d0ed568868a64ef8562eb22f9a19f912dac55c8fb117066017a448468f9e8d2c

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0ed568868a64ef8562eb22f9a19f912dac55c8fb117066017a448468f9e8d2c.exe
Size

78KB
MD5

279ce8395d637a07ee15b9f6a34cb244
SHA1

846bfa7dedf22fa92dac7302184570612fb706ab
SHA256

d0ed568868a64ef8562eb22f9a19f912dac55c8fb117066017a448468f9e8d2c
SHA512

0db240561000d4ba9b0277ea8e9c60da87d30f8dec2978eb07e05053f587e19b8e49e1f7057740cec2f26588b382f6e00182eafa71658c9f4e7059d6e73f0d07
SSDEEP

1536:rhuj/vBvAe9qhc3l8a1AwfiX6yf5oAnqDM+4yyF:CRvAe9qhc3Oa1A2iXCuq4cyF

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgkjhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnneknob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbiaapdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncdgcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffkjlp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajanck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghopckpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kikame32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipbdmaah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbhfjljd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llgjjnlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Echknh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbbdholl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipdqba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odocigqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcgffqei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flqimk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmhale32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdcbom32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iehfdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mibpda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgddhf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opdghh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Meiaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmknaell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mbfkbhpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cndikf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fakdpb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkmchi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kipkhdeq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lljfpnjg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajanck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehedfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klgqcqkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofcmfodb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjoankoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipnjab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Flqimk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbeidl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jianff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbceejpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iefioj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opdghh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afjlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhocqigp.exe

Executes dropped EXE 64 IoCs

pid	Process
2496	Dlijfneg.exe
3040	Dkljak32.exe
4716	Dccbbhld.exe
540	Dafbne32.exe
3776	Dllfkn32.exe
2592	Dojcgi32.exe
3892	Dahode32.exe
4540	Ddgkpp32.exe
1900	Ekacmjgl.exe
3260	Echknh32.exe
840	Eefhjc32.exe
1796	Ehedfo32.exe
2432	Eeidoc32.exe
4244	Ehgqln32.exe
1140	Ekemhj32.exe
4652	Ecmeig32.exe
4912	Eekaebcm.exe
2340	Eleiam32.exe
3144	Ekhjmiad.exe
3992	Ecoangbg.exe
4752	Eemnjbaj.exe
2680	Ehljfnpn.exe
4488	Eofbch32.exe
1664	Eadopc32.exe
3524	Edbklofb.exe
4836	Fkmchi32.exe
2976	Fcckif32.exe
2400	Fdegandp.exe
4076	Fllpbldb.exe
2492	Fomhdg32.exe
5088	Fakdpb32.exe
1788	Flqimk32.exe
4764	Fooeif32.exe
3468	Fbnafb32.exe
1352	Fhgjblfq.exe
976	Fkffog32.exe
1080	Fcmnpe32.exe
1208	Ffkjlp32.exe
4860	Glebhjlg.exe
2788	Gcojed32.exe
4552	Gfngap32.exe
4588	Ghlcnk32.exe
4344	Gkkojgao.exe
3000	Gcagkdba.exe
3108	Gbdgfa32.exe
3916	Ghopckpi.exe
1924	Gkmlofol.exe
4388	Gbgdlq32.exe
2416	Gmlhii32.exe
3556	Gbiaapdf.exe
3244	Gdhmnlcj.exe
4680	Gblngpbd.exe
4332	Hiefcj32.exe
2800	Helfik32.exe
3656	Hmcojh32.exe
3952	Hcmgfbhd.exe
1020	Hcpclbfa.exe
3420	Hbbdholl.exe
2220	Hofdacke.exe
4908	Hbeqmoji.exe
452	Hcdmga32.exe
2236	Hbgmcnhf.exe
4328	Iefioj32.exe
748	Ibjjhn32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Mgkjhe32.exe	Mpablkhc.exe
File created	C:\Windows\SysWOW64\Eifbkgjd.dll	Jfoiokfb.exe
File created	C:\Windows\SysWOW64\Jfaklh32.dll	Kemhff32.exe
File opened for modification	C:\Windows\SysWOW64\Daconoae.exe	Dmgbnq32.exe
File opened for modification	C:\Windows\SysWOW64\Olcbmj32.exe	Ndhmhh32.exe
File created	C:\Windows\SysWOW64\Lfjhbihm.dll	Chmndlge.exe
File opened for modification	C:\Windows\SysWOW64\Baicac32.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Nodfmh32.dll	Mckemg32.exe
File created	C:\Windows\SysWOW64\Gbdhjm32.dll	Ncfdie32.exe
File created	C:\Windows\SysWOW64\Ddonekbl.exe	Daqbip32.exe
File created	C:\Windows\SysWOW64\Qcgffqei.exe	Qqijje32.exe
File opened for modification	C:\Windows\SysWOW64\Cmqmma32.exe	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Pnlaml32.exe	Ofeilobp.exe
File opened for modification	C:\Windows\SysWOW64\Cenahpha.exe	Cmgjgcgo.exe
File opened for modification	C:\Windows\SysWOW64\Npjebj32.exe	Njqmepik.exe
File created	C:\Windows\SysWOW64\Fqjamcpe.dll	Cjinkg32.exe
File opened for modification	C:\Windows\SysWOW64\Ghopckpi.exe	Gbdgfa32.exe
File created	C:\Windows\SysWOW64\Bncfnnbj.dll	Ifjodl32.exe
File opened for modification	C:\Windows\SysWOW64\Ofcmfodb.exe	Ocdqjceo.exe
File opened for modification	C:\Windows\SysWOW64\Liimncmf.exe	Lboeaifi.exe
File opened for modification	C:\Windows\SysWOW64\Mbfkbhpa.exe	Lphoelqn.exe
File created	C:\Windows\SysWOW64\Ogibpb32.dll	Likjcbkc.exe
File created	C:\Windows\SysWOW64\Ihjahg32.dll	Ghopckpi.exe
File opened for modification	C:\Windows\SysWOW64\Lmbmibhb.exe	Lfhdlh32.exe
File opened for modification	C:\Windows\SysWOW64\Gcojed32.exe	Glebhjlg.exe
File created	C:\Windows\SysWOW64\Ofcmfodb.exe	Ocdqjceo.exe
File created	C:\Windows\SysWOW64\Ekphijkm.dll	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Edbklofb.exe	Eadopc32.exe
File opened for modification	C:\Windows\SysWOW64\Jehokgge.exe	Jfeopj32.exe
File created	C:\Windows\SysWOW64\Bapiabak.exe	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Dccbbhld.exe	Dkljak32.exe
File created	C:\Windows\SysWOW64\Dcjfkm32.dll	Ecoangbg.exe
File opened for modification	C:\Windows\SysWOW64\Nngokoej.exe	Ngmgne32.exe
File created	C:\Windows\SysWOW64\Jilkmnni.dll	Ofcmfodb.exe
File created	C:\Windows\SysWOW64\Gdeahgnm.dll	Aqppkd32.exe
File opened for modification	C:\Windows\SysWOW64\Dojcgi32.exe	Dllfkn32.exe
File opened for modification	C:\Windows\SysWOW64\Ibqpimpl.exe	Ipbdmaah.exe
File opened for modification	C:\Windows\SysWOW64\Olmeci32.exe	Ofcmfodb.exe
File opened for modification	C:\Windows\SysWOW64\Hcmgfbhd.exe	Hmcojh32.exe
File opened for modification	C:\Windows\SysWOW64\Liddbc32.exe	Kplpjn32.exe
File created	C:\Windows\SysWOW64\Fhpili32.dll	Eofbch32.exe
File created	C:\Windows\SysWOW64\Helfik32.exe	Hiefcj32.exe
File created	C:\Windows\SysWOW64\Hmcojh32.exe	Helfik32.exe
File opened for modification	C:\Windows\SysWOW64\Kfckahdj.exe	Kdeoemeg.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Cffdpghg.exe
File opened for modification	C:\Windows\SysWOW64\Dafbne32.exe	Dccbbhld.exe
File created	C:\Windows\SysWOW64\Gmlhii32.exe	Gbgdlq32.exe
File created	C:\Windows\SysWOW64\Nngndc32.dll	Gbiaapdf.exe
File opened for modification	C:\Windows\SysWOW64\Dfpgffpm.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Bkblkg32.dll	Ibqpimpl.exe
File created	C:\Windows\SysWOW64\Cojlbcgp.dll	Ldjhpl32.exe
File created	C:\Windows\SysWOW64\Cihmlb32.dll	Ndcdmikd.exe
File created	C:\Windows\SysWOW64\Dmgbnq32.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Fomhdg32.exe	Fllpbldb.exe
File opened for modification	C:\Windows\SysWOW64\Mmpijp32.exe	Meiaib32.exe
File created	C:\Windows\SysWOW64\Ddakjkqi.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Fiknll32.dll	Fdegandp.exe
File created	C:\Windows\SysWOW64\Mjddiqoc.dll	Jbhfjljd.exe
File created	C:\Windows\SysWOW64\Njqmepik.exe	Ncfdie32.exe
File opened for modification	C:\Windows\SysWOW64\Pdpmpdbd.exe	Pqdqof32.exe
File opened for modification	C:\Windows\SysWOW64\Dmgbnq32.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Jmhale32.exe	Jfoiokfb.exe
File created	C:\Windows\SysWOW64\Ebinhj32.dll	Mdehlk32.exe
File created	C:\Windows\SysWOW64\Pkmlea32.dll	Ajanck32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9100	9044	WerFault.exe	368

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eefhjc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghlcnk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbeidl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndhmhh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Echknh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Medgncoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nngokoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbagnedl.dll"	Pflplnlg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekacmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncnaabfm.dll"	Jcgbco32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndcdmikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcncpbmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eadopc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjpgii32.dll"	Ofeilobp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djkahqga.dll"	Kikame32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjcbbmif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Empbnb32.dll"	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhpili32.dll"	Eofbch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hiefcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kboljk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfaklh32.dll"	Kemhff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdegandp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjelcfha.dll"	Daqbip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dafbne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqhacgdh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqmjog32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igjnojdk.dll"	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngmgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlijfneg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfnhlp32.dll"	Jlpkba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phkjck32.dll"	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Migjoaaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlkagbej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olcbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ophfae32.dll"	Fooeif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hikhen32.dll"	Ghlcnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghopckpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kplcdidf.dll"	Eefhjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eofbch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgkjhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddjejl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jianff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npfkgjdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdkkfn32.dll"	Lgokmgjm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beihma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbjcolha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Namdcd32.dll"	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kplpjn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmbmibhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imhkcaln.dll"	Hiefcj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oncofm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eofbch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gcagkdba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iemppiab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flqimk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kipkhdeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfkedibe.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2496	2508	d0ed568868a64ef8562eb22f9a19f912dac55c8fb117066017a448468f9e8d2c.exe	87
PID 2508 wrote to memory of 2496	2508	d0ed568868a64ef8562eb22f9a19f912dac55c8fb117066017a448468f9e8d2c.exe	87
PID 2508 wrote to memory of 2496	2508	d0ed568868a64ef8562eb22f9a19f912dac55c8fb117066017a448468f9e8d2c.exe	87
PID 2496 wrote to memory of 3040	2496	Dlijfneg.exe	88
PID 2496 wrote to memory of 3040	2496	Dlijfneg.exe	88
PID 2496 wrote to memory of 3040	2496	Dlijfneg.exe	88
PID 3040 wrote to memory of 4716	3040	Dkljak32.exe	89
PID 3040 wrote to memory of 4716	3040	Dkljak32.exe	89
PID 3040 wrote to memory of 4716	3040	Dkljak32.exe	89
PID 4716 wrote to memory of 540	4716	Dccbbhld.exe	90
PID 4716 wrote to memory of 540	4716	Dccbbhld.exe	90
PID 4716 wrote to memory of 540	4716	Dccbbhld.exe	90
PID 540 wrote to memory of 3776	540	Dafbne32.exe	91
PID 540 wrote to memory of 3776	540	Dafbne32.exe	91
PID 540 wrote to memory of 3776	540	Dafbne32.exe	91
PID 3776 wrote to memory of 2592	3776	Dllfkn32.exe	92
PID 3776 wrote to memory of 2592	3776	Dllfkn32.exe	92
PID 3776 wrote to memory of 2592	3776	Dllfkn32.exe	92
PID 2592 wrote to memory of 3892	2592	Dojcgi32.exe	93
PID 2592 wrote to memory of 3892	2592	Dojcgi32.exe	93
PID 2592 wrote to memory of 3892	2592	Dojcgi32.exe	93
PID 3892 wrote to memory of 4540	3892	Dahode32.exe	94
PID 3892 wrote to memory of 4540	3892	Dahode32.exe	94
PID 3892 wrote to memory of 4540	3892	Dahode32.exe	94
PID 4540 wrote to memory of 1900	4540	Ddgkpp32.exe	95
PID 4540 wrote to memory of 1900	4540	Ddgkpp32.exe	95
PID 4540 wrote to memory of 1900	4540	Ddgkpp32.exe	95
PID 1900 wrote to memory of 3260	1900	Ekacmjgl.exe	96
PID 1900 wrote to memory of 3260	1900	Ekacmjgl.exe	96
PID 1900 wrote to memory of 3260	1900	Ekacmjgl.exe	96
PID 3260 wrote to memory of 840	3260	Echknh32.exe	97
PID 3260 wrote to memory of 840	3260	Echknh32.exe	97
PID 3260 wrote to memory of 840	3260	Echknh32.exe	97
PID 840 wrote to memory of 1796	840	Eefhjc32.exe	98
PID 840 wrote to memory of 1796	840	Eefhjc32.exe	98
PID 840 wrote to memory of 1796	840	Eefhjc32.exe	98
PID 1796 wrote to memory of 2432	1796	Ehedfo32.exe	99
PID 1796 wrote to memory of 2432	1796	Ehedfo32.exe	99
PID 1796 wrote to memory of 2432	1796	Ehedfo32.exe	99
PID 2432 wrote to memory of 4244	2432	Eeidoc32.exe	100
PID 2432 wrote to memory of 4244	2432	Eeidoc32.exe	100
PID 2432 wrote to memory of 4244	2432	Eeidoc32.exe	100
PID 4244 wrote to memory of 1140	4244	Ehgqln32.exe	101
PID 4244 wrote to memory of 1140	4244	Ehgqln32.exe	101
PID 4244 wrote to memory of 1140	4244	Ehgqln32.exe	101
PID 1140 wrote to memory of 4652	1140	Ekemhj32.exe	102
PID 1140 wrote to memory of 4652	1140	Ekemhj32.exe	102
PID 1140 wrote to memory of 4652	1140	Ekemhj32.exe	102
PID 4652 wrote to memory of 4912	4652	Ecmeig32.exe	103
PID 4652 wrote to memory of 4912	4652	Ecmeig32.exe	103
PID 4652 wrote to memory of 4912	4652	Ecmeig32.exe	103
PID 4912 wrote to memory of 2340	4912	Eekaebcm.exe	104
PID 4912 wrote to memory of 2340	4912	Eekaebcm.exe	104
PID 4912 wrote to memory of 2340	4912	Eekaebcm.exe	104
PID 2340 wrote to memory of 3144	2340	Eleiam32.exe	105
PID 2340 wrote to memory of 3144	2340	Eleiam32.exe	105
PID 2340 wrote to memory of 3144	2340	Eleiam32.exe	105
PID 3144 wrote to memory of 3992	3144	Ekhjmiad.exe	106
PID 3144 wrote to memory of 3992	3144	Ekhjmiad.exe	106
PID 3144 wrote to memory of 3992	3144	Ekhjmiad.exe	106
PID 3992 wrote to memory of 4752	3992	Ecoangbg.exe	107
PID 3992 wrote to memory of 4752	3992	Ecoangbg.exe	107
PID 3992 wrote to memory of 4752	3992	Ecoangbg.exe	107
PID 4752 wrote to memory of 2680	4752	Eemnjbaj.exe	108

C:\Users\Admin\AppData\Local\Temp\d0ed568868a64ef8562eb22f9a19f912dac55c8fb117066017a448468f9e8d2c.exe
"C:\Users\Admin\AppData\Local\Temp\d0ed568868a64ef8562eb22f9a19f912dac55c8fb117066017a448468f9e8d2c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\Dlijfneg.exe
  C:\Windows\system32\Dlijfneg.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\SysWOW64\Dkljak32.exe
    C:\Windows\system32\Dkljak32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Windows\SysWOW64\Dccbbhld.exe
      C:\Windows\system32\Dccbbhld.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:4716
    - - C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:540
      - C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3776
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3892
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3260
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:840
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1140
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2340
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3144
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3992
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        23⤵
        Executes dropped EXE
        
        PID:2680
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4488
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1664
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        26⤵
        Executes dropped EXE
        
        PID:3524
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4836
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        28⤵
        Executes dropped EXE
        
        PID:2976
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2400
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4076
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        31⤵
        Executes dropped EXE
        
        PID:2492
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5088
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1788
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4764
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        35⤵
        Executes dropped EXE
        
        PID:3468
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        36⤵
        Executes dropped EXE
        
        PID:1352
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        37⤵
        Executes dropped EXE
        
        PID:976
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        38⤵
        Executes dropped EXE
        
        PID:1080
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1208
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4860
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        41⤵
        Executes dropped EXE
        
        PID:2788
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        42⤵
        Executes dropped EXE
        
        PID:4552
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4588
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        44⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3000
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3108
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3916
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        48⤵
        Executes dropped EXE
        
        PID:1924
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4388
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        50⤵
        Executes dropped EXE
        
        PID:2416
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3556
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        52⤵
        Executes dropped EXE
        
        PID:3244
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        53⤵
        Executes dropped EXE
        
        PID:4680
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4332
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2800
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3656
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        57⤵
        Executes dropped EXE
        
        PID:3952
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        58⤵
        Executes dropped EXE
        
        PID:1020
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3420
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        60⤵
        Executes dropped EXE
        
        PID:2220
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        61⤵
        Executes dropped EXE
        
        PID:4908
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        62⤵
        Executes dropped EXE
        
        PID:452
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        63⤵
        Executes dropped EXE
        
        PID:2236
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4328
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        65⤵
        Executes dropped EXE
        
        PID:748
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4796
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2796
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        68⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        69⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        70⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        71⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        72⤵
        Drops file in System32 directory
        
        PID:1276
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        73⤵
        Modifies registry class
        
        PID:3100
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        74⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2152
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        76⤵
        Drops file in System32 directory
        
        PID:3836
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        77⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        78⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        79⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5208
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        81⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        82⤵
        Drops file in System32 directory
        
        PID:5288
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5332
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        84⤵
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        86⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5500
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5544
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5584
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        90⤵
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        91⤵
        Modifies registry class
        
        PID:5668
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        92⤵
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        93⤵
        Drops file in System32 directory
        
        PID:5760
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        94⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        95⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        96⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        97⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        98⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        99⤵
        Modifies registry class
        
        PID:6040
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        100⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6140
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        102⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        103⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5324
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        105⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5472
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        107⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        108⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5664
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        110⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        112⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        113⤵
        Drops file in System32 directory
        
        PID:5984
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        114⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        115⤵
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        116⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5140
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        117⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        118⤵
        Drops file in System32 directory
        
        PID:5476
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        119⤵
        Drops file in System32 directory
        
        PID:5580
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        120⤵
        Modifies registry class
        
        PID:5692
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        121⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        122⤵
        Drops file in System32 directory
        
        PID:5940
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        123⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5216
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        125⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        126⤵
        Drops file in System32 directory
        
        PID:5508
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5748
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        128⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        129⤵
        Modifies registry class
        
        PID:6120
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        130⤵
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        131⤵
        Drops file in System32 directory
        
        PID:5736
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6084
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        133⤵
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        134⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        135⤵
        Drops file in System32 directory
        
        PID:5616
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5448
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6148
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        138⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        139⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        140⤵
        Drops file in System32 directory
        
        PID:6280
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6324
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        142⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        143⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        144⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        145⤵
        Modifies registry class
        
        PID:6504
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        146⤵
        Drops file in System32 directory
        
        PID:6544
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6592
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        148⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        149⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        150⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6740
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        151⤵
        Modifies registry class
        
        PID:6788
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        152⤵
        Modifies registry class
        
        PID:6836
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6880
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        154⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        155⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        156⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        157⤵
        Drops file in System32 directory
        
        PID:7056
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        158⤵
        Drops file in System32 directory
        
        PID:7104
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        159⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        160⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        161⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        162⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6364
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        164⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        165⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6492
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        166⤵
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        167⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        168⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        169⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        170⤵
        Modifies registry class
        
        PID:6876
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        171⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        172⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        173⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        174⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6208
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6296
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        177⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        178⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        179⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        180⤵
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6872
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7004
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        183⤵
        Modifies registry class
        
        PID:7156
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6268
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        185⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6604
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        186⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        187⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        188⤵
        Modifies registry class
        
        PID:6584
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        189⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        190⤵
        Modifies registry class
        
        PID:6472
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        191⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7208
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        192⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        193⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7340
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        195⤵
        Modifies registry class
        
        PID:7384
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        196⤵
        Modifies registry class
        
        PID:7420
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7460
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        198⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7560
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        200⤵
        Drops file in System32 directory
        
        PID:7604
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        201⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        202⤵
        Modifies registry class
        
        PID:7688
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        203⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        204⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7820
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        206⤵
        Drops file in System32 directory
        
        PID:7860
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7904
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7940
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        209⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        210⤵
        Modifies registry class
        
        PID:8024
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        211⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8104
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        213⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        214⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7240
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        216⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        217⤵
        Drops file in System32 directory
        
        PID:7404
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        218⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        219⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        220⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        221⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        222⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        223⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        224⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        225⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8060
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        227⤵
        Drops file in System32 directory
        
        PID:8128
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        228⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        229⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        230⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        231⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7672
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        233⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        234⤵
        Modifies registry class
        
        PID:7924
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8056
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        236⤵
        Drops file in System32 directory
        
        PID:8132
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        237⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4964
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7508
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7632
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        241⤵
        Drops file in System32 directory
        
        PID:7776
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        242⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        243⤵
        Drops file in System32 directory
        
        PID:8092
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        244⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        245⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        246⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        247⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8168
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        249⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        250⤵
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        251⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        252⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        253⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        254⤵
        Drops file in System32 directory
        
        PID:8200
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8240
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        256⤵
        Modifies registry class
        
        PID:8280
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        257⤵
        Modifies registry class
        
        PID:8328
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8372
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        259⤵
        Modifies registry class
        
        PID:8404
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8444
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        261⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        262⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8532
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        263⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        264⤵
        Drops file in System32 directory
        
        PID:8624
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        265⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8676
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8724
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        267⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8764
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        268⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        269⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        270⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8944
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9000
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        273⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9044 -s 408
        274⤵
        Program crash
        
        PID:9100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 9044 -ip 9044
1⤵
PID:9072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Dafbne32.exe

Filesize
78KB

MD5
491526ab9c2785a3f6c579574d9024b2

SHA1
433c3d060669c5c83b09edb9a9e989b2c3207bc3

SHA256
62bded5fdd8d44f81c68a037c87ccdcd48a5eb943cda6e0882d34580cea78851

SHA512
a669a0460290edb05598f02d558bee4de9570f5a72d0719846aa0135b16abc36c2083913610d6456f2ce9de014513a0fa184b3bdefbcb8844f20b7fd047da00a

Download Submit
C:\Windows\SysWOW64\Dahode32.exe

Filesize
78KB

MD5
4910fdfa3172656ec5b3a99349b1b7a3

SHA1
5f12af960abeaa87d169b50740a7e3c812a2176e

SHA256
ec9f0437d1af0f7ac21f99b84bf069e643e93352f30289684f94385e2c916c4b

SHA512
29bbfbdedbe7cd03de709614f45dc7c1593ec63ba372c42abd29eaa07a7182d0ceffd449f52af0efd8b06af80d8e1776c887d48a8a78f276420393e7b59d3ce4

Download Submit
C:\Windows\SysWOW64\Dccbbhld.exe

Filesize
78KB

MD5
47a458e7b4fa192163c1f7db977a88bf

SHA1
33c9b1a52885d13d6904a8e9db501aede4a9aa40

SHA256
e270d3cede370a03cc53202b5a7db5ce3a9536bb9498bba69d9d901f18b84d9b

SHA512
42546fe32a36c7e3b81dd1b625d0c036e4f569b0d70b4024a9c6245f5568428789a825b7573fd6ae8b8e85cd66051a0dda7ae2244558dc68542d733ef9b44dd8

Download Submit
C:\Windows\SysWOW64\Ddgkpp32.exe

Filesize
78KB

MD5
5cab6140ba8258138b3b0181db41c293

SHA1
4b49f929738e1d461ffd61cd260325d11b4278db

SHA256
a04b1d80a15b63305e1014b1228697cb3726296bef04be8d3fac09abe9fa9137

SHA512
55dd210436f5f36cc88285e6996b0bd4420b64acd1c9651c34e7b405f5ed16dd8b4cf55df9a1d9d128386b70bf22914c29399933a9afd4faa2920be885a20871

Download Submit
C:\Windows\SysWOW64\Dkljak32.exe

Filesize
78KB

MD5
3703b117232b40c881dc8be995682471

SHA1
46482d4ada266ff0ba868f6589aeff48c1e1e94a

SHA256
733ae76184e6c63d8909dd5b4bf53404216b395d11903c6f23b46f650ae54816

SHA512
ec5cd7c1c273a6e595b46b7ae66d6da1950b74011049177397f6f906b677d0249934e2994edbce3440411ef57bb4e5ab6234a830fa448bce403406a0d8186e28

Download Submit
C:\Windows\SysWOW64\Dlijfneg.exe

Filesize
78KB

MD5
8f9a9e461862336adc81204daa0c0994

SHA1
7385b0a370d19b1ab5c645a9c9451d43717c302d

SHA256
f72ae96a34fda2bc61a2597ec0458f35c2bfcd459c5b51cad8e10d6d6d8e87ad

SHA512
435f3bf3b8047d013fbe8cbd334b28cfe55b0f3b3c48bda810647ea05c1af95024c1d42e00a96a532d688cb045f708c248e25dc1699e98e9ad2acfb47a3d6e59

Download Submit
C:\Windows\SysWOW64\Dllfkn32.exe

Filesize
78KB

MD5
653cbbfa51d3a270e78c208fb1e27bd0

SHA1
beb263b1e75387c393cfc9249e5f59cff908838e

SHA256
724430b314454018fe9a285b83939e82a15d61041fc18995849fa79425161685

SHA512
21906f4c94f00b123abf16f7d89a2759931fc8455b99131868f543d1eed46f734595b65a391967392d98f42cf0468f960beb6377b9453d966df394cbdcb5a115

Download Submit
C:\Windows\SysWOW64\Dojcgi32.exe

Filesize
78KB

MD5
904f1e5a79b43ac3886775a95d5c5a7a

SHA1
82521e8afcf02f559b3e9aa01a851abac0534a00

SHA256
25940129e84cecc3f9767df11c13f7e0f4719a3d6ee3799efccab1916987e4f5

SHA512
e1960750c81f5da9c68ebf1b36baf3a66291905c21d8a05372456ae26442a2df9ae77d1bc33712731a5a9c9c83f0e67d012a09e1bed4b3266c1ca3d25400ed29

Download Submit
C:\Windows\SysWOW64\Eadopc32.exe

Filesize
78KB

MD5
ee10fd0be9622b138a03d4935269534a

SHA1
bb6dfea9f0b0906086427c3a568142c994b81fda

SHA256
020f2c4de66bbd1d3ea1c59d1c7af5847fe429b2eb509ed4262a68061d01f62e

SHA512
cfa94bfe25630187b56bf7039e4a940bbb3eb28644c1c762aa3ab086b88701f618178066e0206103cc8246da3070af79db68000d0d8b71c0c8e53794dde281de

Download Submit
C:\Windows\SysWOW64\Echknh32.exe

Filesize
78KB

MD5
8edaa96df2b15d0f9903f0968ca186a3

SHA1
6b13cf8918518b9a3f4c4257f1f8f7ff8bad246b

SHA256
5ad9f5565693a32174f9d245e926e9da04e8fb84ec9b805fb7d13a1735f69c23

SHA512
0a1fd4899923c659a5ea9afb4339e8097447bd78dfc07d24bdacb8aebc9f8619b188b9bbd154354943bedda32cdf439bb3a2aeddf6bdf5f23e2fceff82d163df

Download Submit
C:\Windows\SysWOW64\Ecmeig32.exe

Filesize
78KB

MD5
6485a88d3f718eba4fbb6c9961d67127

SHA1
0f9647bec691d57ce822b557186034de05b59d1e

SHA256
7b0f0075ef2e713c02518e249b5172224b3f95b0a3d1d36918316defc334c6dd

SHA512
2aa1e217028bca5a271da1044fa6414ed096d84515d1d0828e60537d33c9fdcf7519c0ea3f75b38d71d9d3a9fdfbee72e7b0d495d02eadf918ef259835186a20

Download Submit
C:\Windows\SysWOW64\Ecoangbg.exe

Filesize
78KB

MD5
a2a83dd1dd9e63c7ea9f91584bb80e67

SHA1
d3abc00b7069b0b961cff26640542227c68b5fe4

SHA256
fb46d749734c180c6bb35a755fc4e0b3156698b2d6184abf3c1c38b9abae13e4

SHA512
7956f12e46737bca4341a3cee013f46be81c595fedf7e42352646ead8a5b36ade612fa84acc3f97d621ec1500e0cb443095c242aaafaad7af55bb0edba2bf20c

Download Submit
C:\Windows\SysWOW64\Edbklofb.exe

Filesize
78KB

MD5
5a1008ae848589bf64eb9def2d41c875

SHA1
6d3fcc50afe7b31ec89fc31f2aec7d2861cf0d69

SHA256
735eea3d7eff638e413079f7521c2b1acf1db38706c4dfee03b84d6ef6b54ec0

SHA512
8e1f3f3a59b48b706a8f01c7a149ed43e254f99f0624bef0ca4c217f2d22ce5c64b74cddea13f09780a22e8efcefa691d05616191598baf606c7ca4fb6246d57

Download Submit
C:\Windows\SysWOW64\Eefhjc32.exe

Filesize
78KB

MD5
20cdee8d8fca3427fb54ac71582cf3e0

SHA1
6d4f6a32802c0083e006826cb86096212c7e2374

SHA256
56149ed2453182cc3d22060580db9e741bb8025d7f6c87a661e50111feb630eb

SHA512
135bc415147167cf1ef1c7b1e64dc603d5cc2db479a471b9142c42f9039bc38fc68ccdef5ac68bbdebeca4a50125380b7d0c1a1cae6b3b81fc8c29275557930c

Download Submit
C:\Windows\SysWOW64\Eeidoc32.exe

Filesize
78KB

MD5
70f1a8cdd0d48c6cd746bcf10b9da391

SHA1
35aa063abccb0c5f3a370872a8a252f7f9106509

SHA256
d98a22766edcd37f67736850571c0400282b477f81677f3e50c537cfc3cd4efb

SHA512
6f2c25af5e4944f44bd4328e53cc89c9f1299aa89c8019968806a181f64c79c234eee290655f248194caba57410982c2e8eee9f96fbdfbfc1ff9384257783955

Download Submit
C:\Windows\SysWOW64\Eekaebcm.exe

Filesize
78KB

MD5
ac55b761f99953d51c09c4ac4bee450c

SHA1
3c60da493192f9bdb5e78396d4a6d34554d64c1f

SHA256
552c096cdf780911552a72bfcce4c455813f5c381ae319ffe4b1ecddf443ea03

SHA512
c295ba74eebfce8e619465a61072b30b250c0330eb66b1341dbd6c3577a105a1a7a5e99565aa5b29c04611d1d7cca946acda7080c4506b75bc7c6319423fa17c

Download Submit
C:\Windows\SysWOW64\Eemnjbaj.exe

Filesize
78KB

MD5
982b49fdbc2953edd7b7d07a4e89e3db

SHA1
b9003020654dd90e78dd239fc3570e1a3abc20ee

SHA256
5f6746e99b4f8a11414005ee9af06a00d691918466074ec5db38e35ce82a492d

SHA512
18c3a68e0943c6057579e91bc9f93b1762a2a7c10f8c926876f9aed30afdb74838de394b7aabff7b630a1a5f87a827d38bf5f308a80e5b5be1cd8709681d65fe

Download Submit
C:\Windows\SysWOW64\Ehedfo32.exe

Filesize
78KB

MD5
5cd9f36a1bff649298009f1201ac761b

SHA1
193e9dcac39d1932ff00a9d0c1976bc1bcb3fba9

SHA256
85e2c7177004454189f2893534eb01da9e62d51f2eac343283c29f2d974808f2

SHA512
1f1fb92e6ef452d6668d6a336772f1969669530c28abe982e01b7ab6f5f39942de08f4081f58118ed3a9dc8a80fdaadbd3a3535ffc78890398b7a7cfb6b88c23

Download Submit
C:\Windows\SysWOW64\Ehgqln32.exe

Filesize
78KB

MD5
39e07f1fa3918c50365d5314c5c55a45

SHA1
50f0d1eebc0a921166341e04486d6f0ac2deaf25

SHA256
dca2b7cdf2101acaa1b962599d11305f08d2c92b36fb034a2472f770c4c3880b

SHA512
6370de703bfa3cb25dc30adfcfba47e07fa74be6a3c1d96479cf03f6b5701f776fd61dbd9535abc92882653f22fc00b697e2847c589ddd63c50168ac74111773

Download Submit
C:\Windows\SysWOW64\Ehljfnpn.exe

Filesize
78KB

MD5
5d8e331221a571259560cdeb70c4ff22

SHA1
0aab46cf3c00778c7b206c681f006ed967215f78

SHA256
41dc2d02349ea37a81d4e3d391eebbf59bc3d1e26e417ef9518c7ed494e29c81

SHA512
f30adcd756b51dd2fc980ce77868cb6b9210b41b484815c97d8e52c6f41bc0c4c107e0ea97bec0473023d452a5f2606df6f50d6d34127dbedc86277071ca40ea

Download Submit
C:\Windows\SysWOW64\Ekacmjgl.exe

Filesize
78KB

MD5
5b73a871e005c863218ec81432f34a24

SHA1
371980b0d3635fba6010984767456edb87c7a1dd

SHA256
46753292bbfef13fc49ba41102a9551f9cc458a4e72c4ba254e32fe1fb1753a5

SHA512
27e5aa7c667dc8e83a4b87c69a9d902b11df0d4c6881d291b0fc58bfd1702e3e765501f2851cdc2b34350f90f136f5083349b15c98c4fee876b2af60f4254116

Download Submit
C:\Windows\SysWOW64\Ekemhj32.exe

Filesize
78KB

MD5
b7f632423f11c3573e28371ea4e04430

SHA1
a26798e509043559fdafe2c8df4120959ad9f36f

SHA256
0d8ed569d965655648070212a82786150da23556fce4e8590122ce4ed14fb673

SHA512
ee2a447f3178adf51e5474de338439b7efa0cf1d1dbd02df66326843722b1daf0c09b72e9e7adcb927a0d9ac89a62fc5fc0537747b3f62d6d7a096ace2afec57

Download Submit
C:\Windows\SysWOW64\Ekhjmiad.exe

Filesize
78KB

MD5
5d762e1b63456ff6fae2db6cd6358db1

SHA1
bfa60b9bed591e5c0a842f3b965c6df995189a55

SHA256
1a9dfc5b7e836a20fc17ad4e430753da682441cbc7245f52f55ffa7ef2b54085

SHA512
421a3f7ba876b5b30dd81f2bcd7cb81618f3c2809ba34e55351a4891c56c9ce33f87edc262e4cf6ea6dce128eecc2edead55ddaff1f73d4488f4d6a7f7400f0a

Download Submit
C:\Windows\SysWOW64\Eleiam32.exe

Filesize
78KB

MD5
8c89ba5bbd1de13a3a6693d6a131a56b

SHA1
4d307068250b6b7e34a5785a251d8a1733d1511e

SHA256
dc528f6276bf8ec6d83f81103a72624ba140dcf8329c2da490e315dc7a1d687b

SHA512
2eab457b61e8e1f25d49ed91846f4f3a5997654a5534589c54f72e3a41ee0cf0e25dd07c387d7cd9dbbcb01ad13e3f9f5c9f85d5576a78f2c67a24e0894d4079

Download Submit
C:\Windows\SysWOW64\Eofbch32.exe

Filesize
78KB

MD5
54d032d7d670842224dad582b014cd42

SHA1
cb64698bda6d7508796f38acda0be29e4736be08

SHA256
e236f004e75fa350df4f9224aad3e80b566944b889e86e8d87415d1cd1cf28fe

SHA512
f251a0029ee27f17ba78034496c30aec35b8fbf1d91f7067386c821dffa853ca9ceecbf5d85cf2563a2fa3f1b08b0ea89bee2af681dc650f5b0683cc46d190bb

Download Submit
C:\Windows\SysWOW64\Fakdpb32.exe

Filesize
78KB

MD5
bf3ea7cfbb376f6927f948831697081b

SHA1
741f0af6a514298338326646714a899665a5cc20

SHA256
5e0a80ae56c5aae881a4efe0302b41888df24d9963721d14360390f1aa676b54

SHA512
16bf08cf5b271d9e2f0e272d84569210bb8b9af5f156eedca3b713b87e7c71b3e14c403950faa0102ede9c7938b76113af25488211b6bfdfec6e368bf5a8a3c0

Download Submit
C:\Windows\SysWOW64\Fcckif32.exe

Filesize
78KB

MD5
be846ea758c6a451fe0480dbc3fd5c9d

SHA1
d5441e2dec746cbbe3617e082d77fab61a97f563

SHA256
27189a828de1a86e91a37260c8486653639ca3cb5bdaba3b9ba5b6a5d929076b

SHA512
ba658442f589589a23345c69dcefe65e0bfc5f81182e63713cd4749c8c1886c1ad479cabee44c3c3ad4f1e6f72f279fb63941bea12e131271b426b67264a2af0

Download Submit
C:\Windows\SysWOW64\Fdegandp.exe

Filesize
78KB

MD5
bd6539b585ffe7d21af29898d9a78cb5

SHA1
c4ed49b7b8fdb3018bbaadd2b907e728bcdc7c08

SHA256
1eb1674db8968dda1e5d7169e0673ead0a712c65a6c2e4bb27a0d84a4d1ac822

SHA512
183be34ccf6c17caa5a118414c0b1b0b5a3c314bed7c497fe43c6a1582188d96794e6ff7552d04328ac1d90062a9d8bb456245a664f121cc0471c18a00a958a6

Download Submit
C:\Windows\SysWOW64\Fkmchi32.exe

Filesize
78KB

MD5
57b50f427662ca834913907dbb64faed

SHA1
e2ae1e3c9023359e134a15f5fce41be32a632dd2

SHA256
241ad632ebbdf196da71fa70a05bfd0bc61fc9de66cc280584fa8a0d370f0090

SHA512
e4fa975e5db9a3b9892a1051e16a50f40257660f181de80da88397bce672f5c1c566bdd402fb7f5cff08415dc24858cf6e6cd1006d2e6331551cd7a48aba7bb5

Download Submit
C:\Windows\SysWOW64\Fllpbldb.exe

Filesize
78KB

MD5
ab6695a44269c06f71acacf46186859d

SHA1
34b084b166e56c5477c908ccd58e807123a19826

SHA256
9fdd51960e80e062b242c17fab932574e3dba2cb6e187eb37e37a555f9b64191

SHA512
b08685b8aedfd6ab0eef0505e8b2954ffd53add078e5ac242a7d41bd53cc61763186c1cfd75c18ed40de1149298eb8eb3c80f6a4828e96a0790d0bae8b990b1d

Download Submit
C:\Windows\SysWOW64\Flqimk32.exe

Filesize
78KB

MD5
a4d63dccdbad5dbe638b760f2b7106c9

SHA1
709982c65ecfc5011a076ae4fda8d35dbc7b882c

SHA256
3b9f142146ad402fd4abb52af55f5675c23050e61a65c3cb3a96ad0329644407

SHA512
9b16d2002d85f5363fee61a8f76a5da5fbbd5ceb2279af182b66023ca797a8ded7f644e917b5ab6ef36109aa3356c3b563a0f14833fc552bdbc1db720a70e5f8

Download Submit
C:\Windows\SysWOW64\Fomhdg32.exe

Filesize
78KB

MD5
a534b5318389cd5cc1ae4a19ba8c4074

SHA1
18bb38de5106b19264f9d8afcb2a970331404325

SHA256
ada1bd2fae68b3d9e00760904c9dba9fcecf7266aabd950cfb278c1c6202a731

SHA512
2b364c43fb9c605aec636f71788509252925550b2f8686cd89ddd8041576670cc22833bc2c786e412d2661b59d8b8dca41f80b134129be34989905cf75519dfc

Download Submit
C:\Windows\SysWOW64\Lmiciaaj.exe

Filesize
78KB

MD5
f0b9c132b09cd6f1914e37be3dee5e66

SHA1
1dca8d69ad7e01c03e2777cd7ad3de8417cd1049

SHA256
9086e85d7fff0b38fc310d07e4cec06d97a87dcef85b7a095ea2510e958ce454

SHA512
743cbb330aaedd25541426cc1b8efec69b34c40212349eaba22491835884541f38f39a91bfed3ad036a2d042fd3ea4c3e80860069e89e4d2c8b8e31072625d4f

Download Submit
C:\Windows\SysWOW64\Olcbmj32.exe

Filesize
78KB

MD5
1b0e95d6b38f94d8abcae47611ec171a

SHA1
514af0c8d23f3e09ac6d8af3a998a3fe8fa129a2

SHA256
77f30e157f2d5213640cb05c4e8825abe0ca2564c5ae382b47b570e5ede8a6a3

SHA512
6d64727554b38fafcf1aed0d341c282ebb9aea6e32b3c50786df2eab0344b92f28ba0b7bf4b04401e07053d0a9e755b5961204533d66911b4ebd5c8fb597a8f6

Download Submit
memory/452-431-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/540-37-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/840-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/976-285-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1020-407-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1080-287-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1140-121-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1208-293-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1352-275-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1664-193-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1788-257-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1796-97-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1900-73-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1924-351-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2220-424-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2236-441-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2340-145-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2400-230-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2416-359-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2432-105-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2492-241-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2496-9-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2508-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2508-6-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2592-49-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2680-181-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2788-305-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2800-389-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2976-224-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3000-329-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3040-21-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3108-339-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3144-153-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3244-371-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3260-81-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3420-413-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3468-269-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3524-200-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3556-365-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3656-395-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3776-41-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3892-61-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3916-342-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3952-401-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3992-161-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4076-232-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4244-113-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4332-383-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4344-326-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4388-353-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4488-185-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4540-64-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4552-315-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4588-317-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4652-129-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4680-377-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4716-29-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4752-168-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4764-263-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4836-209-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4860-303-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4908-425-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4912-137-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5088-249-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads