93aa9a57de50d9614a87e2d390212b76f71337c85c011af98ed731d37f05ab8f

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

93aa9a57de50d9614a87e2d390212b76f71337c85c011af98ed731d37f05ab8f.exe
Size

120KB
MD5

0c809dc670fa2178dc030ab119f6e956
SHA1

6e248a449d6b3fd41e08a84259dfb923a8d6ad0d
SHA256

93aa9a57de50d9614a87e2d390212b76f71337c85c011af98ed731d37f05ab8f
SHA512

b63119974737d7b89f0a0522a05ecd3e656059036389f383e482be3ec253a6c0316ae63e6aa915f31c158eba36f990f86d5877b1228b44c36c91dfbb7b6ce25d
SSDEEP

3072:ojjT03uM57HH2EsJ62VlL4eyVRr2i/mjRrz3C:EI3p57HH8jd4e42i/GC

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ednaqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqppkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeaikh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qgcbgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agglboim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aldomc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odkjng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehgqln32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnlhfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjokdipf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bajjli32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbabgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iefioj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Onjegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfolbmje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jifhaenk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mchhggno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oneklm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnicfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Angddopp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hfqlnm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eefhjc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkmchi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ghopckpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmbfpp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmannhhj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqpnombl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cddecc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bkidenlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlkagbej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edihepnm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpppnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miemjaci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibcmom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ekcpbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dmefhako.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chbnia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgbdlf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hbpgbo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iihkpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhbgqohi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmcojh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iicbehnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmdqgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lboeaifi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dddojq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnicfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkoiefmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kplpjn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ahhblemi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbhfjljd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdhdajea.exe

UPX dump on OEP (original entry point) 34 IoCs

resource	yara_rule
behavioral2/files/0x000300000001e97a-6.dat	UPX
behavioral2/files/0x0008000000023421-14.dat	UPX
behavioral2/files/0x0007000000023426-23.dat	UPX
behavioral2/files/0x0007000000023428-30.dat	UPX
behavioral2/files/0x000700000002342a-38.dat	UPX
behavioral2/files/0x000700000002342c-46.dat	UPX
behavioral2/files/0x000700000002342e-54.dat	UPX
behavioral2/files/0x0007000000023431-62.dat	UPX
behavioral2/files/0x0007000000023433-70.dat	UPX
behavioral2/files/0x0007000000023435-78.dat	UPX
behavioral2/files/0x0007000000023437-86.dat	UPX
behavioral2/files/0x0007000000023439-95.dat	UPX
behavioral2/files/0x000700000002343b-103.dat	UPX
behavioral2/files/0x000700000002343d-110.dat	UPX
behavioral2/files/0x000700000002343f-119.dat	UPX
behavioral2/files/0x0007000000023441-127.dat	UPX
behavioral2/files/0x0007000000023443-134.dat	UPX
behavioral2/files/0x0007000000023446-150.dat	UPX
behavioral2/files/0x0007000000023448-158.dat	UPX
behavioral2/files/0x000700000002344a-167.dat	UPX
behavioral2/files/0x000700000002344c-175.dat	UPX
behavioral2/files/0x000700000002344e-182.dat	UPX
behavioral2/files/0x0007000000023452-198.dat	UPX
behavioral2/files/0x0007000000023454-206.dat	UPX
behavioral2/files/0x0007000000023450-191.dat	UPX
behavioral2/files/0x0008000000023422-143.dat	UPX
behavioral2/files/0x0007000000023456-215.dat	UPX
behavioral2/files/0x000700000002345c-239.dat	UPX
behavioral2/files/0x0007000000023460-254.dat	UPX
behavioral2/files/0x000700000002345e-247.dat	UPX
behavioral2/files/0x000700000002345a-230.dat	UPX
behavioral2/files/0x0007000000023458-223.dat	UPX
behavioral2/files/0x00070000000234b4-497.dat	UPX
behavioral2/files/0x00070000000235ac-1275.dat	UPX

Executes dropped EXE 64 IoCs

pid	Process
444	Pclneicb.exe
764	Pjffbc32.exe
464	Pqpnombl.exe
428	Pjhbgb32.exe
644	Pengdk32.exe
4936	Pjkombfj.exe
2548	Peqcjkfp.exe
3832	Pjmlbbdg.exe
548	Pagdol32.exe
2244	Qgallfcq.exe
3428	Qjpiha32.exe
1220	Qbgqio32.exe
964	Qchmagie.exe
4568	Qbimoo32.exe
1560	Acjjfggb.exe
1792	Ajdbcano.exe
5044	Abkjdnoa.exe
3036	Ahhblemi.exe
5008	Aldomc32.exe
4248	Anbkio32.exe
4120	Aaqgek32.exe
2292	Acocaf32.exe
1504	Andgoobc.exe
2388	Aacckjaf.exe
2416	Aeopki32.exe
1092	Ajkhdp32.exe
1576	Angddopp.exe
2160	Aealah32.exe
1796	Ahoimd32.exe
4560	Ajneip32.exe
4384	Abemjmgg.exe
1036	Bdfibe32.exe
1336	Bjpaooda.exe
1684	Bnlnon32.exe
4748	Bajjli32.exe
2108	Blpnib32.exe
3128	Bbifelba.exe
3332	Behbag32.exe
5048	Blbknaib.exe
2848	Baocghgi.exe
1072	Bdmpcdfm.exe
940	Bldgdago.exe
3956	Bobcpmfc.exe
2504	Baaplhef.exe
3836	Bhkhibmc.exe
640	Bkidenlg.exe
3900	Cacmah32.exe
3976	Cdainc32.exe
1832	Cklaknjd.exe
4780	Cafigg32.exe
4340	Cddecc32.exe
3616	Clkndpag.exe
4236	Cbefaj32.exe
436	Cecbmf32.exe
4300	Chbnia32.exe
3936	Colffknh.exe
260	Cefoce32.exe
5064	Chdkoa32.exe
4500	Ckcgkldl.exe
232	Cbjoljdo.exe
2068	Chghdqbf.exe
3252	Ckedalaj.exe
3272	Dhidjpqc.exe
4516	Docmgjhp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Dhkapp32.exe	Demecd32.exe
File created	C:\Windows\SysWOW64\Mjegoo32.dll	Hbpgbo32.exe
File created	C:\Windows\SysWOW64\Hmhhehlb.exe	Heapdjlp.exe
File created	C:\Windows\SysWOW64\Ncfmpnfb.dll	Bnlnon32.exe
File created	C:\Windows\SysWOW64\Ligqhc32.exe	Lekehdgp.exe
File opened for modification	C:\Windows\SysWOW64\Nilcjp32.exe	Ngmgne32.exe
File created	C:\Windows\SysWOW64\Eckgieoo.dll	Dkoggkjo.exe
File opened for modification	C:\Windows\SysWOW64\Hbpgbo32.exe	Hobkfd32.exe
File created	C:\Windows\SysWOW64\Fllifblf.dll	Jfaedkdp.exe
File created	C:\Windows\SysWOW64\Jfeopj32.exe	Jbjcolha.exe
File created	C:\Windows\SysWOW64\Lmdina32.exe	Lenamdem.exe
File created	C:\Windows\SysWOW64\Eghpcp32.dll	Mcmabg32.exe
File created	C:\Windows\SysWOW64\Qgcbgo32.exe	Qddfkd32.exe
File created	C:\Windows\SysWOW64\Dmcibama.exe	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Angddopp.exe	Ajkhdp32.exe
File opened for modification	C:\Windows\SysWOW64\Bajjli32.exe	Bnlnon32.exe
File created	C:\Windows\SysWOW64\Gdjjckag.exe	Gomakdcp.exe
File opened for modification	C:\Windows\SysWOW64\Kmijbcpl.exe	Kebbafoj.exe
File opened for modification	C:\Windows\SysWOW64\Oddmdf32.exe	Onjegled.exe
File opened for modification	C:\Windows\SysWOW64\Beeoaapl.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Iqjpdi32.dll	Pengdk32.exe
File created	C:\Windows\SysWOW64\Edkdkplj.exe	Eamhodmf.exe
File opened for modification	C:\Windows\SysWOW64\Fbpnkama.exe	Foabofnn.exe
File created	C:\Windows\SysWOW64\Nniadn32.dll	Mbfkbhpa.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Eefhjc32.exe	Echknh32.exe
File created	C:\Windows\SysWOW64\Phiifkjp.dll	Bmkjkd32.exe
File opened for modification	C:\Windows\SysWOW64\Dhkjej32.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Fjegoh32.dll	Npmagine.exe
File created	C:\Windows\SysWOW64\Ckqfbfnl.dll	Bldgdago.exe
File created	C:\Windows\SysWOW64\Ojdamdma.dll	Cafigg32.exe
File created	C:\Windows\SysWOW64\Hfifmnij.exe	Hckjacjg.exe
File opened for modification	C:\Windows\SysWOW64\Jlkagbej.exe	Jmhale32.exe
File created	C:\Windows\SysWOW64\Nilcjp32.exe	Ngmgne32.exe
File created	C:\Windows\SysWOW64\Qjkmdp32.dll	Ndaggimg.exe
File created	C:\Windows\SysWOW64\Qddfkd32.exe	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Bldgdago.exe	Bdmpcdfm.exe
File created	C:\Windows\SysWOW64\Jbpbca32.dll	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Afmhck32.exe
File created	C:\Windows\SysWOW64\Kjhcgd32.dll	Gdeqhl32.exe
File created	C:\Windows\SysWOW64\Pkfhoiaf.dll	Ojgbfocc.exe
File created	C:\Windows\SysWOW64\Ohjdgn32.dll	Ocpgod32.exe
File opened for modification	C:\Windows\SysWOW64\Eamhodmf.exe	Eoolbinc.exe
File created	C:\Windows\SysWOW64\Ekacmjgl.exe	Dhbgqohi.exe
File opened for modification	C:\Windows\SysWOW64\Hmhhehlb.exe	Heapdjlp.exe
File created	C:\Windows\SysWOW64\Kepelfam.exe	Kfmepi32.exe
File created	C:\Windows\SysWOW64\Bmhnkg32.dll	Bmpcfdmg.exe
File opened for modification	C:\Windows\SysWOW64\Bgehcmmm.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Aldomc32.exe	Ahhblemi.exe
File opened for modification	C:\Windows\SysWOW64\Opdghh32.exe	Oneklm32.exe
File created	C:\Windows\SysWOW64\Bebblb32.exe	Bmkjkd32.exe
File created	C:\Windows\SysWOW64\Kmfjodai.dll	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Pjffbc32.exe	Pclneicb.exe
File created	C:\Windows\SysWOW64\Cleqadmh.dll	Aacckjaf.exe
File created	C:\Windows\SysWOW64\Debdld32.dll	Opakbi32.exe
File created	C:\Windows\SysWOW64\Pgnilpah.exe	Pmidog32.exe
File opened for modification	C:\Windows\SysWOW64\Peqcjkfp.exe	Pjkombfj.exe
File opened for modification	C:\Windows\SysWOW64\Kplpjn32.exe	Kmncnb32.exe
File created	C:\Windows\SysWOW64\Oponmilc.exe	Nnqbanmo.exe
File opened for modification	C:\Windows\SysWOW64\Ipbdmaah.exe	Imdgqfbd.exe
File opened for modification	C:\Windows\SysWOW64\Hcdmga32.exe	Hkmefd32.exe
File created	C:\Windows\SysWOW64\Jpppnp32.exe	Jifhaenk.exe
File opened for modification	C:\Windows\SysWOW64\Miemjaci.exe	Mckemg32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10652	10460	WerFault.exe	501

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kboeke32.dll"	Acjclpcf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akmfnc32.dll"	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akichh32.dll"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfkgaokd.dll"	Fllpbldb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fkopnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gkoiefmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ofcmfodb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bdfibe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ckedalaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fdegandp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfdhbpg.dll"	Bjfaeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhbffb32.dll"	Bnbmefbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ffddka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ghlcnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gijloo32.dll"	Klgqcqkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dmcibama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Immapg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oendmdab.dll"	Jpppnp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qceiaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gmlhii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lbabgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bcoenmao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcfmgfde.dll"	Dlijfneg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eoaihhlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqlbaq32.dll"	Gododflk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffhoqj32.dll"	Kebbafoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lffhfh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Npcoakfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ogifjcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bobiobnp.dll"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pqpnombl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ippggbck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjjplc32.dll"	Kboljk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ladjgikj.dll"	Ojjolnaq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pmannhhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcjfkm32.dll"	Eabbjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiknll32.dll"	Fdegandp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jcioiood.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pqpnombl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olgkhn32.dll"	Edkdkplj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghkebndc.dll"	Hbbdholl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jholncde.dll"	Mckemg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fhjfhl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ipnjab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lpqiemge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eemnjbaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fkopnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdnidn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbjiol32.dll"	Mmnldp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mnebeogl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qjpiha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Panjjlqo.dll"	Qbgqio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Abkjdnoa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bagcnd32.dll"	Mgagbf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ofcmfodb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnlnon32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 444	5060	93aa9a57de50d9614a87e2d390212b76f71337c85c011af98ed731d37f05ab8f.exe	85
PID 5060 wrote to memory of 444	5060	93aa9a57de50d9614a87e2d390212b76f71337c85c011af98ed731d37f05ab8f.exe	85
PID 5060 wrote to memory of 444	5060	93aa9a57de50d9614a87e2d390212b76f71337c85c011af98ed731d37f05ab8f.exe	85
PID 444 wrote to memory of 764	444	Pclneicb.exe	86
PID 444 wrote to memory of 764	444	Pclneicb.exe	86
PID 444 wrote to memory of 764	444	Pclneicb.exe	86
PID 764 wrote to memory of 464	764	Pjffbc32.exe	87
PID 764 wrote to memory of 464	764	Pjffbc32.exe	87
PID 764 wrote to memory of 464	764	Pjffbc32.exe	87
PID 464 wrote to memory of 428	464	Pqpnombl.exe	88
PID 464 wrote to memory of 428	464	Pqpnombl.exe	88
PID 464 wrote to memory of 428	464	Pqpnombl.exe	88
PID 428 wrote to memory of 644	428	Pjhbgb32.exe	89
PID 428 wrote to memory of 644	428	Pjhbgb32.exe	89
PID 428 wrote to memory of 644	428	Pjhbgb32.exe	89
PID 644 wrote to memory of 4936	644	Pengdk32.exe	90
PID 644 wrote to memory of 4936	644	Pengdk32.exe	90
PID 644 wrote to memory of 4936	644	Pengdk32.exe	90
PID 4936 wrote to memory of 2548	4936	Pjkombfj.exe	91
PID 4936 wrote to memory of 2548	4936	Pjkombfj.exe	91
PID 4936 wrote to memory of 2548	4936	Pjkombfj.exe	91
PID 2548 wrote to memory of 3832	2548	Peqcjkfp.exe	92
PID 2548 wrote to memory of 3832	2548	Peqcjkfp.exe	92
PID 2548 wrote to memory of 3832	2548	Peqcjkfp.exe	92
PID 3832 wrote to memory of 548	3832	Pjmlbbdg.exe	93
PID 3832 wrote to memory of 548	3832	Pjmlbbdg.exe	93
PID 3832 wrote to memory of 548	3832	Pjmlbbdg.exe	93
PID 548 wrote to memory of 2244	548	Pagdol32.exe	94
PID 548 wrote to memory of 2244	548	Pagdol32.exe	94
PID 548 wrote to memory of 2244	548	Pagdol32.exe	94
PID 2244 wrote to memory of 3428	2244	Qgallfcq.exe	95
PID 2244 wrote to memory of 3428	2244	Qgallfcq.exe	95
PID 2244 wrote to memory of 3428	2244	Qgallfcq.exe	95
PID 3428 wrote to memory of 1220	3428	Qjpiha32.exe	96
PID 3428 wrote to memory of 1220	3428	Qjpiha32.exe	96
PID 3428 wrote to memory of 1220	3428	Qjpiha32.exe	96
PID 1220 wrote to memory of 964	1220	Qbgqio32.exe	97
PID 1220 wrote to memory of 964	1220	Qbgqio32.exe	97
PID 1220 wrote to memory of 964	1220	Qbgqio32.exe	97
PID 964 wrote to memory of 4568	964	Qchmagie.exe	98
PID 964 wrote to memory of 4568	964	Qchmagie.exe	98
PID 964 wrote to memory of 4568	964	Qchmagie.exe	98
PID 4568 wrote to memory of 1560	4568	Qbimoo32.exe	99
PID 4568 wrote to memory of 1560	4568	Qbimoo32.exe	99
PID 4568 wrote to memory of 1560	4568	Qbimoo32.exe	99
PID 1560 wrote to memory of 1792	1560	Acjjfggb.exe	100
PID 1560 wrote to memory of 1792	1560	Acjjfggb.exe	100
PID 1560 wrote to memory of 1792	1560	Acjjfggb.exe	100
PID 1792 wrote to memory of 5044	1792	Ajdbcano.exe	102
PID 1792 wrote to memory of 5044	1792	Ajdbcano.exe	102
PID 1792 wrote to memory of 5044	1792	Ajdbcano.exe	102
PID 5044 wrote to memory of 3036	5044	Abkjdnoa.exe	103
PID 5044 wrote to memory of 3036	5044	Abkjdnoa.exe	103
PID 5044 wrote to memory of 3036	5044	Abkjdnoa.exe	103
PID 3036 wrote to memory of 5008	3036	Ahhblemi.exe	104
PID 3036 wrote to memory of 5008	3036	Ahhblemi.exe	104
PID 3036 wrote to memory of 5008	3036	Ahhblemi.exe	104
PID 5008 wrote to memory of 4248	5008	Aldomc32.exe	105
PID 5008 wrote to memory of 4248	5008	Aldomc32.exe	105
PID 5008 wrote to memory of 4248	5008	Aldomc32.exe	105
PID 4248 wrote to memory of 4120	4248	Anbkio32.exe	106
PID 4248 wrote to memory of 4120	4248	Anbkio32.exe	106
PID 4248 wrote to memory of 4120	4248	Anbkio32.exe	106
PID 4120 wrote to memory of 2292	4120	Aaqgek32.exe	107

C:\Users\Admin\AppData\Local\Temp\93aa9a57de50d9614a87e2d390212b76f71337c85c011af98ed731d37f05ab8f.exe
"C:\Users\Admin\AppData\Local\Temp\93aa9a57de50d9614a87e2d390212b76f71337c85c011af98ed731d37f05ab8f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\SysWOW64\Pclneicb.exe
  C:\Windows\system32\Pclneicb.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:444
- - C:\Windows\SysWOW64\Pjffbc32.exe
    C:\Windows\system32\Pjffbc32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Windows\SysWOW64\Pqpnombl.exe
      C:\Windows\system32\Pqpnombl.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:464
    - - C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:428
      - C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:644
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2548
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3428
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1220
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:964
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1560
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4248
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4120
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        23⤵
        Executes dropped EXE
        
        PID:2292
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        24⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2388
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        26⤵
        Executes dropped EXE
        
        PID:2416
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1092
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1576
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        29⤵
        Executes dropped EXE
        
        PID:2160
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        30⤵
        Executes dropped EXE
        
        PID:1796
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        31⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        32⤵
        Executes dropped EXE
        
        PID:4384
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1036
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        34⤵
        Executes dropped EXE
        
        PID:1336
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1684
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4748
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        37⤵
        Executes dropped EXE
        
        PID:2108
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        38⤵
        Executes dropped EXE
        
        PID:3128
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        39⤵
        Executes dropped EXE
        
        PID:3332
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        40⤵
        Executes dropped EXE
        
        PID:5048
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        41⤵
        Executes dropped EXE
        
        PID:2848
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1072
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:940
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        44⤵
        Executes dropped EXE
        
        PID:3956
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        45⤵
        Executes dropped EXE
        
        PID:2504
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        46⤵
        Executes dropped EXE
        
        PID:3836
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:640
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        48⤵
        Executes dropped EXE
        
        PID:3900
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        49⤵
        Executes dropped EXE
        
        PID:3976
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        50⤵
        Executes dropped EXE
        
        PID:1832
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4780
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4340
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        53⤵
        Executes dropped EXE
        
        PID:3616
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        54⤵
        Executes dropped EXE
        
        PID:4236
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        55⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4300
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        57⤵
        Executes dropped EXE
        
        PID:3936
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        58⤵
        Executes dropped EXE
        
        PID:260
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        59⤵
        Executes dropped EXE
        
        PID:5064
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        60⤵
        Executes dropped EXE
        
        PID:4500
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        61⤵
        Executes dropped EXE
        
        PID:232
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        62⤵
        Executes dropped EXE
        
        PID:2068
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3252
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        64⤵
        Executes dropped EXE
        
        PID:3272
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        65⤵
        Executes dropped EXE
        
        PID:4516
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        66⤵
        Drops file in System32 directory
        
        PID:1116
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        67⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        68⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        69⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        70⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        71⤵
        Modifies registry class
        
        PID:1224
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        72⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        73⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:544
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        75⤵
        Drops file in System32 directory
        
        PID:2432
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        76⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        77⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4812
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        79⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        80⤵
        Drops file in System32 directory
        
        PID:3612
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4392
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4224
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2112
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        84⤵
        Drops file in System32 directory
        
        PID:2832
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        85⤵
        Drops file in System32 directory
        
        PID:2060
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        86⤵
        Modifies registry class
        
        PID:2632
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5128
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        88⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        89⤵
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        90⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5304
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        92⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        93⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        94⤵
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        95⤵
        Modifies registry class
        
        PID:5472
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        96⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        97⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        98⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5652
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        100⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        101⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        102⤵
        Modifies registry class
        
        PID:5788
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        103⤵
        Modifies registry class
        
        PID:5828
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        104⤵
        Modifies registry class
        
        PID:5876
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        105⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        106⤵
        Modifies registry class
        
        PID:5964
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        107⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        108⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        109⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        110⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        111⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        112⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        113⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        114⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        115⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        116⤵
        Drops file in System32 directory
        
        PID:5488
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        117⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        118⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        119⤵
        Modifies registry class
        
        PID:5684
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        120⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        121⤵
        Modifies registry class
        
        PID:5836
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        122⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        123⤵
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        124⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        125⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5164
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        127⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        128⤵
        Drops file in System32 directory
        
        PID:5372
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        129⤵
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        131⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        132⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        133⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        134⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        135⤵
        Drops file in System32 directory
        
        PID:5156
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        136⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        137⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        138⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        139⤵
        Drops file in System32 directory
        
        PID:5856
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        140⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5244
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        142⤵
        Drops file in System32 directory
        
        PID:5680
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5900
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        144⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        145⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        146⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        147⤵
        Modifies registry class
        
        PID:6096
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        148⤵
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        149⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        150⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6268
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        152⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6356
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        154⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6432
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        156⤵
        Modifies registry class
        
        PID:6488
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        157⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        158⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6636
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        160⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        161⤵
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        162⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        163⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        164⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        165⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        166⤵
        Modifies registry class
        
        PID:6940
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        167⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7052
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        169⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        170⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        171⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        172⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        173⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6380
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6468
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        176⤵
        Drops file in System32 directory
        
        PID:6532
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6612
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        178⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        179⤵
        Drops file in System32 directory
        
        PID:6740
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        180⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        181⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        182⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7092
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        184⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        185⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        186⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        187⤵
        Drops file in System32 directory
        
        PID:6420
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        188⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        189⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        190⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        191⤵
        Modifies registry class
        
        PID:6980
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        192⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6288
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6480
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        195⤵
        Modifies registry class
        
        PID:6672
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        196⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7108
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        198⤵
        Modifies registry class
        
        PID:6352
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        199⤵
        Modifies registry class
        
        PID:6624
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        200⤵
        Drops file in System32 directory
        
        PID:6976
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        201⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        202⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        203⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        204⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        205⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7248
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        206⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        207⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        208⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        209⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        210⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        211⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        212⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        213⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        214⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        215⤵
        Drops file in System32 directory
        
        PID:7740
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7788
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        217⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        218⤵
        Modifies registry class
        
        PID:7896
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        219⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        220⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        221⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        222⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        223⤵
        Drops file in System32 directory
        
        PID:8124
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        224⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7176
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        226⤵
        Modifies registry class
        
        PID:7244
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7332
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        228⤵
        Drops file in System32 directory
        
        PID:7412
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        229⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        230⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7680
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        232⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        233⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        234⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        235⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        236⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        237⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        238⤵
        Drops file in System32 directory
        
        PID:7280
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        239⤵
        Modifies registry class
        
        PID:7388
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        240⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        241⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        242⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7968
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        244⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        245⤵
        Modifies registry class
        
        PID:6788
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        246⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7652
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        248⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7928
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8016
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        250⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        251⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        252⤵
        Drops file in System32 directory
        
        PID:8012
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        253⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7768
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        255⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        256⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        257⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        258⤵
        Modifies registry class
        
        PID:8272
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        259⤵
        Modifies registry class
        
        PID:8324
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        260⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        261⤵
        Drops file in System32 directory
        
        PID:8408
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        262⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        263⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        264⤵
        Drops file in System32 directory
        
        PID:8528
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        265⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        266⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        267⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        268⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        269⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        270⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8816
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        272⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        273⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        274⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        275⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        276⤵
        Drops file in System32 directory
        
        PID:9040
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        277⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        278⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        279⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        280⤵
        Drops file in System32 directory
        
        PID:9204
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        281⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8300
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        283⤵
        Modifies registry class
        
        PID:8360
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        284⤵
        Drops file in System32 directory
        
        PID:8448
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        285⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        286⤵
        Drops file in System32 directory
        
        PID:8600
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        287⤵
        Drops file in System32 directory
        
        PID:8668
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        288⤵
        Modifies registry class
        
        PID:8716
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8828
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        290⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        291⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        292⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        293⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        294⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7588
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8248
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        297⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        298⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        299⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        300⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        301⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        302⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        303⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        304⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8344
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        306⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        307⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        308⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        309⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        310⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        311⤵
        Modifies registry class
        
        PID:8880
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        312⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        313⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        314⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9180
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        316⤵
        Drops file in System32 directory
        
        PID:9260
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        317⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        318⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        319⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        320⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        321⤵
        Modifies registry class
        
        PID:9484
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        322⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        323⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9616
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9656
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9704
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        327⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        328⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        329⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        330⤵
        Modifies registry class
        
        PID:9876
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        331⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        332⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        333⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        334⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10084
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        336⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10172
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        338⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9224
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        340⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        341⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        342⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        343⤵
        Modifies registry class
        
        PID:9508
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        344⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        345⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        346⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        347⤵
        Modifies registry class
        
        PID:9804
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        348⤵
        Drops file in System32 directory
        
        PID:9884
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        349⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        350⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10032
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        352⤵
        Drops file in System32 directory
        
        PID:10100
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        353⤵
        Modifies registry class
        
        PID:10164
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10232
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        355⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        356⤵
        Drops file in System32 directory
        
        PID:9376
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        357⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9464
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        358⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        359⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        360⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        361⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        362⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        363⤵
        Modifies registry class
        
        PID:10068
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        364⤵
        Modifies registry class
        
        PID:10208
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        365⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        366⤵
        Modifies registry class
        
        PID:9412
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        367⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        368⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        369⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        370⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        371⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        372⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        373⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9860
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9240
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        376⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10152
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        378⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        379⤵
        Drops file in System32 directory
        
        PID:9504
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        380⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        381⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        382⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        383⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        384⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        385⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        386⤵
        Modifies registry class
        
        PID:10500
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        387⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10584
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        389⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10628
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        390⤵
        Modifies registry class
        
        PID:10668
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10704
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        392⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        393⤵
        Modifies registry class
        
        PID:10788
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        394⤵
        Modifies registry class
        
        PID:10832
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10872
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        396⤵
        Drops file in System32 directory
        
        PID:10920
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        397⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        398⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        399⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11080
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        401⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11164
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        403⤵
        Modifies registry class
        
        PID:11200
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        404⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        405⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10324
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        407⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        408⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10460 -s 412
        409⤵
        Program crash
        
        PID:10652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 10460 -ip 10460
1⤵
PID:10488

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:9804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aacckjaf.exe

Filesize
120KB

MD5
e202b868e707c9eb181340a6bdbbbad6

SHA1
26babfec68701770643f6a07454910a722f18cb3

SHA256
466c96de9231655967cbf62ef351fe43d34bd9f4b851177d255bc1478f08a7f2

SHA512
54ba9d5f69bff2f60a4e17ad8d9150888f472025ded751611fe2bb6a81b51756a89af6b831b1db98c375195ea52a15e1058042679addf6c184bebbe8be755122

Download Submit
C:\Windows\SysWOW64\Aaqgek32.exe

Filesize
120KB

MD5
0477fb98fd340b8c878a21734b255df9

SHA1
edf0e69390a302b7fa84763542a50f0e56622bd2

SHA256
6bf2ddad93a9cf7436bff9ab8461f2564c5f3c8dd215958a3a4c6fa1eb8793b1

SHA512
144ce39997f75114570c39465b6182fe60fd4734185e068f33e43285da152b7761b2c20b51dece6d1c9422a6d38ca6f7f931b86f9f6e1564947c01f2fce3b174

Download Submit
C:\Windows\SysWOW64\Abemjmgg.exe

Filesize
120KB

MD5
cba8c483e4b5bc07e5de9048aaefeaab

SHA1
87cbfcf05ea4e36a1725db115ea428e5d0f4531a

SHA256
33642d55394974d355be0d3d2efacabc8fddef6a6cfe8b7d8388ded16eca3851

SHA512
536482a011d269a2f0a30913115a97dd8a4852af595cacb0830b7af0b0a378ea5c70f26d71f41adc71eddf25ced1cfe04131783ea81b09c3eb7083b03742d4f0

Download Submit
C:\Windows\SysWOW64\Abkjdnoa.exe

Filesize
120KB

MD5
ed4092cd3fad2456036a8debdb15391f

SHA1
452646e5e48451c58ef4a21db66dc1eeb591876e

SHA256
5979f9fab359ba57ce52027fb41be32e1397cdd9ef48d9d60bf4d52a5506f2fb

SHA512
2e5d67c8f7be8d0c027dd090f0b3f42017f83413284a8bd96119cc2c4f064640469c4f44bd02e3a16b8caeee1e4256c9057d24049a1b9ebcb00df6db013fd554

Download Submit
C:\Windows\SysWOW64\Acjjfggb.exe

Filesize
120KB

MD5
12b28f4e39dd5b2f6ff6f52f97d98202

SHA1
6263ad511b95582f2283cc5c17f88e75fb739fa6

SHA256
dbed0c11c5cff960fdd0861fcead44fd430c5f4f5e34056b013bf54da1e2015e

SHA512
d09325b6bc3ce5113864417da0335165d68629b859205a2807b15917827af5ff323ae4020c225f80c1e96890da6b43ea4bbf078f1a45e0103b6f27a6dea5d352

Download Submit
C:\Windows\SysWOW64\Acocaf32.exe

Filesize
120KB

MD5
eba5277448f140f68c4c38dc03b7d1a6

SHA1
d2bacd934ee4c7621a9915ebdad3666f59ddaba7

SHA256
f10601e240831b9452176ad149336637bac39c81e3812caecf60dc0c56f241f0

SHA512
89deb22d66ba8fc9f339f65e6648c111e0dd2e77303f1ed8865c2f15a102eeb8683b83299a132f539d359803beca13f62beefedd5936d6e2d39428fe51d35925

Download Submit
C:\Windows\SysWOW64\Aealah32.exe

Filesize
120KB

MD5
59751af24b2c44436e89f7da1ff539d6

SHA1
7b2b7bb555bbf3e8d7c5551f2cee0ea0f1e66a09

SHA256
916cdc7185d0bdd6158de0caec01878b25fde4d0ee4b557316736387030fb0a8

SHA512
d2b70a355ff290e1a937e41e30929e2257315069b772b14c0bc5a69a4bb170c2bd617edea6a5f1c7e919d1360769de48c9ec03be50ba942c61b562a4350bd983

Download Submit
C:\Windows\SysWOW64\Aeopki32.exe

Filesize
120KB

MD5
33c78bf98debd16b58f5a75f714a5b34

SHA1
ea4ce113faa6c26ed26c128bf7b4f1b2a2b69a75

SHA256
0adbe8053437ec5c24df67b29ec06575377d4f3afe33ea068e566454c853586d

SHA512
1dc97718348b1f779d5b3f90aaa5a282fba9f25d88071b743322d89b2d332a1a5a9f4e60bcda1025197ba50dc2b13d4f8e869d87aae7797c32a7e018e11e5cb9

Download Submit
C:\Windows\SysWOW64\Ahhblemi.exe

Filesize
120KB

MD5
3822ebcb6fb5b93ab3a7b5ec82f0d107

SHA1
6b12ffcb34a20498db22615f20ddb6e1a0d92780

SHA256
1edb5461b304255575497619ff7ee9adf17ab566b21a2454ec9f4cc847e47e83

SHA512
36b8a3469f0236b6a612b5bc78533634027b1dc8468d2f71333ae03a4447b0abcf16ae42d5d21179d07565993409abc9ad16f2eab99fd67c68413a714f18cf98

Download Submit
C:\Windows\SysWOW64\Ahoimd32.exe

Filesize
120KB

MD5
cbfa315ba37c4cf462b05ef83361a7f4

SHA1
7e6b3491a97744763e1a8b7e2a5148949ded255e

SHA256
ca495487d26b797f7de9bb0c4f263d47a712f508ea4a7cc6b7ca449978375a00

SHA512
35ddbbed30e335e7294d9a7f3504422b5ab9867d6f9f7c48eb249d4104d1c4a91c94b8db171a3f95437766e33dda041022c240161ac6804e7acf493e73ebb646

Download Submit
C:\Windows\SysWOW64\Ajdbcano.exe

Filesize
120KB

MD5
dff286c1ba1d0ef8309df8b3cc9b0f3d

SHA1
080f21201924b092a461f38c5bb4fbb80d251aa6

SHA256
645151cf90170f407c9e69d225bd8823b14d59aa46af91468013c6c0da4c6e6c

SHA512
8996acadcb3ff2beb8321fcc002996564725382455bd6ec805604619587737769b1365ab1486c0e65b0c106ed6fcd949fe75f8b0bea7b95e737a91e9206bbfe7

Download Submit
C:\Windows\SysWOW64\Ajkhdp32.exe

Filesize
120KB

MD5
25997b6b2ac3f4a77ea344d7eec62290

SHA1
7142c93215244cd0172dea83062dc83c91d9270d

SHA256
dafab35bae34cefe2da4176bdc566454be56890acb8ebbfe9c7d62a1acf8824d

SHA512
cc540255382726cb533c385b8a1aa3b2c84e3e125264ea086aec784fac7397ef43ff7efdac24c5c7258496b58ee0337f0d55e8c26f07b86a564545d77512f14c

Download Submit
C:\Windows\SysWOW64\Ajneip32.exe

Filesize
120KB

MD5
568086a5bdf840c74a9d30584b556cd8

SHA1
71cfd592297f278affb5b784e35ef84aa2dfad79

SHA256
a62ad0750411a9aa0c33d8b87129985603d39de75cae9131b0d608af84edcff9

SHA512
92bf0ff80f6b4ad51bd4b8b9dd7ac21210980f42df1066f5f3471479ab4545381763cb070716ccab8b9e4d9fcb1416967ada3e3e05f516267532209de6f5c0bf

Download Submit
C:\Windows\SysWOW64\Aldomc32.exe

Filesize
120KB

MD5
9280f27f588f56f4ffd16fb334cb4166

SHA1
5ac5b9d7d25db4d1a5a2f0d6b29c81d2f85294dd

SHA256
1710f94b0d5d4f532dd713401337bf7c970895fd3cc759c290aff0673614ef3f

SHA512
42f2216f7c97806bd5a3e451699bb4f632d5683408dd94ceafa17f6afd7d0613de241457b0ae6c2286c05244ea82c985714446db99be5880402e631e6944846e

Download Submit
C:\Windows\SysWOW64\Anbkio32.exe

Filesize
120KB

MD5
0577c5dae145e9312cdc2d6e1783cbee

SHA1
b99b49a6f7e50331d8747fa39e016aa9eb6d7ff7

SHA256
d8cc096e7a8fbf334e17d2d475852d5f3bc38327706c6028874da03b62e2ccef

SHA512
ebfff37c8f099267607d7643a023851f4696e77a7d0dd28814815cde5c07a7b07ebfa7950619bd94d072d005c07c233fb602ee311b59943cae37f5d51dc497c1

Download Submit
C:\Windows\SysWOW64\Andgoobc.exe

Filesize
120KB

MD5
f4a8ad89251322025ee69bfe098ca53b

SHA1
3b629965735e230811922a9e2735b8a34b689541

SHA256
45faba16be336b53a45ed2754058e6060ac42d7f5f4900ff8e45f6f0c24d1cea

SHA512
997f1028018d6e2a3390f42e1d999f92d5ead389ad25ddeb557bb51c5c3aa2b4a47f5e9f60926e8c4f34124fd687e23e26e3c96a46c1f1f220918eecc7f995e1

Download Submit
C:\Windows\SysWOW64\Angddopp.exe

Filesize
120KB

MD5
a9e06d80cc02add52b575969e73c6593

SHA1
f0cc7ca27f13aab1b2cc4cddcf1ce996db334fc2

SHA256
ad00979b709244db398025b0ea7f481ce7b4874a4cdfd472814c59789f0d9d2a

SHA512
74e8cbcd5a0a45c5affa80ced98f5b889823ffa21b56507df67be70f99f233a1689b6da1f8747ae232f0b7489e2f74bac4666c4ecab010f36958e485509b70c8

Download Submit
C:\Windows\SysWOW64\Bdfibe32.exe

Filesize
120KB

MD5
0d0a3c8996d7a92f934b74508e222ac3

SHA1
0dec74bd14b262c8eceaf40b323e2386f85d1095

SHA256
cf3cad85e58e4c6d54f40bd3f367977f2ac605d4dae9797acc510dacb6211b8a

SHA512
41e16460665fce33f05437392599b2b54994b8389b1b3cfe28b8dea65bd00df1bf42e51fa42ee6eb9d9ba232d50196ccb4715eb0c5782d2929045e6b023a1740

Download Submit
C:\Windows\SysWOW64\Cpnfbohh.dll

Filesize
7KB

MD5
3d7d125c56bfaf561cc172237767602c

SHA1
e4c54f4013aa6437a5da643e0bc7dfacc94968b0

SHA256
9d90f551133cad1f4fd651e506344a79aa1d02af224931862cc93eedb4fd1490

SHA512
f96ad41ba403e0d7f4fd750fdea48203a1fe1bce76985a68187c854baf34f83b91018de204bee1c81159c1bd53e6672c28004878faf0155ab8ee533b448c4180

Download Submit
C:\Windows\SysWOW64\Dddojq32.exe

Filesize
120KB

MD5
80476450ca94744cdfc1792eccd15ba2

SHA1
c25cf11a0213dcd7a653c0bb6ff56440a42fd181

SHA256
a90060f7d86cb5f82b229613c304480d74ae69e5199ee5a6a2b2caaf01918c9c

SHA512
1fc26dfac5e8c9e70356500c0d55ec2bd3a4a49f71c8657587dc6a4b4dbc1c371f87a1379653365cf1b3565d8ee37e9e1287e2f6a1dd96f54cb649b87de072bf

Download Submit
C:\Windows\SysWOW64\Jifhaenk.exe

Filesize
120KB

MD5
136c5b2d19995bd836b9892ef7164cd8

SHA1
2a482dc90b1065dbfd995f1d22393536c1719a21

SHA256
ee150b96a7eb06bfa5c8bb304ca7d4ee243c26e438b3f1a9639e6011d557752c

SHA512
bb0d25832fd3dc1ee479d5a8adb49d5df11ebdaec2389068031160b44c0b348e8b572fb726e19d590b72659329c06ee63e3fc5c9d12c0b2327b28e5fa0cb3d38

Download Submit
C:\Windows\SysWOW64\Pagdol32.exe

Filesize
120KB

MD5
bfa7f43504cabc1bf5440de0056f5cd3

SHA1
082664f03d6dcd1affc7bf88ebb87d0eebda1f6e

SHA256
f985fb2b128418f83f120663e0bbf70b2395df3df49c6248d4296c30c3fd42a5

SHA512
d554477e115acda2ce2317a131f81384379c315fea0c4ca7e013920de48f9a9c95709000713f2878c1da85013a606710c54fb2f0601f1c138cf35a0db31e1c9c

Download Submit
C:\Windows\SysWOW64\Pclneicb.exe

Filesize
120KB

MD5
0b93891c7c0e8b87841e26c49b5b276f

SHA1
b5f85c7b2cc031eec487a384f0976dc7cdde7e3d

SHA256
7d437340af5d09eb3293d539158ae86e6c7db5a4a35185cbe0f91deded2464f2

SHA512
b39473ce17bdb487df9528c3a5904bbf8606109f048b1047f5e2bb2dac3f1f9a40b380504dda901c7220826729fc4d853e94d12ed15c6fe24f775405db4f4262

Download Submit
C:\Windows\SysWOW64\Pengdk32.exe

Filesize
120KB

MD5
4f09fe865c8eb9800894cf9ae45dda93

SHA1
1a9b7c6269a9aec14c21339501299ff2e8dc5edb

SHA256
42f346344f36b5c30f320ec84ce896568123148eb3d18066d62a4b5e9157e35c

SHA512
74387dfd175ffe7afbb949f051decea826d9a19d649c0a64dd48e44e52397e0651bf042c36335ae6ac4effd99f39745af65bc11728858f1d4546d70c19768675

Download Submit
C:\Windows\SysWOW64\Peqcjkfp.exe

Filesize
120KB

MD5
876610e4de10360918a82ffc3da97f68

SHA1
f822420f15b19f8fd9d64d8d8fc492d5254873d0

SHA256
eab7d3157f6a49e2f0a288d905b750d2e3ad2695359bf4677ec546d540b69ac9

SHA512
d1a10c37519e250ca82ac3e55b8608c80383b119ed58f3f93c794512031f198afd0f583c84de5a8b2fc66dfe7f4639a3ea46bc9fdcf0b1fbdc016661b4269209

Download Submit
C:\Windows\SysWOW64\Pjffbc32.exe

Filesize
120KB

MD5
541ffb6ad3947eaea6ce06cf0f18de72

SHA1
fb4d14e07b90f9eab1047d75f98c9e7cfe4604d9

SHA256
6d82cbeab7b7d91c3aed0496e65cf5d8005ce75214a9fdb2902d11567c20b38d

SHA512
2781a7ef61d05fafa02d64f0b59c06d5f2ecd57cd9d2671c9203a933031026c4769bf7b76fcdb75a2e77983c2efbb25b817180da2dd7902f875dc00f788230b9

Download Submit
C:\Windows\SysWOW64\Pjhbgb32.exe

Filesize
120KB

MD5
d2046db4594b302f4ab61925447f0494

SHA1
a319e240144932fb2bd89b7b9c3d89d456b7db0c

SHA256
0fae706ab3fe7a7aba64280b7429b03342e70629940ddbde55e9428dec197f59

SHA512
770ff0beb98e4362a37f683520dd2adcbc58e725b0e89984dfcb7b1f6609de23ee4d531a3eb61d7f186e4c4f736542e3ece1aa108f06296154938af2a0a3c0b4

Download Submit
C:\Windows\SysWOW64\Pjkombfj.exe

Filesize
120KB

MD5
864195e3e25bb8f5616f8ac93aa77f37

SHA1
6ef340bf598dee54989f94041aab4f1d63c64932

SHA256
eab5217152bbd9836b6765a3ecb198c07190486e26b2580587077e401491308b

SHA512
32b87037a018d6388f7cbf744a62dcb33f56688a4b5daf302ec5b10f7ffa7303c6821e60e5a0f8112e0f8674ad7317395f8cfc56045b32767094966f304652c8

Download Submit
C:\Windows\SysWOW64\Pjmlbbdg.exe

Filesize
120KB

MD5
8737af6e324a6fcc7e0fa7c8bc937169

SHA1
177bdbec0dd7cfbd77d56d2c94ac626cf96ee8a5

SHA256
445c8c2c3f65fd68682fe318b44ec155d4f7b62f1725cb7b810de67aa01f2a01

SHA512
be5f4c04f90b8dbe40f2a5d00cd7d27d6a7b984339064dfb7bc3a22d6ffe5efaa21f21a27e27fd09db7947bfc6af91e21914a99873652af9bacbfe781d1ec3c4

Download Submit
C:\Windows\SysWOW64\Pqpnombl.exe

Filesize
120KB

MD5
5159e2ec80538af16c42ef7df7837a68

SHA1
60430cf20d02eacfdc0a2eb5c2a63103491ee209

SHA256
bb3b4f96a9f57acb7915855a0bc055cf541777b0089de158c4664ce313072340

SHA512
862e00b2c9b4e8549e066486e632e86b32453214922b08a984fd34a575d93cc5bfccf91f2bd98296b09012be91aa3af6db52b9d95f7ffb7ed709443150504b33

Download Submit
C:\Windows\SysWOW64\Qbgqio32.exe

Filesize
120KB

MD5
6857ee89049d6db70725e6c837d45760

SHA1
e42baba30b86fa9f39c3027b962e3b500154c76f

SHA256
6355a2945baf5014e7198c6be96c8368c6696d2c5f24fa74a4dbdf8d8ddfa6a1

SHA512
29d5d789ab3720fd1c114d7e08060d8dedd8fe54dee04f2028536b29c4126d1c17fd9ea72b292576a8e43e508ef97fd95877d822bda1110877af544eedcf1974

Download Submit
C:\Windows\SysWOW64\Qbimoo32.exe

Filesize
120KB

MD5
6b0b026f5c5fd6ac053d4193ec6a57ab

SHA1
f57132278ae20e74255231639601bbb787fd3710

SHA256
be887a13d29fb04c94d9ab8e3436c7f256b80e3457f6cad7016482da41e30d10

SHA512
dd58cc1c01410d5cc8bf9d26bfa47805acea39eef29f291d8d30b8233308d95608d0a13bc69184850d9070596ee79834bfa957cb627b5ee2a4663c950d2015de

Download Submit
C:\Windows\SysWOW64\Qchmagie.exe

Filesize
120KB

MD5
3027c06d242159edde8a05a5a1fdd219

SHA1
1c032e3e019d277a4862473390735369d9b8b57a

SHA256
568f0c8338f6a14e8ee15eef91f875e29f873527eb8744e3732993ffa528f5be

SHA512
daebca58501fce72e3de4f02ff5d0e5a02fe28654b4578c442c8943f3b21a0beff7a0dc9e64a8ff1447ec259c7d938d47ccfb90916b0708457931c37406089dc

Download Submit
C:\Windows\SysWOW64\Qgallfcq.exe

Filesize
120KB

MD5
e38898b424ad273daaec9169b6f9854e

SHA1
4900996aa391c20a4669d878afb12867d70386c9

SHA256
597e5a474791cef6b8d6a0baa94ab7abf08e49f4dae94a3b5fa8d00a4ff682c7

SHA512
6bedfe99f0e4c40a94ce7b414957e2d0a7aa8df3b3a060f6db577afc3baf3a6815a55b876ca184837176542a8014473a0d86798cf22c30c4d6f876ee347421cb

Download Submit
C:\Windows\SysWOW64\Qjpiha32.exe

Filesize
120KB

MD5
d70b5ba0f24df7a0a1dba7639b0fb6d0

SHA1
541e64eef73a3af50073f6916f178c7106c3358b

SHA256
606274371adf6cbf9264545ea6c9ae3f8db520201ab8c4c5ce9a182add68322d

SHA512
e940ca4f84116d3c2f3c666263f605907e3a52f2c58dc74f884a83ef1f0f49082bf90fa24c05d04356a6957c48012a7e8434f52b4ed98a023a9bb0dc3e276ff4

Download Submit
memory/232-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/260-411-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/428-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/436-392-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/444-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/464-27-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/548-76-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/640-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/644-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/764-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/940-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/964-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1036-265-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1072-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1092-212-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1220-101-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1336-267-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1504-183-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1560-120-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1576-216-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1684-272-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1792-132-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1796-236-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1832-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2068-435-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2108-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2160-228-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2244-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2292-189-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2388-197-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2416-200-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2504-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2548-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2848-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3036-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3128-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3252-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3272-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3332-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3428-88-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3616-380-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3832-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3836-338-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3900-350-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3936-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3956-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3976-356-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4120-173-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4236-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4248-164-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4300-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4340-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4384-248-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4500-423-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4560-240-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4568-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4748-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4780-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4936-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5008-153-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5044-136-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5048-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5060-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5064-417-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/10152-2715-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/10248-2712-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/10324-2686-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/10460-2684-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/10500-2706-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/10584-2704-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/10704-2701-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/10752-2700-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/10964-2695-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/11000-2694-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/11040-2693-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/11120-2691-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/11164-2690-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads