SysWOW64\Leqcod32.dll	Jibeql32.exe
File created	C:\Windows\SysWOW64\Lnepih32.exe	Lkgdml32.exe
File opened for modification	C:\Windows\SysWOW64\Nacbfdao.exe	Njljefql.exe
File created	C:\Windows\SysWOW64\Fkokhc32.dll	Dcfebonm.exe
File created	C:\Windows\SysWOW64\Fdahphpi.dll	Cidncj32.exe
File created	C:\Windows\SysWOW64\Aiolam32.exe	Aahdqp32.exe
File created	C:\Windows\SysWOW64\Jbocea32.exe	Jpaghf32.exe
File created	C:\Windows\SysWOW64\Nlnldg32.dll	Boegpc32.exe
File created	C:\Windows\SysWOW64\Kdffocib.exe	Kagichjo.exe
File created	C:\Windows\SysWOW64\Ifopiajn.exe	Ibccic32.exe
File created	C:\Windows\SysWOW64\Jmpngk32.exe	Jfffjqdf.exe
File created	C:\Windows\SysWOW64\Dakcla32.dll	Ifjfnb32.exe
File created	C:\Windows\SysWOW64\Qonnknli.dll	Coagla32.exe
File created	C:\Windows\SysWOW64\Gqkhjn32.exe	Gmoliohh.exe
File created	C:\Windows\SysWOW64\Kbmebabl.dll	Ijdeiaio.exe
File opened for modification	C:\Windows\SysWOW64\Jjpeepnb.exe	Jpjqhgol.exe
File created	C:\Windows\SysWOW64\Caimgncj.exe	Cpgqpe32.exe
File opened for modification	C:\Windows\SysWOW64\Ebbidj32.exe	Ecphimfb.exe
File created	C:\Windows\SysWOW64\Gmaioo32.exe	Gjclbc32.exe
File created	C:\Windows\SysWOW64\Jaedgjjd.exe	Iinlemia.exe
File created	C:\Windows\SysWOW64\Bkghno32.dll	Peajdajk.exe
File created	C:\Windows\SysWOW64\Ojigmkeg.dll	Djpnohej.exe
File opened for modification	C:\Windows\SysWOW64\Hpbaqj32.exe	Hmdedo32.exe
File opened for modification	C:\Windows\SysWOW64\Mcklgm32.exe	Mdiklqhm.exe
File created	C:\Windows\SysWOW64\Goohek32.dll	Bpidngil.exe
File created	C:\Windows\SysWOW64\Kgbefoji.exe	Kdcijcke.exe
File opened for modification	C:\Windows\SysWOW64\Fqohnp32.exe	Fihqmb32.exe
File opened for modification	C:\Windows\SysWOW64\Clckpf32.exe	Cidncj32.exe
File opened for modification	C:\Windows\SysWOW64\Ehlaaddj.exe	Ebbidj32.exe
File created	C:\Windows\SysWOW64\Lifenaok.dll	Mahbje32.exe
File created	C:\Windows\SysWOW64\Akonjjdb.dll	Chnlihnl.exe
File opened for modification	C:\Windows\SysWOW64\Ffbnph32.exe	Ecdbdl32.exe
File created	C:\Windows\SysWOW64\Lidmdfdo.dll	Lpcmec32.exe
File created	C:\Windows\SysWOW64\Ppgjkamf.dll	Ehonfc32.exe
File opened for modification	C:\Windows\SysWOW64\Aahdqp32.exe	Aojhdd32.exe
File created	C:\Windows\SysWOW64\Hdgohg32.dll	Fflaff32.exe
File created	C:\Windows\SysWOW64\Fbkmec32.dll	Jmpngk32.exe
File created	C:\Windows\SysWOW64\Pkckjila.dll	Ndghmo32.exe
File opened for modification	C:\Windows\SysWOW64\Algbmjgk.exe	Aihfanhg.exe
File created	C:\Windows\SysWOW64\Gqffnmfa.dll	Mcklgm32.exe
File opened for modification	C:\Windows\SysWOW64\Mnocof32.exe	Mciobn32.exe
File opened for modification	C:\Windows\SysWOW64\Jfkoeppq.exe	Jbocea32.exe
File opened for modification	C:\Windows\SysWOW64\Cchiaqjm.exe	Commqb32.exe
File created	C:\Windows\SysWOW64\Iebapp32.dll	Goiojk32.exe
File created	C:\Windows\SysWOW64\Njljefql.exe	Mcbahlip.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8828	8744	WerFault.exe	371

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ichhhi32.dll"	Jiikak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lilanioo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmoliohh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqmhbpba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjapmdid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhibni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gcidfi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iannfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckegia32.dll"	Laciofpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kogbodfe.dll"	Aihfanhg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfofbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lalcng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Peajdajk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Doccaall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehlaaddj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipckgh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qhfmalbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lklnhlfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Epmcab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipldfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cekohk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebeejijj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjolnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qbggce32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aeacko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebjmif32.dll"	Dhnepfpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpfihl32.dll"	Ipckgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jibeql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inomojol.dll"	Ecbenm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jpojcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hikfoe32.dll"	Aaanpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkbkiioa.dll"	Ebbidj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngfkoo32.dll"	Aldegj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Clihig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipldfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aiolam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkmdbdbp.dll"	Gfcgge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibjqcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebkdha32.dll"	Ibagcc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebbidj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpolqa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkgmcjld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cipehkcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlilmlna.dll"	Iannfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aaanpa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Clckpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djmdfpmb.dll"	Gbjhlfhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcedaheh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khehmdgi.dll"	Lilanioo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lklnhlfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qhfmalbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fodeolof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Goiojk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hippdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncldnkae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddomph32.dll"	Debeijoc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fifdgblo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gncoccha.dll"	Kkkdan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebbidj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Clckpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmbkmemo.dll"	Icjmmg32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 3160	3268	23abf392ece378b6e4846b01848eaeff.exe	88
PID 3268 wrote to memory of 3160	3268	23abf392ece378b6e4846b01848eaeff.exe	88
PID 3268 wrote to memory of 3160	3268	23abf392ece378b6e4846b01848eaeff.exe	88
PID 3160 wrote to memory of 3804	3160	Ppdbljkd.exe	89
PID 3160 wrote to memory of 3804	3160	Ppdbljkd.exe	89
PID 3160 wrote to memory of 3804	3160	Ppdbljkd.exe	89
PID 3804 wrote to memory of 4612	3804	Pbbnhfjh.exe	90
PID 3804 wrote to memory of 4612	3804	Pbbnhfjh.exe	90
PID 3804 wrote to memory of 4612	3804	Pbbnhfjh.exe	90
PID 4612 wrote to memory of 4752	4612	Peajdajk.exe	91
PID 4612 wrote to memory of 4752	4612	Peajdajk.exe	91
PID 4612 wrote to memory of 4752	4612	Peajdajk.exe	91
PID 4752 wrote to memory of 1400	4752	Plkbak32.exe	92
PID 4752 wrote to memory of 1400	4752	Plkbak32.exe	92
PID 4752 wrote to memory of 1400	4752	Plkbak32.exe	92
PID 1400 wrote to memory of 2084	1400	Pbekne32.exe	93
PID 1400 wrote to memory of 2084	1400	Pbekne32.exe	93
PID 1400 wrote to memory of 2084	1400	Pbekne32.exe	93
PID 2084 wrote to memory of 932	2084	Pecgja32.exe	94
PID 2084 wrote to memory of 932	2084	Pecgja32.exe	94
PID 2084 wrote to memory of 932	2084	Pecgja32.exe	94
PID 932 wrote to memory of 908	932	Phbcfl32.exe	95
PID 932 wrote to memory of 908	932	Phbcfl32.exe	95
PID 932 wrote to memory of 908	932	Phbcfl32.exe	95
PID 908 wrote to memory of 3280	908	Qpikgj32.exe	96
PID 908 wrote to memory of 3280	908	Qpikgj32.exe	96
PID 908 wrote to memory of 3280	908	Qpikgj32.exe	96
PID 3280 wrote to memory of 4336	3280	Qbggce32.exe	97
PID 3280 wrote to memory of 4336	3280	Qbggce32.exe	97
PID 3280 wrote to memory of 4336	3280	Qbggce32.exe	97
PID 4336 wrote to memory of 2756	4336	Qefdpq32.exe	98
PID 4336 wrote to memory of 2756	4336	Qefdpq32.exe	98
PID 4336 wrote to memory of 2756	4336	Qefdpq32.exe	98
PID 2756 wrote to memory of 1004	2756	Qhdpll32.exe	100
PID 2756 wrote to memory of 1004	2756	Qhdpll32.exe	100
PID 2756 wrote to memory of 1004	2756	Qhdpll32.exe	100
PID 1004 wrote to memory of 3272	1004	Qpkhmi32.exe	101
PID 1004 wrote to memory of 3272	1004	Qpkhmi32.exe	101
PID 1004 wrote to memory of 3272	1004	Qpkhmi32.exe	101
PID 3272 wrote to memory of 456	3272	Qbjdiedp.exe	102
PID 3272 wrote to memory of 456	3272	Qbjdiedp.exe	102
PID 3272 wrote to memory of 456	3272	Qbjdiedp.exe	102
PID 456 wrote to memory of 2964	456	Qehqepcc.exe	103
PID 456 wrote to memory of 2964	456	Qehqepcc.exe	103
PID 456 wrote to memory of 2964	456	Qehqepcc.exe	103
PID 2964 wrote to memory of 4516	2964	Qhfmalbg.exe	104
PID 2964 wrote to memory of 4516	2964	Qhfmalbg.exe	104
PID 2964 wrote to memory of 4516	2964	Qhfmalbg.exe	104
PID 4516 wrote to memory of 5052	4516	Apndbici.exe	105
PID 4516 wrote to memory of 5052	4516	Apndbici.exe	105
PID 4516 wrote to memory of 5052	4516	Apndbici.exe	105
PID 5052 wrote to memory of 812	5052	Aaoaja32.exe	106
PID 5052 wrote to memory of 812	5052	Aaoaja32.exe	106
PID 5052 wrote to memory of 812	5052	Aaoaja32.exe	106
PID 812 wrote to memory of 2296	812	Aldegj32.exe	107
PID 812 wrote to memory of 2296	812	Aldegj32.exe	107
PID 812 wrote to memory of 2296	812	Aldegj32.exe	107
PID 2296 wrote to memory of 4576	2296	Aaanpa32.exe	108
PID 2296 wrote to memory of 4576	2296	Aaanpa32.exe	108
PID 2296 wrote to memory of 4576	2296	Aaanpa32.exe	108
PID 4576 wrote to memory of 4312	4576	Aihfanhg.exe	109
PID 4576 wrote to memory of 4312	4576	Aihfanhg.exe	109
PID 4576 wrote to memory of 4312	4576	Aihfanhg.exe	109
PID 4312 wrote to memory of 2120	4312	Algbmjgk.exe	110

C:\Users\Admin\AppData\Local\Temp\23abf392ece378b6e4846b01848eaeff.exe
"C:\Users\Admin\AppData\Local\Temp\23abf392ece378b6e4846b01848eaeff.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\SysWOW64\Ppdbljkd.exe
  C:\Windows\system32\Ppdbljkd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Windows\SysWOW64\Pbbnhfjh.exe
    C:\Windows\system32\Pbbnhfjh.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3804
  - - C:\Windows\SysWOW64\Peajdajk.exe
      C:\Windows\system32\Peajdajk.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4612
    - - C:\Windows\SysWOW64\Plkbak32.exe
        
        C:\Windows\system32\Plkbak32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4752
      - C:\Windows\SysWOW64\Pbekne32.exe
        
        C:\Windows\system32\Pbekne32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1400
        
        C:\Windows\SysWOW64\Pecgja32.exe
        
        C:\Windows\system32\Pecgja32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SysWOW64\Phbcfl32.exe
        
        C:\Windows\system32\Phbcfl32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:932
        
        C:\Windows\SysWOW64\Qpikgj32.exe
        
        C:\Windows\system32\Qpikgj32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:908
        
        C:\Windows\SysWOW64\Qbggce32.exe
        
        C:\Windows\system32\Qbggce32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3280
        
        C:\Windows\SysWOW64\Qefdpq32.exe
        
        C:\Windows\system32\Qefdpq32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4336
        
        C:\Windows\SysWOW64\Qhdpll32.exe
        
        C:\Windows\system32\Qhdpll32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2756
        
        C:\Windows\SysWOW64\Qpkhmi32.exe
        
        C:\Windows\system32\Qpkhmi32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1004
        
        C:\Windows\SysWOW64\Qbjdiedp.exe
        
        C:\Windows\system32\Qbjdiedp.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3272
        
        C:\Windows\SysWOW64\Qehqepcc.exe
        
        C:\Windows\system32\Qehqepcc.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\SysWOW64\Qhfmalbg.exe
        
        C:\Windows\system32\Qhfmalbg.exe
        16⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\SysWOW64\Apndbici.exe
        
        C:\Windows\system32\Apndbici.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\SysWOW64\Aaoaja32.exe
        
        C:\Windows\system32\Aaoaja32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\Aldegj32.exe
        
        C:\Windows\system32\Aldegj32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:812
        
        C:\Windows\SysWOW64\Aaanpa32.exe
        
        C:\Windows\system32\Aaanpa32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2296
        
        C:\Windows\SysWOW64\Aihfanhg.exe
        
        C:\Windows\system32\Aihfanhg.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\SysWOW64\Algbmjgk.exe
        
        C:\Windows\system32\Algbmjgk.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4312
        
        C:\Windows\SysWOW64\Abqjjd32.exe
        
        C:\Windows\system32\Abqjjd32.exe
        23⤵
        Executes dropped EXE
        
        PID:2120
        
        C:\Windows\SysWOW64\Aeoffo32.exe
        
        C:\Windows\system32\Aeoffo32.exe
        24⤵
        Executes dropped EXE
        
        PID:1624
        
        C:\Windows\SysWOW64\Aliobieh.exe
        
        C:\Windows\system32\Aliobieh.exe
        25⤵
        Executes dropped EXE
        
        PID:2220
        
        C:\Windows\SysWOW64\Abcgoc32.exe
        
        C:\Windows\system32\Abcgoc32.exe
        26⤵
        Executes dropped EXE
        
        PID:2944
        
        C:\Windows\SysWOW64\Aeacko32.exe
        
        C:\Windows\system32\Aeacko32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3488
        
        C:\Windows\SysWOW64\Ahppgjjl.exe
        
        C:\Windows\system32\Ahppgjjl.exe
        28⤵
        Executes dropped EXE
        
        PID:3948
        
        C:\Windows\SysWOW64\Aojhdd32.exe
        
        C:\Windows\system32\Aojhdd32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2504
        
        C:\Windows\SysWOW64\Aahdqp32.exe
        
        C:\Windows\system32\Aahdqp32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1384
        
        C:\Windows\SysWOW64\Aiolam32.exe
        
        C:\Windows\system32\Aiolam32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4912
        
        C:\Windows\SysWOW64\Bpidngil.exe
        
        C:\Windows\system32\Bpidngil.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3420
        
        C:\Windows\SysWOW64\Bakqfp32.exe
        
        C:\Windows\system32\Bakqfp32.exe
        33⤵
        Executes dropped EXE
        
        PID:2852
        
        C:\Windows\SysWOW64\Bibigmpl.exe
        
        C:\Windows\system32\Bibigmpl.exe
        34⤵
        Executes dropped EXE
        
        PID:4512
        
        C:\Windows\SysWOW64\Blpechop.exe
        
        C:\Windows\system32\Blpechop.exe
        35⤵
        Executes dropped EXE
        
        PID:3724
        
        C:\Windows\SysWOW64\Bammlomg.exe
        
        C:\Windows\system32\Bammlomg.exe
        36⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Bidemmnj.exe
        
        C:\Windows\system32\Bidemmnj.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1780
        
        C:\Windows\SysWOW64\Blbaihmn.exe
        
        C:\Windows\system32\Blbaihmn.exe
        38⤵
        Executes dropped EXE
        
        PID:1128
        
        C:\Windows\SysWOW64\Boanecla.exe
        
        C:\Windows\system32\Boanecla.exe
        39⤵
        Executes dropped EXE
        
        PID:3624
        
        C:\Windows\SysWOW64\Bekfan32.exe
        
        C:\Windows\system32\Bekfan32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3204
        
        C:\Windows\SysWOW64\Bhibni32.exe
        
        C:\Windows\system32\Bhibni32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2796
        
        C:\Windows\SysWOW64\Blennh32.exe
        
        C:\Windows\system32\Blennh32.exe
        42⤵
        Executes dropped EXE
        
        PID:2580
        
        C:\Windows\SysWOW64\Bockjc32.exe
        
        C:\Windows\system32\Bockjc32.exe
        43⤵
        Executes dropped EXE
        
        PID:872
        
        C:\Windows\SysWOW64\Bemcgmak.exe
        
        C:\Windows\system32\Bemcgmak.exe
        44⤵
        Executes dropped EXE
        
        PID:4768
        
        C:\Windows\SysWOW64\Bhlocipo.exe
        
        C:\Windows\system32\Bhlocipo.exe
        45⤵
        Executes dropped EXE
        
        PID:5036
        
        C:\Windows\SysWOW64\Blgkdg32.exe
        
        C:\Windows\system32\Blgkdg32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4920
        
        C:\Windows\SysWOW64\Boegpc32.exe
        
        C:\Windows\system32\Boegpc32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4424
        
        C:\Windows\SysWOW64\Beppmmoi.exe
        
        C:\Windows\system32\Beppmmoi.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3728
        
        C:\Windows\SysWOW64\Chnlihnl.exe
        
        C:\Windows\system32\Chnlihnl.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4672
        
        C:\Windows\SysWOW64\Clihig32.exe
        
        C:\Windows\system32\Clihig32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5104
        
        C:\Windows\SysWOW64\Cafpanem.exe
        
        C:\Windows\system32\Cafpanem.exe
        51⤵
        Executes dropped EXE
        
        PID:2240
        
        C:\Windows\SysWOW64\Cimhckeo.exe
        
        C:\Windows\system32\Cimhckeo.exe
        52⤵
        Executes dropped EXE
        
        PID:4660
        
        C:\Windows\SysWOW64\Chphoh32.exe
        
        C:\Windows\system32\Chphoh32.exe
        53⤵
        Executes dropped EXE
        
        PID:3088
        
        C:\Windows\SysWOW64\Cpgqpe32.exe
        
        C:\Windows\system32\Cpgqpe32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3244
        
        C:\Windows\SysWOW64\Caimgncj.exe
        
        C:\Windows\system32\Caimgncj.exe
        55⤵
        Executes dropped EXE
        
        PID:2532
        
        C:\Windows\SysWOW64\Cipehkcl.exe
        
        C:\Windows\system32\Cipehkcl.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2396
        
        C:\Windows\SysWOW64\Clnadfbp.exe
        
        C:\Windows\system32\Clnadfbp.exe
        57⤵
        Executes dropped EXE
        
        PID:4892
        
        C:\Windows\SysWOW64\Commqb32.exe
        
        C:\Windows\system32\Commqb32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4848
        
        C:\Windows\SysWOW64\Cchiaqjm.exe
        
        C:\Windows\system32\Cchiaqjm.exe
        59⤵
        Executes dropped EXE
        
        PID:2508
        
        C:\Windows\SysWOW64\Cefemliq.exe
        
        C:\Windows\system32\Cefemliq.exe
        60⤵
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\SysWOW64\Chebighd.exe
        
        C:\Windows\system32\Chebighd.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3752
        
        C:\Windows\SysWOW64\Cpljkdig.exe
        
        C:\Windows\system32\Cpljkdig.exe
        62⤵
        Executes dropped EXE
        
        PID:3432
        
        C:\Windows\SysWOW64\Ccjfgphj.exe
        
        C:\Windows\system32\Ccjfgphj.exe
        63⤵
        Executes dropped EXE
        
        PID:2492
        
        C:\Windows\SysWOW64\Ceibclgn.exe
        
        C:\Windows\system32\Ceibclgn.exe
        64⤵
        Executes dropped EXE
        
        PID:64
        
        C:\Windows\SysWOW64\Cidncj32.exe
        
        C:\Windows\system32\Cidncj32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4040
        
        C:\Windows\SysWOW64\Clckpf32.exe
        
        C:\Windows\system32\Clckpf32.exe
        66⤵
        Modifies registry class
        
        PID:4620
        
        C:\Windows\SysWOW64\Coagla32.exe
        
        C:\Windows\system32\Coagla32.exe
        67⤵
        Drops file in System32 directory
        
        PID:2024
        
        C:\Windows\SysWOW64\Cekohk32.exe
        
        C:\Windows\system32\Cekohk32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4676
        
        C:\Windows\SysWOW64\Dlegeemh.exe
        
        C:\Windows\system32\Dlegeemh.exe
        69⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\Doccaall.exe
        
        C:\Windows\system32\Doccaall.exe
        70⤵
        Modifies registry class
        
        PID:960
        
        C:\Windows\SysWOW64\Dabpnlkp.exe
        
        C:\Windows\system32\Dabpnlkp.exe
        71⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\Diihojkb.exe
        
        C:\Windows\system32\Diihojkb.exe
        72⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\Dlgdkeje.exe
        
        C:\Windows\system32\Dlgdkeje.exe
        73⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Dofpgqji.exe
        
        C:\Windows\system32\Dofpgqji.exe
        74⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\Dadlclim.exe
        
        C:\Windows\system32\Dadlclim.exe
        75⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Djlddi32.exe
        
        C:\Windows\system32\Djlddi32.exe
        76⤵
        Drops file in System32 directory
        
        PID:3328
        
        C:\Windows\SysWOW64\Dhnepfpj.exe
        
        C:\Windows\system32\Dhnepfpj.exe
        77⤵
        Modifies registry class
        
        PID:4480
        
        C:\Windows\SysWOW64\Dpemacql.exe
        
        C:\Windows\system32\Dpemacql.exe
        78⤵
        Drops file in System32 directory
        
        PID:4440
        
        C:\Windows\SysWOW64\Dcdimopp.exe
        
        C:\Windows\system32\Dcdimopp.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2032
        
        C:\Windows\SysWOW64\Debeijoc.exe
        
        C:\Windows\system32\Debeijoc.exe
        80⤵
        Modifies registry class
        
        PID:3756
        
        C:\Windows\SysWOW64\Dllmfd32.exe
        
        C:\Windows\system32\Dllmfd32.exe
        81⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Dphifcoi.exe
        
        C:\Windows\system32\Dphifcoi.exe
        82⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\Dcfebonm.exe
        
        C:\Windows\system32\Dcfebonm.exe
        83⤵
        Drops file in System32 directory
        
        PID:1948
        
        C:\Windows\SysWOW64\Daifnk32.exe
        
        C:\Windows\system32\Daifnk32.exe
        84⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\Djpnohej.exe
        
        C:\Windows\system32\Djpnohej.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:708
        
        C:\Windows\SysWOW64\Dlojkddn.exe
        
        C:\Windows\system32\Dlojkddn.exe
        86⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Domfgpca.exe
        
        C:\Windows\system32\Domfgpca.exe
        87⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Dchbhn32.exe
        
        C:\Windows\system32\Dchbhn32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3308
        
        C:\Windows\SysWOW64\Ehekqe32.exe
        
        C:\Windows\system32\Ehekqe32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8
        
        C:\Windows\SysWOW64\Epmcab32.exe
        
        C:\Windows\system32\Epmcab32.exe
        90⤵
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Eckonn32.exe
        
        C:\Windows\system32\Eckonn32.exe
        91⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Ejegjh32.exe
        
        C:\Windows\system32\Ejegjh32.exe
        92⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Elccfc32.exe
        
        C:\Windows\system32\Elccfc32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5252
        
        C:\Windows\SysWOW64\Eoapbo32.exe
        
        C:\Windows\system32\Eoapbo32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5300
        
        C:\Windows\SysWOW64\Ebploj32.exe
        
        C:\Windows\system32\Ebploj32.exe
        95⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Ejgdpg32.exe
        
        C:\Windows\system32\Ejgdpg32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5384
        
        C:\Windows\SysWOW64\Eleplc32.exe
        
        C:\Windows\system32\Eleplc32.exe
        97⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Ecphimfb.exe
        
        C:\Windows\system32\Ecphimfb.exe
        98⤵
        Drops file in System32 directory
        
        PID:5476
        
        C:\Windows\SysWOW64\Ebbidj32.exe
        
        C:\Windows\system32\Ebbidj32.exe
        99⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5520
        
        C:\Windows\SysWOW64\Ehlaaddj.exe
        
        C:\Windows\system32\Ehlaaddj.exe
        100⤵
        Modifies registry class
        
        PID:5564
        
        C:\Windows\SysWOW64\Eqciba32.exe
        
        C:\Windows\system32\Eqciba32.exe
        101⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Ecbenm32.exe
        
        C:\Windows\system32\Ecbenm32.exe
        102⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Ebeejijj.exe
        
        C:\Windows\system32\Ebeejijj.exe
        103⤵
        Modifies registry class
        
        PID:5692
        
        C:\Windows\SysWOW64\Ehonfc32.exe
        
        C:\Windows\system32\Ehonfc32.exe
        104⤵
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Eoifcnid.exe
        
        C:\Windows\system32\Eoifcnid.exe
        105⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Ecdbdl32.exe
        
        C:\Windows\system32\Ecdbdl32.exe
        106⤵
        Drops file in System32 directory
        
        PID:5820
        
        C:\Windows\SysWOW64\Ffbnph32.exe
        
        C:\Windows\system32\Ffbnph32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5860
        
        C:\Windows\SysWOW64\Fhajlc32.exe
        
        C:\Windows\system32\Fhajlc32.exe
        108⤵
        Drops file in System32 directory
        
        PID:5912
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        109⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Fokbim32.exe
        
        C:\Windows\system32\Fokbim32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5996
        
        C:\Windows\SysWOW64\Fbioei32.exe
        
        C:\Windows\system32\Fbioei32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6036
        
        C:\Windows\SysWOW64\Ffekegon.exe
        
        C:\Windows\system32\Ffekegon.exe
        112⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Fjqgff32.exe
        
        C:\Windows\system32\Fjqgff32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6120
        
        C:\Windows\SysWOW64\Fcikolnh.exe
        
        C:\Windows\system32\Fcikolnh.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5148
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        115⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Fifdgblo.exe
        
        C:\Windows\system32\Fifdgblo.exe
        116⤵
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Fqmlhpla.exe
        
        C:\Windows\system32\Fqmlhpla.exe
        117⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Fbnhphbp.exe
        
        C:\Windows\system32\Fbnhphbp.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5472
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5548
        
        C:\Windows\SysWOW64\Fjepaecb.exe
        
        C:\Windows\system32\Fjepaecb.exe
        120⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        121⤵
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Fqohnp32.exe
        
        C:\Windows\system32\Fqohnp32.exe
        122⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Fflaff32.exe
        
        C:\Windows\system32\Fflaff32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5828
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        124⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Fijmbb32.exe
        
        C:\Windows\system32\Fijmbb32.exe
        125⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        126⤵
        Modifies registry class
        
        PID:6028
        
        C:\Windows\SysWOW64\Gcpapkgp.exe
        
        C:\Windows\system32\Gcpapkgp.exe
        127⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        128⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Gimjhafg.exe
        
        C:\Windows\system32\Gimjhafg.exe
        129⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Gqdbiofi.exe
        
        C:\Windows\system32\Gqdbiofi.exe
        130⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Gcbnejem.exe
        
        C:\Windows\system32\Gcbnejem.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5504
        
        C:\Windows\SysWOW64\Gfqjafdq.exe
        
        C:\Windows\system32\Gfqjafdq.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5632
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        133⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5852
        
        C:\Windows\SysWOW64\Goiojk32.exe
        
        C:\Windows\system32\Goiojk32.exe
        135⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5960
        
        C:\Windows\SysWOW64\Gbgkfg32.exe
        
        C:\Windows\system32\Gbgkfg32.exe
        136⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Gfcgge32.exe
        
        C:\Windows\system32\Gfcgge32.exe
        137⤵
        Modifies registry class
        
        PID:3936
        
        C:\Windows\SysWOW64\Giacca32.exe
        
        C:\Windows\system32\Giacca32.exe
        138⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5436
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        140⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5868
        
        C:\Windows\SysWOW64\Gjapmdid.exe
        
        C:\Windows\system32\Gjapmdid.exe
        142⤵
        Modifies registry class
        
        PID:3820
        
        C:\Windows\SysWOW64\Gmoliohh.exe
        
        C:\Windows\system32\Gmoliohh.exe
        143⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5280
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        144⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        145⤵
        Modifies registry class
        
        PID:5816
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5188
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        147⤵
        Drops file in System32 directory
        
        PID:5600
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        148⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        149⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        150⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        151⤵
        Drops file in System32 directory
        
        PID:6192
        
        C:\Windows\SysWOW64\Hpbaqj32.exe
        
        C:\Windows\system32\Hpbaqj32.exe
        152⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        153⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        154⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        155⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6420
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        157⤵
        Modifies registry class
        
        PID:6456
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        158⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6572
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        160⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        161⤵
        Modifies registry class
        
        PID:6680
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        162⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        163⤵
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        164⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        165⤵
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        166⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6988
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        168⤵
        Modifies registry class
        
        PID:7032
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        169⤵
        Modifies registry class
        
        PID:7092
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7132
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        171⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        172⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6284
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        174⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        175⤵
        Drops file in System32 directory
        
        PID:6416
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        176⤵
        Modifies registry class
        
        PID:6484
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        177⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        178⤵
        Drops file in System32 directory
        
        PID:6668
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        179⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        180⤵
        Modifies registry class
        
        PID:6848
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        181⤵
        Modifies registry class
        
        PID:6940
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        182⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        183⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5392
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6244
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        186⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        187⤵
        Drops file in System32 directory
        
        PID:6480
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6660
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6776
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        190⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        191⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        192⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        193⤵
        Drops file in System32 directory
        
        PID:6308
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        194⤵
        Drops file in System32 directory
        
        PID:6496
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        195⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6784
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        196⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7160
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        198⤵
        Drops file in System32 directory
        
        PID:6464
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        199⤵
        Drops file in System32 directory
        
        PID:6936
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        200⤵
        Modifies registry class
        
        PID:6336
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        201⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        202⤵
        Drops file in System32 directory
        
        PID:6560
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        203⤵
        Drops file in System32 directory
        
        PID:6736
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        204⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        205⤵
        Modifies registry class
        
        PID:7240
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        206⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        207⤵
        Drops file in System32 directory
        
        PID:7324
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        208⤵
        Drops file in System32 directory
        
        PID:7368
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        209⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7448
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        211⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7532
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7576
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        214⤵
        Drops file in System32 directory
        
        PID:7616
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        215⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        216⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        217⤵
        Drops file in System32 directory
        
        PID:7740
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        218⤵
        Drops file in System32 directory
        
        PID:7780
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7820
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        220⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        221⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7952
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7988
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8036
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        225⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        226⤵
        Modifies registry class
        
        PID:8112
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        227⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7140
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        229⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        230⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        231⤵
        Drops file in System32 directory
        
        PID:7360
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        232⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        233⤵
        Drops file in System32 directory
        
        PID:7484
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        234⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        235⤵
        Modifies registry class
        
        PID:7604
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7680
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7728
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        238⤵
        Drops file in System32 directory
        
        PID:7804
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        239⤵
        Modifies registry class
        
        PID:7856
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7920
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7996
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        242⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        243⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        244⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        245⤵
        Drops file in System32 directory
        
        PID:7236
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        246⤵
        Drops file in System32 directory
        
        PID:7364
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        247⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        248⤵
        Drops file in System32 directory
        
        PID:7572
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        249⤵
        Drops file in System32 directory
        
        PID:7720
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        250⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        251⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8028
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        253⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        254⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        255⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7752
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        257⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8180
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        259⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7768
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        261⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        262⤵
        Drops file in System32 directory
        
        PID:7512
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7932
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7792
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        265⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        266⤵
        Modifies registry class
        
        PID:8196
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        267⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        268⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8328
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        270⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        271⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        272⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        273⤵
        Drops file in System32 directory
        
        PID:8488
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        274⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8576
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        276⤵
        Modifies registry class
        
        PID:8616
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        277⤵
        Modifies registry class
        
        PID:8664
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        278⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        279⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8744 -s 400
        280⤵
        Program crash
        
        PID:8828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 8744 -ip 8744
1⤵
PID:8808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaanpa32.exe

Filesize
63KB

MD5
77940b31d5251d3d79a519a2d0d263e9

SHA1
08e3c2c1c7b1bc9e6d6e2f21987acaea57310637

SHA256
97fc37df75fdc92a93bf023029348f227a7a2f4e0dc634215a37b6fc5b4040e2

SHA512
6fc06b9c0079c829a37e040de788c28d5de9f764d382faf8780802422b7aadcef3c520a71f3d19d1ec250168b14dc432d409e307ff3ad0d80189329faf09f68a

Download Submit
C:\Windows\SysWOW64\Aahdqp32.exe

Filesize
63KB

MD5
733318f37554ec85e128a936a4b7ced0

SHA1
f5df4f936980783ea558663fb2f9f2bc075a4f48

SHA256
3eebe3a24dc5f63dc9753aa3d3b46296b1d461ad03eda64b531c350f30d190ef

SHA512
fdfff8844603a7014a83ae0178d8075a0cca848047879bb24efe07858484fb506d98635e1ee0fd155f779678067aaebd01f54a8180609594441d99d327392c61

Download Submit
C:\Windows\SysWOW64\Aaoaja32.exe

Filesize
63KB

MD5
a21643974bd3eda18ecac3fc50537598

SHA1
5d24b986de782c9b0870bd1711e4f9155bbf83e5

SHA256
e1827fb4766723268edff8486e1c323686c3f9e9b68b6ca71e3d0feb5f2c5b38

SHA512
2a45f3609825d7f4cf24df10aefe1a3c7c81df4a21d1b9df15148253dbdb28e9db97a2ee019dda7cc9fbb4284bf49b1e80d7c0c27b40d2b2a2ccb25986548766

Download Submit
C:\Windows\SysWOW64\Abcgoc32.exe

Filesize
63KB

MD5
3c9d1832ebcc13205dd345b68c64f202

SHA1
e092d7dccb87a4b4712b490dc341d7e69d286047

SHA256
26f74bb4a66bc84d32cadfdad18fd45230dec482b2b78929b9ed7b92ec1cc3a8

SHA512
fdb3a6414055ca08e660c4daf67cf178f367cff7dfbc992207fd28476c9dca7dc29ffb5bb1e6e8ab50c607cd5c6baaef900ebe686fe25e5d9aa8355da6d7b480

Download Submit
C:\Windows\SysWOW64\Abqjjd32.exe

Filesize
63KB

MD5
b8725a7b5a865a5458b35917fe06a3c9

SHA1
8fb9fea0808227bc6c3e8e3ff6762d5c7229cdb4

SHA256
0e211acaaa2234a872147755aac78c49a9e3106eb48df4630c2136c354b3dfce

SHA512
d57f6cb0d49d03c740d14613f6c8b529ee4219e52a3c0bf27685ccf4854d37c4d16e979569917bcea57b3ee63a9bbc555ed6cf6b32039ef4106d59be9d419489

Download Submit
C:\Windows\SysWOW64\Aeacko32.exe

Filesize
63KB

MD5
1b20c1e3e3aefcc37982eab1b1f40edf

SHA1
7a946913e9ed0a7fa39fcd781bac85281993d86c

SHA256
548f98e7215ddf6e5091ac6298b6f592a06a218a4f5b494d8fec0a41c8a2ed92

SHA512
367667be0ec1782394a5fe544c2671e9713e11d5e898a368d9f57a47b793f62cfb9594aa5bd05bd8816be1cb9ba520fe5b828dca01e5c5f4bebb9fc85584af22

Download Submit
C:\Windows\SysWOW64\Aeoffo32.exe

Filesize
63KB

MD5
1737f0dabfa8c2ac03fa25068757cb61

SHA1
7a5def5fb45377b53fbed95e5a363450f8f9f3ca

SHA256
40ab28eb0b7bb10bfa1fe640b4ee606eb5fb1147563f163c34b11e1f9205eff3

SHA512
18a8d23f556e020a99e6a246ef4030402d586d0e8047db4b8aa16d041c404b593f4b333422157053303a622de2d9ad921a783dd86ec26e110f2070a36b570197

Download Submit
C:\Windows\SysWOW64\Ahppgjjl.exe

Filesize
63KB

MD5
4dafa7fc9679976ef4b53e434b526fe6

SHA1
8c91b57260d50f9f659f583061b4a8d64c6a625a

SHA256
4ce818a607cd4da59857f79120d4adc0807232a66f9c8980fba6ace6fa994586

SHA512
0f3634c90ba6d3fee37c8a81945f0fdc552ea276e4890ca511e09c24675af264110d2c62dda78730ec4ac84981dcea0fa7a7b6f2aba4b2871575328b95aefbf1

Download Submit
C:\Windows\SysWOW64\Aihfanhg.exe

Filesize
63KB

MD5
2671bb4dc323786f53c4d3346ab72e95

SHA1
a84d654e5d0ac3926347ec2e29b9bafc175a0a72

SHA256
e7c82aec71e46a634ad2d22b723db70c93b7c3c0056d544391b9b026b3cdaf55

SHA512
26a549464f6b16327fcb1554ae68eaea7c8917a88be1ab8a0c6a239df6052639504cac3864ee7a78f666b9f53504454d83114dc18bbe6646dd81ec0e05e69bcf

Download Submit
C:\Windows\SysWOW64\Aiolam32.exe

Filesize
63KB

MD5
f452da8fc746623cbcf23d1ba455be06

SHA1
900619390939bbdb8a6d5308fbf3fcfeeb08304c

SHA256
bb8dd050f912001b6317bc67f7a33793cf3ef690ebb7537dc256ece4cdfbbffd

SHA512
ec2da3bcaacf3bd6dc720076019521b91b52169f8e8d05893a219a5822992a8ced71e63e4919a59707ae5cad1964f7e075ce493d8fb16a42746fbd066ca4c656

Download Submit
C:\Windows\SysWOW64\Aldegj32.exe

Filesize
63KB

MD5
c909eaed8ac3fcd16da46197b1569d6e

SHA1
32f983de62df7daa7b7cc69b07f8397f9ccf7000

SHA256
d84939039fd2a12da0e53d6da496ce995d3b0742941ebce7980d81a22781b13b

SHA512
4b2e41051ed4248743f3a34c2431b7ffd64369bc41eb15c7e893fd9d76f60bf74a90da417508f6cc13a8b81ad8326a40195ce8270b422fb27ef1d09fa72c6e4b

Download Submit
C:\Windows\SysWOW64\Algbmjgk.exe

Filesize
63KB

MD5
949cb219cab5421456f905dea39b0262

SHA1
1b9d2c8afd55e8e06f26899fedb5aaba311ac11b

SHA256
5f787b6ff74acdb704cfe94dedb073ae53c1be751ba2495a7921738cc2eb7483

SHA512
5e39b169a0670fa3f9bcbf1c168d4889e98097d39bb1618aa985d291823298c69b96419a1d043619ae25af3a3a3de5492a0bef7ef5e45867b196fac1fc4dda81

Download Submit
C:\Windows\SysWOW64\Aliobieh.exe

Filesize
63KB

MD5
922ff43d810c067280d8b4d2956eabcc

SHA1
90fefaa1264c880d4a66b16063cad0d7c573d057

SHA256
bc6a9bb4b90ae2d3d8f6d876365700669de3c2017e4ca1242fbac1f9f54d2364

SHA512
1994f4705064f3a3d2050b42169c8b52d5c60ac150ed760c76be119209b9e94f737b9f4a8ffcf9f99774a570b4aa318e93a3397b149763f4d61adc4ee040a948

Download Submit
C:\Windows\SysWOW64\Aojhdd32.exe

Filesize
63KB

MD5
dacfcae91ac4f1de3a5d02f496905a7e

SHA1
a2fcef9521f14eefe43d2859dac64745f19cce9a

SHA256
7fa9edc290b2c0d2a0c20b08eaed1de24fc620b968297d50b0b322e9596cfc74

SHA512
a1500934dc3345fe608f018dd4a3946892f55ce280c7d4be4bb23cd23a66b1ebd6e80d14065cab0afe212b88e3f597085ebedd62d961e2c3a3cb20b4ee3e8501

Download Submit
C:\Windows\SysWOW64\Apndbici.exe

Filesize
63KB

MD5
4ba199493cc2a5a1ca5ed65b55cba659

SHA1
3406cf97e27c6660080c90a327f4ac349bb4ca6a

SHA256
68e26e1b851bc976e7e0819533451ccdf9aa7e47536ba427f00819ec73cf584e

SHA512
88ae86de03d333bfff55dfbd55df6355b0b3d1cd77995b8700551fccaae65530e4292baffd39a45971f432b39d18284a320c28a6841beeeb8e363e883ac11772

Download Submit
C:\Windows\SysWOW64\Bakqfp32.exe

Filesize
63KB

MD5
e5f68523f1800a25de437acc2f4b63d2

SHA1
41531746149ccc243da835f0b49070f37e5e369d

SHA256
69a4bc94d53a7270f84d42e351237e0b9dccbabef9c3384b9a6e7832fa39311a

SHA512
5306813a18c07c4fac31a207ffb66d6e5184deedeea96039b486b1515dda4922f8249ea6dd28cb7b417e3029a6a62c77555125ddfb36aeed02eabc667de90749

Download Submit
C:\Windows\SysWOW64\Bpidngil.exe

Filesize
63KB

MD5
7341bea24920bb88dd9313208fd962e4

SHA1
e069eeea4d9f115856ee7fb276de35fd4af2c764

SHA256
4c5d48aed0967a848d4b7ee60efffcd9a0177c51c65d4fc109d7632dca02f2e5

SHA512
b9de262f94be03bb36b4831ab34386fda591262a87813689a43d648ed5ca9d9294a6570a72db76e4ffd615b4804d899c92cdc66d9bc02ced9795057160d607f3

Download Submit
C:\Windows\SysWOW64\Gmmocpjk.exe

Filesize
63KB

MD5
03a7ac744d420a66a706ddbb3414c6d9

SHA1
059fa181e7dcf3b243f2d32a07d6f32e54fdb202

SHA256
3578841c42f5d44562db63563db7245d9f3ce7d5ea088da18cfebffcb099d02d

SHA512
ed78a267ed82bb61974b9c651865352f5501027ebda39b0aeaa5a914a59ab1c70ba02a92321a845020743d8d828ca796568a58bb7332cf552c3e2a64f66022f3

Download Submit
C:\Windows\SysWOW64\Iannfk32.exe

Filesize
63KB

MD5
33aa4af3909393d890d37238ceb41f2d

SHA1
aeb0c986acd66400e2b6402128a7343df82c37a0

SHA256
e9d646c855aece02a15c31e7d74f3f5ef86352b904f1b3fc1dc4e5cc901699d6

SHA512
061251a89b9ff0c671b441c9fce3d55b39556b76cbc55db9c55ed913e578e281bb875d783e430828380f625942d92dce186bbf0ed086a3b12c2fab2a09feca51

Download Submit
C:\Windows\SysWOW64\Lnepih32.exe

Filesize
63KB

MD5
7fa89bec3b486cc03813986c0a448ecc

SHA1
d2c415cb772d1ec5e7351649622754c0e25dd6a3

SHA256
c2934602dc23b54bf7dfda7419aa5280fded6b6c0206ed165ebe0418618b4152

SHA512
b5a4046a0a8dc37aebcb7d2acf261e8fe7070a2e60ce0866aff1c29592757c4516fe6abfef1f2d35f826460a4a5604ec09f0fa50e28486c1a260cf1380b00b62

Download Submit
C:\Windows\SysWOW64\Pbbnhfjh.exe

Filesize
63KB

MD5
9127f251264d563ca291c8d56008a99a

SHA1
2916140f11f92f285eec571b4517bea4f05e86b1

SHA256
ca568f4ef8a992f90f25bf64f930977e441eaa9fe5f8778fbffda54640701cfd

SHA512
8622636061a222e78bf4889a9f988a3b018b88553f154b0a13138bd19f74554da5458b37e8f07bd880d0efabfd93fd51798b5d8acdf2de0828cf00a80009f37e

Download Submit
C:\Windows\SysWOW64\Pbekne32.exe

Filesize
63KB

MD5
3b6f86471d0aeba88cbd2c4ba34d7378

SHA1
ba195f36a506cc2362bf925967a781305a869679

SHA256
c81e7f3fe59591dda0cb970d472986facfe930b225a49d03ca9aa4ff5fe1fbf8

SHA512
2e72180f93057392948304bd3c401f5485d66dc5dc13493f98fea9a5dd8a75540bfe35210a4c75508bffd58c1d72560e1a51f4fe0d1e04e7ce6e39d82199c508

Download Submit
C:\Windows\SysWOW64\Peajdajk.exe

Filesize
63KB

MD5
95e31f659c420e8f194a059281f33f69

SHA1
6302ab2b8d912ebf9a9a2b0bcb6b7c8d5d6f3c4c

SHA256
9cd453e615f54f31e63252f4ce54101d7622223cc6873d53cc9303e99b957b4b

SHA512
7903777716ed5d5fd7e49d16b6c56444cd059447495ff142821ec980e8f4c968000d06623449be78878c7dfa7a9f0b496cb06413314657078cdf1c8e991ef8f8

Download Submit
C:\Windows\SysWOW64\Pecgja32.exe

Filesize
63KB

MD5
fc380c3f6a0fc17471178d56d57f0d79

SHA1
c6ebd4f3f8b965c4783e0859ad349c16fcc22059

SHA256
3d98bd735f1ae1c3ed102a3c5237ae23396739f2ed4c1e933845b6e3b750987f

SHA512
ded5a47d7ae45b3c26dc746205d20e9a6554e19d635638906e90b77ee5a585fe4a81b7851d903b87f7a83df5617e57053e425b3dd3e325d768fbce5fb96818c2

Download Submit
C:\Windows\SysWOW64\Phbcfl32.exe

Filesize
63KB

MD5
ee1068c66558efe1dd7862024e4246a0

SHA1
a435b2685ee1bc855e32e79924f4f54939acece4

SHA256
d2e1c44148297c8819e448309855fca49855d0048d4b68d48c36e33644b23e37

SHA512
3672ee59083e621ec0c731ae6fd163d93771edb885af129cae368df6fecd085799d6ff3c8c650469b12491eb467331e157895bf9cebd4c1d38f777745901592a

Download Submit
C:\Windows\SysWOW64\Plkbak32.exe

Filesize
63KB

MD5
767f91baeedf9881307519fdf9113f5c

SHA1
0e1e8f63f9afaac7e1891d8c13bbbeda7c8c47a6

SHA256
41a4a1ff6060ee6bfe217c1a48b0a03ee346d9d830af2c3d1d10c36f92b8eff0

SHA512
e895b27d8747ab1273d18f4f27a43aaa1df71b9181ff5da6de043e3bd0e60ac0d3b04aee2b1beb45de6630b7f80b10139ba8adb9fddc6700c3e748ec41e8a6c2

Download Submit
C:\Windows\SysWOW64\Ppdbljkd.exe

Filesize
63KB

MD5
d286fb240074f8f9f89591917c935181

SHA1
b40983e648fd334ddc67325c04b4844733fa59fd

SHA256
2380723310ad3c00dd56dfa47a236a8d93e5c73e13cad36477b116ee5bbd883c

SHA512
56d75445a425bfaf4c9dcbf7319f409ef5019c26c167b9d710b81cdf9f68deef22cac07ea6fd29dda9693906cd3c5d25c7506b4955fb7a096d66bef7ea320aae

Download Submit
C:\Windows\SysWOW64\Qbggce32.exe

Filesize
63KB

MD5
852bfe58e9320392d370c31b82bbe045

SHA1
86c5a2af3d64edafe6908db39a31414ec161f824

SHA256
58e1055386c627440222d0769b832401a2e9acadb2f308ff89005f8fbb1c8076

SHA512
1ed50e36d7c3980f471dbe08dc224b713b661837a656209f28f05195554404a10b40205992b95aad30b465636a340851858164ad98e590a15e43126396f7f337

Download Submit
C:\Windows\SysWOW64\Qbjdiedp.exe

Filesize
63KB

MD5
2b3279f422c007b361f96384b4090d73

SHA1
5e8ef0e61cb71e9c935a5042e9422a96b6ded91e

SHA256
cde83edcdd24360b03d44489676446d5309e2bfc5a8931d4d6220004b60c4e62

SHA512
35836725b244a987692afcbe0a8d5016936e358038a38e423b532ee13548b30a6db2498c16a03bb03ca025d0219c9fe91a70b86012492a43950839136aa0d987

Download Submit
C:\Windows\SysWOW64\Qefdpq32.exe

Filesize
63KB

MD5
53e043c371069fe94b7c971ca3381953

SHA1
fc0bae3468ea9325c065cc8c15027280c3adc557

SHA256
8a85f8b203231c61ba0f85795165d1a601aa85911d0d27104b9451372506d8b6

SHA512
78d88ac0a4f39ad867548d39e33fa561112c8e3596f1dc1a297943b2c30734b56d0fdefbe5ef42a51da07572954cc82223de3621ed3865bbd1e82a269e9ef354

Download Submit
C:\Windows\SysWOW64\Qehqepcc.exe

Filesize
63KB

MD5
721013358aef618e58f3db6e8d1f33cf

SHA1
7e382f99b2fffeab3f946544237911e657bdf205

SHA256
f8907a8b44f8b67f0f28c5c9cedbb341f6f10d1489c88ced009d91388486459c

SHA512
4e69b8f477294352e494b4e94b0b029c5c21218a6e70d8b83cd5c814ada54a45f7c750f714ac0c15a8b4f9db97bbf15c23b50335507d6b3732adf841b15c4d75

Download Submit
C:\Windows\SysWOW64\Qhdpll32.exe

Filesize
63KB

MD5
ff19245c1a5a8e2a4ccc8136b0e79b13

SHA1
37356f5da84c576a4aaa8f5b19c31dd23a17d0bd

SHA256
28d0b71eb95049c5ec7f6d67efdd40ddfd0f894b08b43b2848d6753bdcd0883a

SHA512
a2ea95caee014934f262cd323ee4373f2c87ef72aa996218053176375746316765c6ea568ad120a2fac478ec83d822c5a75968cc9fd7b16dfa44a10d8d112792

Download Submit
C:\Windows\SysWOW64\Qhfmalbg.exe

Filesize
63KB

MD5
cacc18eeb53e14f370cf927698a0160e

SHA1
c2701d6fb8b93d25c9d2d55c210040d1d60c0b25

SHA256
54e1cf921e35855e42e3b378f90c02bfde7628d732232ec1e76b77badca20c82

SHA512
23867ef9921953bf3eb8190c54f3e5fac6202396b76e06a02bab8da8d74f25464dd592d08369c4c75fe2f68cb4befd5b39082911b92988543d4fa70e06b13237

Download Submit
C:\Windows\SysWOW64\Qpikgj32.exe

Filesize
63KB

MD5
af65e0f5b160123c1e191fe7da41e223

SHA1
54448eb39d1f364a3a73647be63e7c1deb974638

SHA256
0eb5f3062afb7edc28d4918e87e74ff0fba0ee0ffe6450d71b0d50f9c4a34cb1

SHA512
49c0c90178b4719fc5b9dd2b58e7fbe4e483db9c79c3efdff38d33447a02a5e716122cce563edf037ddb66834f683e2448dc69de3caafb8b4296e7508540a1cc

Download Submit
C:\Windows\SysWOW64\Qpkhmi32.exe

Filesize
63KB

MD5
64dae374cfc2c5902a26982d44e23b73

SHA1
c944f68b10c7ec7f38d023df1642d2e97ad8bb9f

SHA256
93ec3c62630442a763ed65c72dfa3c7a94b4687d173b57330dbb8fb86cb71db8

SHA512
05c0422135e62f7a65d473c439c8fced1fd506c490ea8e97f5d6f29bb88ceabec72cbb0e9fd3d0d5f476d073d8cca6182d67e80d996255967b6342d36d468d9b

Download Submit
memory/456-113-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/812-145-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/872-321-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/908-65-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/932-57-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1004-101-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1128-288-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1384-233-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1400-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1624-185-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1780-281-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2084-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2120-177-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2220-193-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2240-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2296-153-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2396-395-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2492-437-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2504-225-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2508-413-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2532-393-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2580-315-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2756-89-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2796-305-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2852-261-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2944-201-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2964-121-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3088-377-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3160-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3164-419-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3204-299-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3244-387-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3268-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3268-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3272-105-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3280-73-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3420-248-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3432-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3488-209-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3624-293-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3724-273-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3728-347-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3752-425-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3804-17-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3948-219-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4312-173-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4336-81-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4424-341-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4508-275-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4512-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4516-129-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4576-161-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4612-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4660-375-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4672-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4752-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4768-327-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4848-407-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4892-401-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4912-241-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4920-335-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5036-333-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5052-136-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5104-359-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7140-1883-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7236-1866-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7308-1857-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7360-1880-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7420-1879-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7436-1864-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7484-1878-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7492-1852-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7540-1877-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7572-1863-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7584-1856-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7604-1876-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7720-1862-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7752-1855-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7768-1851-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7892-1846-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7936-1860-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7988-1888-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/7996-1870-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/8036-1887-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/8056-1869-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/8112-1885-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/8152-1884-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/8280-1843-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/8328-1842-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/8536-1837-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/8664-1834-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/8704-1833-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads