cff3b479c1bb2610f4d451565180361e5ebcbe4a7b17348684237a2d48d831bf

Analysis

max time kernel
149s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 04:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cff3b479c1bb2610f4d451565180361e5ebcbe4a7b17348684237a2d48d831bf.exe
Size

92KB
MD5

079ef782fb1b8db0df85600ecb38eb00
SHA1

ca573a1348ccc55e23b85809e6fdbf775206c53a
SHA256

cff3b479c1bb2610f4d451565180361e5ebcbe4a7b17348684237a2d48d831bf
SHA512

0bcfe8a174631c2831a4e156d0dc27e6ec3e295845abf43056823e2019d9f7b5e2958d9831d55583e345813ba337a383ba466729ecc6363f81dde33fa69f2d12
SSDEEP

1536:Vxm6SjL7rowIjmYeWUxSpWROZYQ9+5FTzBA3jLV3BGnMPJKEsztuJO:cjLvoFYSp7S5FJkjLlBRh1sN

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnqfgbjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oklnbkdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpnlod32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bicgfb32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lemcoccc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Meamib32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omhnifeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Poqpanem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbonbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpnaoeqo.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Difehkgp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alljdngf.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqegce32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqcigqhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kaqgmpjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfgblepb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmmeoajm.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhbbjaoj.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bplhkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mafaidgd.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cioimfil.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjcdhjia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbdimenj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Plhdhkkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmmeoajm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adiddf32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anhikj32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhddohe.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfpnkkkj.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kndggdhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opfjebdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcegfajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kejfho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmakidic.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eakmbllp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdapok32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogekmkhb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdfbnelf.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbdimenj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqnoianm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikaeqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbppffcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocfnelbc.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mbcqmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofnell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnphgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkkefmgj.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfllgima.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipbejckk.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phpkjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjgofjgg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqnoianm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Doadopei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdocikij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acmlemmq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjcomijp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qldmie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnnkbg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdedoi32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngkdekad.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcnpkn32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Paolmidq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iafngkog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhqiinol.exe

Executes dropped EXE 64 IoCs

pid	Process
1748	Lgfnjdaj.exe
2012	Loabofne.exe
1304	Mfkgjchn.exe
1336	Mmglmm32.exe
2000	Mbddedlo.exe
1772	Mmihbmke.exe
320	Nccqog32.exe
1704	Nloeci32.exe
1152	Nfdjqbpc.exe
1592	Nlabiink.exe
340	Nankaplb.exe
1488	Nhhcnj32.exe
544	Nbmgkcce.exe
1508	Nlfldh32.exe
1108	Penlla32.exe
2024	Plhdhkkn.exe
2044	Pkmaih32.exe
1104	Pdefbm32.exe
1828	Aiehmo32.exe
988	Akddij32.exe
1016	Abnlfdcf.exe
868	Ajiajf32.exe
1340	Aqcigqhn.exe
1268	Bkimdihd.exe
1324	Bmjjla32.exe
1720	Bgonij32.exe
1116	Bniffd32.exe
1952	Bpkbnmkc.exe
1484	Bfdkjg32.exe
1860	Bicgfb32.exe
1620	Chfpim32.exe
1584	Dellniki.exe
1504	Eigdnkfn.exe
1656	Epcipd32.exe
2032	Fhedef32.exe
1752	Fpcfohnc.exe
1480	Fljfdi32.exe
1552	Gdanef32.exe
1804	Gmicnl32.exe
1176	Gedhbn32.exe
908	Gomlkcof.exe
796	Gakhgonj.exe
1184	Geianmdp.exe
1664	Goaefc32.exe
960	Gdonoj32.exe
860	Hpeock32.exe
388	Hkmpfc32.exe
1068	Hnllbolc.exe
592	Hdedoi32.exe
600	Hlqick32.exe
1912	Ifkjbp32.exe
436	Ikhbjg32.exe
932	Idqgcmja.exe
1692	Ikmlefok.exe
1724	Ijbifc32.exe
1360	Ikaeqf32.exe
680	Jejjikaf.exe
912	Jghfegqj.exe
1304	Jqajnlgj.exe
1772	Jmgkcm32.exe
704	Jfpplcco.exe
1780	Jcdpeg32.exe
1696	Jpkakhhm.exe
1104	Kicecn32.exe

Loads dropped DLL 64 IoCs

pid	Process
1728	cff3b479c1bb2610f4d451565180361e5ebcbe4a7b17348684237a2d48d831bf.exe
1728	cff3b479c1bb2610f4d451565180361e5ebcbe4a7b17348684237a2d48d831bf.exe
1748	Lgfnjdaj.exe
1748	Lgfnjdaj.exe
2012	Loabofne.exe
2012	Loabofne.exe
1304	Mfkgjchn.exe
1304	Mfkgjchn.exe
1336	Mmglmm32.exe
1336	Mmglmm32.exe
2000	Mbddedlo.exe
2000	Mbddedlo.exe
1772	Mmihbmke.exe
1772	Mmihbmke.exe
320	Nccqog32.exe
320	Nccqog32.exe
1704	Nloeci32.exe
1704	Nloeci32.exe
1152	Nfdjqbpc.exe
1152	Nfdjqbpc.exe
1592	Nlabiink.exe
1592	Nlabiink.exe
340	Nankaplb.exe
340	Nankaplb.exe
1488	Nhhcnj32.exe
1488	Nhhcnj32.exe
544	Nbmgkcce.exe
544	Nbmgkcce.exe
1508	Nlfldh32.exe
1508	Nlfldh32.exe
1108	Penlla32.exe
1108	Penlla32.exe
2024	Plhdhkkn.exe
2024	Plhdhkkn.exe
2044	Pkmaih32.exe
2044	Pkmaih32.exe
1104	Pdefbm32.exe
1104	Pdefbm32.exe
1828	Aiehmo32.exe
1828	Aiehmo32.exe
988	Akddij32.exe
988	Akddij32.exe
956	Aihdbn32.exe
956	Aihdbn32.exe
868	Ajiajf32.exe
868	Ajiajf32.exe
1340	Aqcigqhn.exe
1340	Aqcigqhn.exe
1268	Bkimdihd.exe
1268	Bkimdihd.exe
1324	Bmjjla32.exe
1324	Bmjjla32.exe
1720	Bgonij32.exe
1720	Bgonij32.exe
1116	Bniffd32.exe
1116	Bniffd32.exe
1952	Bpkbnmkc.exe
1952	Bpkbnmkc.exe
1484	Bfdkjg32.exe
1484	Bfdkjg32.exe
1860	Bicgfb32.exe
1860	Bicgfb32.exe
1620	Chfpim32.exe
1620	Chfpim32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Kanjhpli.exe	Kicecn32.exe
File opened for modification	C:\Windows\SysWOW64\Kndggdhp.exe	Kdocikij.exe
File created	C:\Windows\SysWOW64\Ngndkhlf.exe	Mofmjjld.exe
File created	C:\Windows\SysWOW64\Licfdbpa.exe	Lgbjlj32.exe
File created	C:\Windows\SysWOW64\Lkihqm32.exe	Liklda32.exe
File created	C:\Windows\SysWOW64\Gcjojgod.dll	Qpmlddqn.exe
File created	C:\Windows\SysWOW64\Dfpkbd32.dll	Mofmjjld.exe
File created	C:\Windows\SysWOW64\Oekcgabh.dll	Mafaidgd.exe
File created	C:\Windows\SysWOW64\Gafogh32.dll	Aogbqpap.exe
File opened for modification	C:\Windows\SysWOW64\Bilphc32.exe	Fnidhl32.exe
File created	C:\Windows\SysWOW64\Gblpfgpa.dll	Nbackh32.exe
File created	C:\Windows\SysWOW64\Gmacjogi.dll	Apcljnce.exe
File created	C:\Windows\SysWOW64\Bkmilp32.dll	Akncea32.exe
File created	C:\Windows\SysWOW64\Boidkm32.exe	Bgamjo32.exe
File created	C:\Windows\SysWOW64\Fdfbnelf.exe	Fecbbh32.exe
File created	C:\Windows\SysWOW64\Nhhcnj32.exe	Nankaplb.exe
File created	C:\Windows\SysWOW64\Mnqfgbjk.exe	Mhdnol32.exe
File opened for modification	C:\Windows\SysWOW64\Mjqbgi32.exe	Mknblleg.exe
File created	C:\Windows\SysWOW64\Fgagcd32.dll	Boidkm32.exe
File created	C:\Windows\SysWOW64\Dnnkbg32.exe	Dkpoflbj.exe
File opened for modification	C:\Windows\SysWOW64\Goaefc32.exe	Geianmdp.exe
File created	C:\Windows\SysWOW64\Difehkgp.exe	Dfhilphl.exe
File created	C:\Windows\SysWOW64\Aakalo32.dll	Cfplajjh.exe
File created	C:\Windows\SysWOW64\Aijmco32.dll	Dekmli32.exe
File opened for modification	C:\Windows\SysWOW64\Lnehgi32.exe	Lkglkm32.exe
File opened for modification	C:\Windows\SysWOW64\Bmffnhgk.exe	Bbmemjjl.exe
File opened for modification	C:\Windows\SysWOW64\Bbgagh32.exe	Boidkm32.exe
File created	C:\Windows\SysWOW64\Aghlmoem.dll	Ckbbem32.exe
File opened for modification	C:\Windows\SysWOW64\Hpnlod32.exe	Folfknll.exe
File created	C:\Windows\SysWOW64\Iihmmi32.exe	Ifjqan32.exe
File opened for modification	C:\Windows\SysWOW64\Baphmd32.exe	Bmelmefm.exe
File created	C:\Windows\SysWOW64\Jljlpl32.dll	Ejiebh32.exe
File created	C:\Windows\SysWOW64\Fljfdi32.exe	Fpcfohnc.exe
File created	C:\Windows\SysWOW64\Okcnfm32.dll	Mhdnol32.exe
File opened for modification	C:\Windows\SysWOW64\Okimkj32.exe	Ododnppn.exe
File created	C:\Windows\SysWOW64\Bhiahdcf.dll	Poqpanem.exe
File created	C:\Windows\SysWOW64\Cbgbed32.dll	Cckjdpam.exe
File created	C:\Windows\SysWOW64\Pfiomelk.exe	Phenca32.exe
File opened for modification	C:\Windows\SysWOW64\Bjdckjil.exe	Bdjknpbo.exe
File created	C:\Windows\SysWOW64\Bgonij32.exe	Bmjjla32.exe
File created	C:\Windows\SysWOW64\Ilfhfhji.dll	Lenlbabh.exe
File created	C:\Windows\SysWOW64\Offploee.dll	Nhanip32.exe
File opened for modification	C:\Windows\SysWOW64\Ppldnjgg.exe	Piblap32.exe
File opened for modification	C:\Windows\SysWOW64\Pkjnlnin.exe	Phkaocik.exe
File created	C:\Windows\SysWOW64\Cedjlg32.exe	Cdcndojd.exe
File created	C:\Windows\SysWOW64\Pdefbm32.exe	Pkmaih32.exe
File opened for modification	C:\Windows\SysWOW64\Bkimdihd.exe	Aqcigqhn.exe
File created	C:\Windows\SysWOW64\Gdonoj32.exe	Goaefc32.exe
File created	C:\Windows\SysWOW64\Ghmhnf32.dll	Ookbdm32.exe
File opened for modification	C:\Windows\SysWOW64\Lgpmgkle.exe	Knhhne32.exe
File created	C:\Windows\SysWOW64\Dipqam32.dll	Bdlhdp32.exe
File created	C:\Windows\SysWOW64\Ceidgflm.exe	Checnbmc.exe
File created	C:\Windows\SysWOW64\Lmdlpqde.exe	Lemcoccc.exe
File opened for modification	C:\Windows\SysWOW64\Njhhhh32.exe	Mfllgima.exe
File created	C:\Windows\SysWOW64\Odpipaof.exe	Oaamdepb.exe
File created	C:\Windows\SysWOW64\Eaeoie32.dll	Cneognqi.exe
File opened for modification	C:\Windows\SysWOW64\Biaicben.exe	Bbgagh32.exe
File created	C:\Windows\SysWOW64\Bjfpqjgi.exe	Bhhddohe.exe
File created	C:\Windows\SysWOW64\Kehichcp.dll	Mmihbmke.exe
File opened for modification	C:\Windows\SysWOW64\Jfpplcco.exe	Jmgkcm32.exe
File opened for modification	C:\Windows\SysWOW64\Ajjjhici.exe	Alfioedo.exe
File created	C:\Windows\SysWOW64\Jjhhao32.dll	Bgamjo32.exe
File opened for modification	C:\Windows\SysWOW64\Ldbcch32.exe	Ijqoeqce.exe
File created	C:\Windows\SysWOW64\Cjmkdf32.dll	Aqcigqhn.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cealdcqm.dll"	Lienhqof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Baphmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnppbehi.dll"	Fcafjq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nghmipmn.dll"	Aiehmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkmpfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkagic32.dll"	Difehkgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Folfknll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iflmfm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iimfhhpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkfibd32.dll"	Checnbmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chhifm32.dll"	Mgikph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmhchgab.dll"	Ceiqcinn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifgdkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaidnanq.dll"	Okfkfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qceedn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofnell32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnjhbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Phnnebgh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qnophiaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bbmemjjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bcegfajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Caagcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmhhhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlfldh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdanef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Necfnepf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pocpkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Blofjnec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Epcipd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofkknobb.dll"	Kaepho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilfhfhji.dll"	Lenlbabh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Medjob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpekabip.dll"	Bmbpgfho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjmkdf32.dll"	Aqcigqhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aifljpga.dll"	Bicgfb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogpmpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jobcnkje.dll"	Ommfha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnokng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhqiinol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hkdkef32.dll"	Bjfpqjgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bniffd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngkdekad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djaigobh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olcmdp32.dll"	Bfpnkkkj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hlqick32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjjjblnd.dll"	Jqajnlgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgchnb32.dll"	Cmhhhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phidjc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdbgoeoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Knelhegh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjelbhgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgkipmlg.dll"	Dlgojfda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iimfhhpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlabiink.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Macpak32.dll"	Kaqgmpjf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oiakcgih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilglnp32.dll"	Aobieq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cafgiinj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbdjkm32.dll"	Lhmhomal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nfenbdok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbogeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndioocfa.dll"	Dipcli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgcfhg32.dll"	Kicecn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ingbkppc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1748	1728	cff3b479c1bb2610f4d451565180361e5ebcbe4a7b17348684237a2d48d831bf.exe	28
PID 1728 wrote to memory of 1748	1728	cff3b479c1bb2610f4d451565180361e5ebcbe4a7b17348684237a2d48d831bf.exe	28
PID 1728 wrote to memory of 1748	1728	cff3b479c1bb2610f4d451565180361e5ebcbe4a7b17348684237a2d48d831bf.exe	28
PID 1728 wrote to memory of 1748	1728	cff3b479c1bb2610f4d451565180361e5ebcbe4a7b17348684237a2d48d831bf.exe	28
PID 1748 wrote to memory of 2012	1748	Lgfnjdaj.exe	29
PID 1748 wrote to memory of 2012	1748	Lgfnjdaj.exe	29
PID 1748 wrote to memory of 2012	1748	Lgfnjdaj.exe	29
PID 1748 wrote to memory of 2012	1748	Lgfnjdaj.exe	29
PID 2012 wrote to memory of 1304	2012	Loabofne.exe	30
PID 2012 wrote to memory of 1304	2012	Loabofne.exe	30
PID 2012 wrote to memory of 1304	2012	Loabofne.exe	30
PID 2012 wrote to memory of 1304	2012	Loabofne.exe	30
PID 1304 wrote to memory of 1336	1304	Mfkgjchn.exe	31
PID 1304 wrote to memory of 1336	1304	Mfkgjchn.exe	31
PID 1304 wrote to memory of 1336	1304	Mfkgjchn.exe	31
PID 1304 wrote to memory of 1336	1304	Mfkgjchn.exe	31
PID 1336 wrote to memory of 2000	1336	Mmglmm32.exe	32
PID 1336 wrote to memory of 2000	1336	Mmglmm32.exe	32
PID 1336 wrote to memory of 2000	1336	Mmglmm32.exe	32
PID 1336 wrote to memory of 2000	1336	Mmglmm32.exe	32
PID 2000 wrote to memory of 1772	2000	Mbddedlo.exe	33
PID 2000 wrote to memory of 1772	2000	Mbddedlo.exe	33
PID 2000 wrote to memory of 1772	2000	Mbddedlo.exe	33
PID 2000 wrote to memory of 1772	2000	Mbddedlo.exe	33
PID 1772 wrote to memory of 320	1772	Mmihbmke.exe	34
PID 1772 wrote to memory of 320	1772	Mmihbmke.exe	34
PID 1772 wrote to memory of 320	1772	Mmihbmke.exe	34
PID 1772 wrote to memory of 320	1772	Mmihbmke.exe	34
PID 320 wrote to memory of 1704	320	Nccqog32.exe	35
PID 320 wrote to memory of 1704	320	Nccqog32.exe	35
PID 320 wrote to memory of 1704	320	Nccqog32.exe	35
PID 320 wrote to memory of 1704	320	Nccqog32.exe	35
PID 1704 wrote to memory of 1152	1704	Nloeci32.exe	36
PID 1704 wrote to memory of 1152	1704	Nloeci32.exe	36
PID 1704 wrote to memory of 1152	1704	Nloeci32.exe	36
PID 1704 wrote to memory of 1152	1704	Nloeci32.exe	36
PID 1152 wrote to memory of 1592	1152	Nfdjqbpc.exe	37
PID 1152 wrote to memory of 1592	1152	Nfdjqbpc.exe	37
PID 1152 wrote to memory of 1592	1152	Nfdjqbpc.exe	37
PID 1152 wrote to memory of 1592	1152	Nfdjqbpc.exe	37
PID 1592 wrote to memory of 340	1592	Nlabiink.exe	38
PID 1592 wrote to memory of 340	1592	Nlabiink.exe	38
PID 1592 wrote to memory of 340	1592	Nlabiink.exe	38
PID 1592 wrote to memory of 340	1592	Nlabiink.exe	38
PID 340 wrote to memory of 1488	340	Nankaplb.exe	39
PID 340 wrote to memory of 1488	340	Nankaplb.exe	39
PID 340 wrote to memory of 1488	340	Nankaplb.exe	39
PID 340 wrote to memory of 1488	340	Nankaplb.exe	39
PID 1488 wrote to memory of 544	1488	Nhhcnj32.exe	40
PID 1488 wrote to memory of 544	1488	Nhhcnj32.exe	40
PID 1488 wrote to memory of 544	1488	Nhhcnj32.exe	40
PID 1488 wrote to memory of 544	1488	Nhhcnj32.exe	40
PID 544 wrote to memory of 1508	544	Nbmgkcce.exe	41
PID 544 wrote to memory of 1508	544	Nbmgkcce.exe	41
PID 544 wrote to memory of 1508	544	Nbmgkcce.exe	41
PID 544 wrote to memory of 1508	544	Nbmgkcce.exe	41
PID 1508 wrote to memory of 1108	1508	Nlfldh32.exe	42
PID 1508 wrote to memory of 1108	1508	Nlfldh32.exe	42
PID 1508 wrote to memory of 1108	1508	Nlfldh32.exe	42
PID 1508 wrote to memory of 1108	1508	Nlfldh32.exe	42
PID 1108 wrote to memory of 2024	1108	Penlla32.exe	43
PID 1108 wrote to memory of 2024	1108	Penlla32.exe	43
PID 1108 wrote to memory of 2024	1108	Penlla32.exe	43
PID 1108 wrote to memory of 2024	1108	Penlla32.exe	43

C:\Users\Admin\AppData\Local\Temp\cff3b479c1bb2610f4d451565180361e5ebcbe4a7b17348684237a2d48d831bf.exe
"C:\Users\Admin\AppData\Local\Temp\cff3b479c1bb2610f4d451565180361e5ebcbe4a7b17348684237a2d48d831bf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\Lgfnjdaj.exe
  C:\Windows\system32\Lgfnjdaj.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\SysWOW64\Loabofne.exe
    C:\Windows\system32\Loabofne.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Windows\SysWOW64\Mfkgjchn.exe
      C:\Windows\system32\Mfkgjchn.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1304
    - - C:\Windows\SysWOW64\Mmglmm32.exe
        
        C:\Windows\system32\Mmglmm32.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1336
      - C:\Windows\SysWOW64\Mbddedlo.exe
        
        C:\Windows\system32\Mbddedlo.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2000
        
        C:\Windows\SysWOW64\Mmihbmke.exe
        
        C:\Windows\system32\Mmihbmke.exe
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1772
        
        C:\Windows\SysWOW64\Nccqog32.exe
        
        C:\Windows\system32\Nccqog32.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:320
        
        C:\Windows\SysWOW64\Nloeci32.exe
        
        C:\Windows\system32\Nloeci32.exe
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\SysWOW64\Nfdjqbpc.exe
        
        C:\Windows\system32\Nfdjqbpc.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1152
        
        C:\Windows\SysWOW64\Nlabiink.exe
        
        C:\Windows\system32\Nlabiink.exe
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1592
        
        C:\Windows\SysWOW64\Nankaplb.exe
        
        C:\Windows\system32\Nankaplb.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:340
        
        C:\Windows\SysWOW64\Nhhcnj32.exe
        
        C:\Windows\system32\Nhhcnj32.exe
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1488
        
        C:\Windows\SysWOW64\Nbmgkcce.exe
        
        C:\Windows\system32\Nbmgkcce.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:544
        
        C:\Windows\SysWOW64\Nlfldh32.exe
        
        C:\Windows\system32\Nlfldh32.exe
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Windows\SysWOW64\Penlla32.exe
        
        C:\Windows\system32\Penlla32.exe
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\SysWOW64\Plhdhkkn.exe
        
        C:\Windows\system32\Plhdhkkn.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2024
        
        C:\Windows\SysWOW64\Pkmaih32.exe
        
        C:\Windows\system32\Pkmaih32.exe
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2044
        
        C:\Windows\SysWOW64\Pdefbm32.exe
        
        C:\Windows\system32\Pdefbm32.exe
        19⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1104
        
        C:\Windows\SysWOW64\Aiehmo32.exe
        
        C:\Windows\system32\Aiehmo32.exe
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1828
        
        C:\Windows\SysWOW64\Akddij32.exe
        
        C:\Windows\system32\Akddij32.exe
        21⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:988
        
        C:\Windows\SysWOW64\Abnlfdcf.exe
        
        C:\Windows\system32\Abnlfdcf.exe
        22⤵
        Executes dropped EXE
        
        PID:1016
        
        C:\Windows\SysWOW64\Aihdbn32.exe
        
        C:\Windows\system32\Aihdbn32.exe
        23⤵
        Loads dropped DLL
        
        PID:956
        
        C:\Windows\SysWOW64\Ajiajf32.exe
        
        C:\Windows\system32\Ajiajf32.exe
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:868
        
        C:\Windows\SysWOW64\Aqcigqhn.exe
        
        C:\Windows\system32\Aqcigqhn.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Modifies registry class
        
        PID:1340
        
        C:\Windows\SysWOW64\Bkimdihd.exe
        
        C:\Windows\system32\Bkimdihd.exe
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1268
        
        C:\Windows\SysWOW64\Bmjjla32.exe
        
        C:\Windows\system32\Bmjjla32.exe
        27⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1324
        
        C:\Windows\SysWOW64\Bgonij32.exe
        
        C:\Windows\system32\Bgonij32.exe
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1720
        
        C:\Windows\SysWOW64\Bniffd32.exe
        
        C:\Windows\system32\Bniffd32.exe
        29⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1116
        
        C:\Windows\SysWOW64\Bpkbnmkc.exe
        
        C:\Windows\system32\Bpkbnmkc.exe
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1952
        
        C:\Windows\SysWOW64\Bfdkjg32.exe
        
        C:\Windows\system32\Bfdkjg32.exe
        31⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1484
        
        C:\Windows\SysWOW64\Bicgfb32.exe
        
        C:\Windows\system32\Bicgfb32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1860
        
        C:\Windows\SysWOW64\Chfpim32.exe
        
        C:\Windows\system32\Chfpim32.exe
        33⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1620
        
        C:\Windows\SysWOW64\Dellniki.exe
        
        C:\Windows\system32\Dellniki.exe
        34⤵
        Executes dropped EXE
        
        PID:1584
        
        C:\Windows\SysWOW64\Eigdnkfn.exe
        
        C:\Windows\system32\Eigdnkfn.exe
        35⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Windows\SysWOW64\Epcipd32.exe
        
        C:\Windows\system32\Epcipd32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1656
        
        C:\Windows\SysWOW64\Fhedef32.exe
        
        C:\Windows\system32\Fhedef32.exe
        37⤵
        Executes dropped EXE
        
        PID:2032
        
        C:\Windows\SysWOW64\Fpcfohnc.exe
        
        C:\Windows\system32\Fpcfohnc.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1752
        
        C:\Windows\SysWOW64\Fljfdi32.exe
        
        C:\Windows\system32\Fljfdi32.exe
        39⤵
        Executes dropped EXE
        
        PID:1480
        
        C:\Windows\SysWOW64\Gdanef32.exe
        
        C:\Windows\system32\Gdanef32.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1552
        
        C:\Windows\SysWOW64\Gmicnl32.exe
        
        C:\Windows\system32\Gmicnl32.exe
        41⤵
        Executes dropped EXE
        
        PID:1804
        
        C:\Windows\SysWOW64\Gedhbn32.exe
        
        C:\Windows\system32\Gedhbn32.exe
        42⤵
        Executes dropped EXE
        
        PID:1176
        
        C:\Windows\SysWOW64\Gomlkcof.exe
        
        C:\Windows\system32\Gomlkcof.exe
        43⤵
        Executes dropped EXE
        
        PID:908
        
        C:\Windows\SysWOW64\Gakhgonj.exe
        
        C:\Windows\system32\Gakhgonj.exe
        44⤵
        Executes dropped EXE
        
        PID:796
        
        C:\Windows\SysWOW64\Geianmdp.exe
        
        C:\Windows\system32\Geianmdp.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1184
        
        C:\Windows\SysWOW64\Goaefc32.exe
        
        C:\Windows\system32\Goaefc32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1664
        
        C:\Windows\SysWOW64\Gdonoj32.exe
        
        C:\Windows\system32\Gdonoj32.exe
        47⤵
        Executes dropped EXE
        
        PID:960
        
        C:\Windows\SysWOW64\Hpeock32.exe
        
        C:\Windows\system32\Hpeock32.exe
        48⤵
        Executes dropped EXE
        
        PID:860
        
        C:\Windows\SysWOW64\Hkmpfc32.exe
        
        C:\Windows\system32\Hkmpfc32.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:388
        
        C:\Windows\SysWOW64\Hnllbolc.exe
        
        C:\Windows\system32\Hnllbolc.exe
        50⤵
        Executes dropped EXE
        
        PID:1068
        
        C:\Windows\SysWOW64\Hdedoi32.exe
        
        C:\Windows\system32\Hdedoi32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:592
        
        C:\Windows\SysWOW64\Hlqick32.exe
        
        C:\Windows\system32\Hlqick32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:600
        
        C:\Windows\SysWOW64\Ifkjbp32.exe
        
        C:\Windows\system32\Ifkjbp32.exe
        53⤵
        Executes dropped EXE
        
        PID:1912
        
        C:\Windows\SysWOW64\Ikhbjg32.exe
        
        C:\Windows\system32\Ikhbjg32.exe
        54⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Idqgcmja.exe
        
        C:\Windows\system32\Idqgcmja.exe
        55⤵
        Executes dropped EXE
        
        PID:932
        
        C:\Windows\SysWOW64\Ikmlefok.exe
        
        C:\Windows\system32\Ikmlefok.exe
        56⤵
        Executes dropped EXE
        
        PID:1692
        
        C:\Windows\SysWOW64\Ijbifc32.exe
        
        C:\Windows\system32\Ijbifc32.exe
        57⤵
        Executes dropped EXE
        
        PID:1724
        
        C:\Windows\SysWOW64\Ikaeqf32.exe
        
        C:\Windows\system32\Ikaeqf32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1360
        
        C:\Windows\SysWOW64\Jejjikaf.exe
        
        C:\Windows\system32\Jejjikaf.exe
        59⤵
        Executes dropped EXE
        
        PID:680
        
        C:\Windows\SysWOW64\Jghfegqj.exe
        
        C:\Windows\system32\Jghfegqj.exe
        60⤵
        Executes dropped EXE
        
        PID:912

C:\Windows\SysWOW64\Jqajnlgj.exe
C:\Windows\system32\Jqajnlgj.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:1304
- C:\Windows\SysWOW64\Jmgkcm32.exe
  C:\Windows\system32\Jmgkcm32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1772
- - C:\Windows\SysWOW64\Jfpplcco.exe
    C:\Windows\system32\Jfpplcco.exe
    3⤵
    - Executes dropped EXE
    PID:704
  - - C:\Windows\SysWOW64\Jcdpeg32.exe
      C:\Windows\system32\Jcdpeg32.exe
      4⤵
      Executes dropped EXE
      PID:1780
    - - C:\Windows\SysWOW64\Jpkakhhm.exe
        
        C:\Windows\system32\Jpkakhhm.exe
        5⤵
        Executes dropped EXE
        
        PID:1696
      - C:\Windows\SysWOW64\Kicecn32.exe
        
        C:\Windows\system32\Kicecn32.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1104
        
        C:\Windows\SysWOW64\Kanjhpli.exe
        
        C:\Windows\system32\Kanjhpli.exe
        7⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\Kejfho32.exe
        
        C:\Windows\system32\Kejfho32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1324
        
        C:\Windows\SysWOW64\Kbnfbc32.exe
        
        C:\Windows\system32\Kbnfbc32.exe
        9⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Kaqgmpjf.exe
        
        C:\Windows\system32\Kaqgmpjf.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:636
        
        C:\Windows\SysWOW64\Kdocikij.exe
        
        C:\Windows\system32\Kdocikij.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2028
        
        C:\Windows\SysWOW64\Kndggdhp.exe
        
        C:\Windows\system32\Kndggdhp.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1000
        
        C:\Windows\SysWOW64\Kdapok32.exe
        
        C:\Windows\system32\Kdapok32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1988
        
        C:\Windows\SysWOW64\Kaepho32.exe
        
        C:\Windows\system32\Kaepho32.exe
        14⤵
        Modifies registry class
        
        PID:1968
        
        C:\Windows\SysWOW64\Kfbiqf32.exe
        
        C:\Windows\system32\Kfbiqf32.exe
        15⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\Kpjmiljh.exe
        
        C:\Windows\system32\Kpjmiljh.exe
        16⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\Lbiiegil.exe
        
        C:\Windows\system32\Lbiiegil.exe
        17⤵
        
        PID:1072
        
        C:\Windows\SysWOW64\Lmnncp32.exe
        
        C:\Windows\system32\Lmnncp32.exe
        18⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Lfgblepb.exe
        
        C:\Windows\system32\Lfgblepb.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1788
        
        C:\Windows\SysWOW64\Lienhqof.exe
        
        C:\Windows\system32\Lienhqof.exe
        20⤵
        Modifies registry class
        
        PID:272
        
        C:\Windows\SysWOW64\Lelomadk.exe
        
        C:\Windows\system32\Lelomadk.exe
        21⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Lbppffcd.exe
        
        C:\Windows\system32\Lbppffcd.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1932
        
        C:\Windows\SysWOW64\Lenlbabh.exe
        
        C:\Windows\system32\Lenlbabh.exe
        23⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:268
        
        C:\Windows\SysWOW64\Lhmhomal.exe
        
        C:\Windows\system32\Lhmhomal.exe
        24⤵
        Modifies registry class
        
        PID:1516
        
        C:\Windows\SysWOW64\Lkkdkhqo.exe
        
        C:\Windows\system32\Lkkdkhqo.exe
        25⤵
        
        PID:280
        
        C:\Windows\SysWOW64\Mkmaph32.exe
        
        C:\Windows\system32\Mkmaph32.exe
        26⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\Mokjffec.exe
        
        C:\Windows\system32\Mokjffec.exe
        27⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\Mhdnol32.exe
        
        C:\Windows\system32\Mhdnol32.exe
        28⤵
        Drops file in System32 directory
        
        PID:1328
        
        C:\Windows\SysWOW64\Mnqfgbjk.exe
        
        C:\Windows\system32\Mnqfgbjk.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1316
        
        C:\Windows\SysWOW64\Mgikph32.exe
        
        C:\Windows\system32\Mgikph32.exe
        30⤵
        Modifies registry class
        
        PID:1760
        
        C:\Windows\SysWOW64\Mjggld32.exe
        
        C:\Windows\system32\Mjggld32.exe
        31⤵
        
        PID:320
        
        C:\Windows\SysWOW64\Mcpleifp.exe
        
        C:\Windows\system32\Mcpleifp.exe
        32⤵
        
        PID:876
        
        C:\Windows\SysWOW64\Mlhpnolp.exe
        
        C:\Windows\system32\Mlhpnolp.exe
        33⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\Mofmjjld.exe
        
        C:\Windows\system32\Mofmjjld.exe
        34⤵
        Drops file in System32 directory
        
        PID:1592
        
        C:\Windows\SysWOW64\Ngndkhlf.exe
        
        C:\Windows\system32\Ngndkhlf.exe
        35⤵
        
        PID:560
        
        C:\Windows\SysWOW64\Ncdepi32.exe
        
        C:\Windows\system32\Ncdepi32.exe
        36⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\Njnmmbig.exe
        
        C:\Windows\system32\Njnmmbig.exe
        37⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\Nhanip32.exe
        
        C:\Windows\system32\Nhanip32.exe
        38⤵
        Drops file in System32 directory
        
        PID:1268
        
        C:\Windows\SysWOW64\Nfenbdok.exe
        
        C:\Windows\system32\Nfenbdok.exe
        39⤵
        Modifies registry class
        
        PID:1952
        
        C:\Windows\SysWOW64\Nhcjnono.exe
        
        C:\Windows\system32\Nhcjnono.exe
        40⤵
        
        PID:856
        
        C:\Windows\SysWOW64\Nbloge32.exe
        
        C:\Windows\system32\Nbloge32.exe
        41⤵
        
        PID:988
        
        C:\Windows\SysWOW64\Ngkdekad.exe
        
        C:\Windows\system32\Ngkdekad.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:768
        
        C:\Windows\SysWOW64\Njipagph.exe
        
        C:\Windows\system32\Njipagph.exe
        43⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\Ododnppn.exe
        
        C:\Windows\system32\Ododnppn.exe
        44⤵
        Drops file in System32 directory
        
        PID:1308
        
        C:\Windows\SysWOW64\Okimkj32.exe
        
        C:\Windows\system32\Okimkj32.exe
        45⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\Ojlmffne.exe
        
        C:\Windows\system32\Ojlmffne.exe
        46⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\Omjibb32.exe
        
        C:\Windows\system32\Omjibb32.exe
        47⤵
        
        PID:880
        
        C:\Windows\SysWOW64\Oqfecqeb.exe
        
        C:\Windows\system32\Oqfecqeb.exe
        48⤵
        
        PID:544
        
        C:\Windows\SysWOW64\Odaado32.exe
        
        C:\Windows\system32\Odaado32.exe
        49⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\Ogpmpk32.exe
        
        C:\Windows\system32\Ogpmpk32.exe
        50⤵
        Modifies registry class
        
        PID:2060
        
        C:\Windows\SysWOW64\Ommfha32.exe
        
        C:\Windows\system32\Ommfha32.exe
        51⤵
        Modifies registry class
        
        PID:2068
        
        C:\Windows\SysWOW64\Ookbdm32.exe
        
        C:\Windows\system32\Ookbdm32.exe
        52⤵
        Drops file in System32 directory
        
        PID:2076
        
        C:\Windows\SysWOW64\Ocfnelbc.exe
        
        C:\Windows\system32\Ocfnelbc.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2084
        
        C:\Windows\SysWOW64\Ogbjej32.exe
        
        C:\Windows\system32\Ogbjej32.exe
        54⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\Omobnaic.exe
        
        C:\Windows\system32\Omobnaic.exe
        55⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Ocikjk32.exe
        
        C:\Windows\system32\Ocikjk32.exe
        56⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\Pbhdee32.exe
        
        C:\Windows\system32\Pbhdee32.exe
        57⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\Piblap32.exe
        
        C:\Windows\system32\Piblap32.exe
        58⤵
        Drops file in System32 directory
        
        PID:2272
        
        C:\Windows\SysWOW64\Ppldnjgg.exe
        
        C:\Windows\system32\Ppldnjgg.exe
        59⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\Ihkkpm32.exe
        
        C:\Windows\system32\Ihkkpm32.exe
        60⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Jhoqjpak.exe
        
        C:\Windows\system32\Jhoqjpak.exe
        61⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\Knelhegh.exe
        
        C:\Windows\system32\Knelhegh.exe
        62⤵
        Modifies registry class
        
        PID:2364
        
        C:\Windows\SysWOW64\Knhhne32.exe
        
        C:\Windows\system32\Knhhne32.exe
        63⤵
        Drops file in System32 directory
        
        PID:2372
        
        C:\Windows\SysWOW64\Lgpmgkle.exe
        
        C:\Windows\system32\Lgpmgkle.exe
        64⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\Lmmeoajm.exe
        
        C:\Windows\system32\Lmmeoajm.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2388
        
        C:\Windows\SysWOW64\Lgbjlj32.exe
        
        C:\Windows\system32\Lgbjlj32.exe
        66⤵
        Drops file in System32 directory
        
        PID:2396
        
        C:\Windows\SysWOW64\Licfdbpa.exe
        
        C:\Windows\system32\Licfdbpa.exe
        67⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\Lqknepqc.exe
        
        C:\Windows\system32\Lqknepqc.exe
        68⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Lcijakpg.exe
        
        C:\Windows\system32\Lcijakpg.exe
        69⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\Lfgfmgok.exe
        
        C:\Windows\system32\Lfgfmgok.exe
        70⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Lifcibno.exe
        
        C:\Windows\system32\Lifcibno.exe
        71⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\Lkdoenmb.exe
        
        C:\Windows\system32\Lkdoenmb.exe
        72⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\Lclggk32.exe
        
        C:\Windows\system32\Lclggk32.exe
        73⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\Lfjccf32.exe
        
        C:\Windows\system32\Lfjccf32.exe
        74⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\Lemcoccc.exe
        
        C:\Windows\system32\Lemcoccc.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2468
        
        C:\Windows\SysWOW64\Lmdlpqde.exe
        
        C:\Windows\system32\Lmdlpqde.exe
        76⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\Lkglkm32.exe
        
        C:\Windows\system32\Lkglkm32.exe
        77⤵
        Drops file in System32 directory
        
        PID:2484
        
        C:\Windows\SysWOW64\Lnehgi32.exe
        
        C:\Windows\system32\Lnehgi32.exe
        78⤵
        
        PID:2492
        
        C:\Windows\SysWOW64\Liklda32.exe
        
        C:\Windows\system32\Liklda32.exe
        79⤵
        Drops file in System32 directory
        
        PID:2500
        
        C:\Windows\SysWOW64\Lkihqm32.exe
        
        C:\Windows\system32\Lkihqm32.exe
        80⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\Loddalaf.exe
        
        C:\Windows\system32\Loddalaf.exe
        81⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\Mbcqmg32.exe
        
        C:\Windows\system32\Mbcqmg32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2524
        
        C:\Windows\SysWOW64\Mafaidgd.exe
        
        C:\Windows\system32\Mafaidgd.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2532
        
        C:\Windows\SysWOW64\Meamib32.exe
        
        C:\Windows\system32\Meamib32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2540
        
        C:\Windows\SysWOW64\Mgpifn32.exe
        
        C:\Windows\system32\Mgpifn32.exe
        85⤵
        
        PID:2548
        
        C:\Windows\SysWOW64\Mkkefmgj.exe
        
        C:\Windows\system32\Mkkefmgj.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2556
        
        C:\Windows\SysWOW64\Mnjabhfn.exe
        
        C:\Windows\system32\Mnjabhfn.exe
        87⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\Mbemcg32.exe
        
        C:\Windows\system32\Mbemcg32.exe
        88⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Medjob32.exe
        
        C:\Windows\system32\Medjob32.exe
        89⤵
        Modifies registry class
        
        PID:2580
        
        C:\Windows\SysWOW64\Mcgjkode.exe
        
        C:\Windows\system32\Mcgjkode.exe
        90⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\Mknblleg.exe
        
        C:\Windows\system32\Mknblleg.exe
        91⤵
        Drops file in System32 directory
        
        PID:2596
        
        C:\Windows\SysWOW64\Mjqbgi32.exe
        
        C:\Windows\system32\Mjqbgi32.exe
        92⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\Mgdbamjl.exe
        
        C:\Windows\system32\Mgdbamjl.exe
        93⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\Mjcomijp.exe
        
        C:\Windows\system32\Mjcomijp.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2620
        
        C:\Windows\SysWOW64\Mnokng32.exe
        
        C:\Windows\system32\Mnokng32.exe
        95⤵
        Modifies registry class
        
        PID:2628
        
        C:\Windows\SysWOW64\Mmakidic.exe
        
        C:\Windows\system32\Mmakidic.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2664
        
        C:\Windows\SysWOW64\Mjelbhgm.exe
        
        C:\Windows\system32\Mjelbhgm.exe
        97⤵
        Modifies registry class
        
        PID:2680
        
        C:\Windows\SysWOW64\Mmdhodgq.exe
        
        C:\Windows\system32\Mmdhodgq.exe
        98⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Mcnpkn32.exe
        
        C:\Windows\system32\Mcnpkn32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2712
        
        C:\Windows\SysWOW64\Mfllgima.exe
        
        C:\Windows\system32\Mfllgima.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2728
        
        C:\Windows\SysWOW64\Njhhhh32.exe
        
        C:\Windows\system32\Njhhhh32.exe
        101⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\Nmfddc32.exe
        
        C:\Windows\system32\Nmfddc32.exe
        102⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\Nlieppkh.exe
        
        C:\Windows\system32\Nlieppkh.exe
        103⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\Ncpmanlk.exe
        
        C:\Windows\system32\Ncpmanlk.exe
        104⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\Nbcmlj32.exe
        
        C:\Windows\system32\Nbcmlj32.exe
        105⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\Nmhajc32.exe
        
        C:\Windows\system32\Nmhajc32.exe
        106⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\Npgnfo32.exe
        
        C:\Windows\system32\Npgnfo32.exe
        107⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Nfqfbi32.exe
        
        C:\Windows\system32\Nfqfbi32.exe
        108⤵
        
        PID:2948
        
        C:\Windows\SysWOW64\Necfnepf.exe
        
        C:\Windows\system32\Necfnepf.exe
        109⤵
        Modifies registry class
        
        PID:2960
        
        C:\Windows\SysWOW64\Nhbbjaoj.exe
        
        C:\Windows\system32\Nhbbjaoj.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2972
        
        C:\Windows\SysWOW64\Npijknpl.exe
        
        C:\Windows\system32\Npijknpl.exe
        111⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\Noljgk32.exe
        
        C:\Windows\system32\Noljgk32.exe
        112⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Najgcf32.exe
        
        C:\Windows\system32\Najgcf32.exe
        113⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\Niaodd32.exe
        
        C:\Windows\system32\Niaodd32.exe
        114⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\Nlpkpo32.exe
        
        C:\Windows\system32\Nlpkpo32.exe
        115⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\Nonglk32.exe
        
        C:\Windows\system32\Nonglk32.exe
        116⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\Nbjcmimm.exe
        
        C:\Windows\system32\Nbjcmimm.exe
        117⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\Nhglep32.exe
        
        C:\Windows\system32\Nhglep32.exe
        118⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Noqdbjba.exe
        
        C:\Windows\system32\Noqdbjba.exe
        119⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\Nmcdng32.exe
        
        C:\Windows\system32\Nmcdng32.exe
        120⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\Oeklod32.exe
        
        C:\Windows\system32\Oeklod32.exe
        121⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\Ohihkp32.exe
        
        C:\Windows\system32\Ohihkp32.exe
        122⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\Okgdgk32.exe
        
        C:\Windows\system32\Okgdgk32.exe
        123⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Oaamdepb.exe
        
        C:\Windows\system32\Oaamdepb.exe
        124⤵
        Drops file in System32 directory
        
        PID:2288
        
        C:\Windows\SysWOW64\Odpipaof.exe
        
        C:\Windows\system32\Odpipaof.exe
        125⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\Ofnell32.exe
        
        C:\Windows\system32\Ofnell32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1372
        
        C:\Windows\SysWOW64\Oimahh32.exe
        
        C:\Windows\system32\Oimahh32.exe
        127⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\Omhnifeg.exe
        
        C:\Windows\system32\Omhnifeg.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1628
        
        C:\Windows\SysWOW64\Opfjebdj.exe
        
        C:\Windows\system32\Opfjebdj.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1768
        
        C:\Windows\SysWOW64\Obefamcn.exe
        
        C:\Windows\system32\Obefamcn.exe
        130⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\Oklnbkdp.exe
        
        C:\Windows\system32\Oklnbkdp.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2032
        
        C:\Windows\SysWOW64\Omjjnfcd.exe
        
        C:\Windows\system32\Omjjnfcd.exe
        132⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\Olmjjc32.exe
        
        C:\Windows\system32\Olmjjc32.exe
        133⤵
        
        PID:836
        
        C:\Windows\SysWOW64\Oddbkp32.exe
        
        C:\Windows\system32\Oddbkp32.exe
        134⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\Obgbfmak.exe
        
        C:\Windows\system32\Obgbfmak.exe
        135⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\Oefobhqo.exe
        
        C:\Windows\system32\Oefobhqo.exe
        136⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\Oiakcgih.exe
        
        C:\Windows\system32\Oiakcgih.exe
        137⤵
        Modifies registry class
        
        PID:1964
        
        C:\Windows\SysWOW64\Olpgobhl.exe
        
        C:\Windows\system32\Olpgobhl.exe
        138⤵
        
        PID:552
        
        C:\Windows\SysWOW64\Oonckngp.exe
        
        C:\Windows\system32\Oonckngp.exe
        139⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Ogekmkhb.exe
        
        C:\Windows\system32\Ogekmkhb.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1436
        
        C:\Windows\SysWOW64\Oichigge.exe
        
        C:\Windows\system32\Oichigge.exe
        141⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\Ppnpea32.exe
        
        C:\Windows\system32\Ppnpea32.exe
        142⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\Poqpanem.exe
        
        C:\Windows\system32\Poqpanem.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:784
        
        C:\Windows\SysWOW64\Paolmidq.exe
        
        C:\Windows\system32\Paolmidq.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:588
        
        C:\Windows\SysWOW64\Pejhnh32.exe
        
        C:\Windows\system32\Pejhnh32.exe
        145⤵
        
        PID:336
        
        C:\Windows\SysWOW64\Phidjc32.exe
        
        C:\Windows\system32\Phidjc32.exe
        146⤵
        Modifies registry class
        
        PID:1464
        
        C:\Windows\SysWOW64\Pkgafoka.exe
        
        C:\Windows\system32\Pkgafoka.exe
        147⤵
        
        PID:828
        
        C:\Windows\SysWOW64\Pocmfm32.exe
        
        C:\Windows\system32\Pocmfm32.exe
        148⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\Pcniglkc.exe
        
        C:\Windows\system32\Pcniglkc.exe
        149⤵
        
        PID:316
        
        C:\Windows\SysWOW64\Pemecgjg.exe
        
        C:\Windows\system32\Pemecgjg.exe
        150⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\Phkaocik.exe
        
        C:\Windows\system32\Phkaocik.exe
        151⤵
        Drops file in System32 directory
        
        PID:1684
        
        C:\Windows\SysWOW64\Pkjnlnin.exe
        
        C:\Windows\system32\Pkjnlnin.exe
        152⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Poeilm32.exe
        
        C:\Windows\system32\Poeilm32.exe
        153⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\Pdbbdd32.exe
        
        C:\Windows\system32\Pdbbdd32.exe
        154⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\Phnnebgh.exe
        
        C:\Windows\system32\Phnnebgh.exe
        155⤵
        Modifies registry class
        
        PID:1440
        
        C:\Windows\SysWOW64\Ppibie32.exe
        
        C:\Windows\system32\Ppibie32.exe
        156⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\Phpkjb32.exe
        
        C:\Windows\system32\Phpkjb32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:340
        
        C:\Windows\SysWOW64\Pgbkfolp.exe
        
        C:\Windows\system32\Pgbkfolp.exe
        158⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\Pdgkpckj.exe
        
        C:\Windows\system32\Pdgkpckj.exe
        159⤵
        
        PID:832
        
        C:\Windows\SysWOW64\Qjcdhjia.exe
        
        C:\Windows\system32\Qjcdhjia.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1212
        
        C:\Windows\SysWOW64\Qnophiaj.exe
        
        C:\Windows\system32\Qnophiaj.exe
        161⤵
        Modifies registry class
        
        PID:1120
        
        C:\Windows\SysWOW64\Qpmlddqn.exe
        
        C:\Windows\system32\Qpmlddqn.exe
        162⤵
        Drops file in System32 directory
        
        PID:1976
        
        C:\Windows\SysWOW64\Qclhqppa.exe
        
        C:\Windows\system32\Qclhqppa.exe
        163⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\Qjfqmj32.exe
        
        C:\Windows\system32\Qjfqmj32.exe
        164⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\Qldmie32.exe
        
        C:\Windows\system32\Qldmie32.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1744
        
        C:\Windows\SysWOW64\Aobieq32.exe
        
        C:\Windows\system32\Aobieq32.exe
        166⤵
        Modifies registry class
        
        PID:1680
        
        C:\Windows\SysWOW64\Agjagn32.exe
        
        C:\Windows\system32\Agjagn32.exe
        167⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\Afmabkmb.exe
        
        C:\Windows\system32\Afmabkmb.exe
        168⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Ahknnflf.exe
        
        C:\Windows\system32\Ahknnflf.exe
        169⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Alfioedo.exe
        
        C:\Windows\system32\Alfioedo.exe
        170⤵
        Drops file in System32 directory
        
        PID:1560
        
        C:\Windows\SysWOW64\Ajjjhici.exe
        
        C:\Windows\system32\Ajjjhici.exe
        171⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Amifddbm.exe
        
        C:\Windows\system32\Amifddbm.exe
        172⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\Aklfpa32.exe
        
        C:\Windows\system32\Aklfpa32.exe
        173⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\Aogbqpap.exe
        
        C:\Windows\system32\Aogbqpap.exe
        174⤵
        Drops file in System32 directory
        
        PID:528
        
        C:\Windows\SysWOW64\Abfomkqd.exe
        
        C:\Windows\system32\Abfomkqd.exe
        175⤵
        
        PID:596
        
        C:\Windows\SysWOW64\Ahpgie32.exe
        
        C:\Windows\system32\Ahpgie32.exe
        176⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\Akncea32.exe
        
        C:\Windows\system32\Akncea32.exe
        177⤵
        Drops file in System32 directory
        
        PID:1688
        
        C:\Windows\SysWOW64\Abhkbk32.exe
        
        C:\Windows\system32\Abhkbk32.exe
        178⤵
        
        PID:692
        
        C:\Windows\SysWOW64\Afcgcjgk.exe
        
        C:\Windows\system32\Afcgcjgk.exe
        179⤵
        
        PID:616
        
        C:\Windows\SysWOW64\Aibcoefn.exe
        
        C:\Windows\system32\Aibcoefn.exe
        180⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\Agedkb32.exe
        
        C:\Windows\system32\Agedkb32.exe
        181⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\Adiddf32.exe
        
        C:\Windows\system32\Adiddf32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1488
        
        C:\Windows\SysWOW64\Bkcmqpco.exe
        
        C:\Windows\system32\Bkcmqpco.exe
        183⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\Bbmemjjl.exe
        
        C:\Windows\system32\Bbmemjjl.exe
        184⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2344
        
        C:\Windows\SysWOW64\Bmffnhgk.exe
        
        C:\Windows\system32\Bmffnhgk.exe
        185⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\Bennoegm.exe
        
        C:\Windows\system32\Bennoegm.exe
        186⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\Bcpnkb32.exe
        
        C:\Windows\system32\Bcpnkb32.exe
        187⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\Bfojgn32.exe
        
        C:\Windows\system32\Bfojgn32.exe
        188⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\Bnfbhk32.exe
        
        C:\Windows\system32\Bnfbhk32.exe
        189⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\Bqdodfma.exe
        
        C:\Windows\system32\Bqdodfma.exe
        190⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\Bfaglmki.exe
        
        C:\Windows\system32\Bfaglmki.exe
        191⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\Bcegfajb.exe
        
        C:\Windows\system32\Bcegfajb.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2116
        
        C:\Windows\SysWOW64\Bjopbl32.exe
        
        C:\Windows\system32\Bjopbl32.exe
        193⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Bmmlog32.exe
        
        C:\Windows\system32\Bmmlog32.exe
        194⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\Bplhkb32.exe
        
        C:\Windows\system32\Bplhkb32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2208
        
        C:\Windows\SysWOW64\Bcgdka32.exe
        
        C:\Windows\system32\Bcgdka32.exe
        196⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\Ceiqcinn.exe
        
        C:\Windows\system32\Ceiqcinn.exe
        197⤵
        Modifies registry class
        
        PID:1860
        
        C:\Windows\SysWOW64\Cpnepbnd.exe
        
        C:\Windows\system32\Cpnepbnd.exe
        198⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\Cbmalnmg.exe
        
        C:\Windows\system32\Cbmalnmg.exe
        199⤵
        
        PID:320
        
        C:\Windows\SysWOW64\Cfhmml32.exe
        
        C:\Windows\system32\Cfhmml32.exe
        200⤵
        
        PID:532
        
        C:\Windows\SysWOW64\Chijddko.exe
        
        C:\Windows\system32\Chijddko.exe
        201⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\Cbonbm32.exe
        
        C:\Windows\system32\Cbonbm32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:856
        
        C:\Windows\SysWOW64\Ciifogba.exe
        
        C:\Windows\system32\Ciifogba.exe
        203⤵
        
        PID:956
        
        C:\Windows\SysWOW64\Clgbkcae.exe
        
        C:\Windows\system32\Clgbkcae.exe
        204⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\Cneognqi.exe
        
        C:\Windows\system32\Cneognqi.exe
        205⤵
        Drops file in System32 directory
        
        PID:1248
        
        C:\Windows\SysWOW64\Cadkcjpm.exe
        
        C:\Windows\system32\Cadkcjpm.exe
        206⤵
        
        PID:880
        
        C:\Windows\SysWOW64\Cdbgoeoq.exe
        
        C:\Windows\system32\Cdbgoeoq.exe
        207⤵
        Modifies registry class
        
        PID:2052
        
        C:\Windows\SysWOW64\Cljopbpc.exe
        
        C:\Windows\system32\Cljopbpc.exe
        208⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\Cnhklnof.exe
        
        C:\Windows\system32\Cnhklnof.exe
        209⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\Cafgiinj.exe
        
        C:\Windows\system32\Cafgiinj.exe
        210⤵
        Modifies registry class
        
        PID:2340
        
        C:\Windows\SysWOW64\Cdedee32.exe
        
        C:\Windows\system32\Cdedee32.exe
        211⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\Cfcpap32.exe
        
        C:\Windows\system32\Cfcpap32.exe
        212⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\Cnjhbn32.exe
        
        C:\Windows\system32\Cnjhbn32.exe
        213⤵
        Modifies registry class
        
        PID:2816
        
        C:\Windows\SysWOW64\Ddgqjd32.exe
        
        C:\Windows\system32\Ddgqjd32.exe
        214⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\Djaigobh.exe
        
        C:\Windows\system32\Djaigobh.exe
        215⤵
        Modifies registry class
        
        PID:2884
        
        C:\Windows\SysWOW64\Dmpecjal.exe
        
        C:\Windows\system32\Dmpecjal.exe
        216⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\Dpnaoeqo.exe
        
        C:\Windows\system32\Dpnaoeqo.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2936
        
        C:\Windows\SysWOW64\Ddimpd32.exe
        
        C:\Windows\system32\Ddimpd32.exe
        218⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\Dfhilphl.exe
        
        C:\Windows\system32\Dfhilphl.exe
        219⤵
        Drops file in System32 directory
        
        PID:3016
        
        C:\Windows\SysWOW64\Difehkgp.exe
        
        C:\Windows\system32\Difehkgp.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3048
        
        C:\Windows\SysWOW64\Dlebdffc.exe
        
        C:\Windows\system32\Dlebdffc.exe
        221⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\Ddljedgf.exe
        
        C:\Windows\system32\Ddljedgf.exe
        222⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\Dfjfaofi.exe
        
        C:\Windows\system32\Dfjfaofi.exe
        223⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\Demfml32.exe
        
        C:\Windows\system32\Demfml32.exe
        224⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Dlgojfda.exe
        
        C:\Windows\system32\Dlgojfda.exe
        225⤵
        Modifies registry class
        
        PID:2312
        
        C:\Windows\SysWOW64\Eakmbllp.exe
        
        C:\Windows\system32\Eakmbllp.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:560
        
        C:\Windows\SysWOW64\Eamjhljn.exe
        
        C:\Windows\system32\Eamjhljn.exe
        227⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\Fnidhl32.exe
        
        C:\Windows\system32\Fnidhl32.exe
        228⤵
        Drops file in System32 directory
        
        PID:3040
        
        C:\Windows\SysWOW64\Bilphc32.exe
        
        C:\Windows\system32\Bilphc32.exe
        229⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\Bbedahpd.exe
        
        C:\Windows\system32\Bbedahpd.exe
        230⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Bdcpmdog.exe
        
        C:\Windows\system32\Bdcpmdog.exe
        231⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\Bgamjo32.exe
        
        C:\Windows\system32\Bgamjo32.exe
        232⤵
        Drops file in System32 directory
        
        PID:2236
        
        C:\Windows\SysWOW64\Boidkm32.exe
        
        C:\Windows\system32\Boidkm32.exe
        233⤵
        Drops file in System32 directory
        
        PID:288
        
        C:\Windows\SysWOW64\Bbgagh32.exe
        
        C:\Windows\system32\Bbgagh32.exe
        234⤵
        Drops file in System32 directory
        
        PID:1500
        
        C:\Windows\SysWOW64\Biaicben.exe
        
        C:\Windows\system32\Biaicben.exe
        235⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Ckpepnda.exe
        
        C:\Windows\system32\Ckpepnda.exe
        236⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\Cbinlh32.exe
        
        C:\Windows\system32\Cbinlh32.exe
        237⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\Cckjdpam.exe
        
        C:\Windows\system32\Cckjdpam.exe
        238⤵
        Drops file in System32 directory
        
        PID:876
        
        C:\Windows\SysWOW64\Ckbbem32.exe
        
        C:\Windows\system32\Ckbbem32.exe
        239⤵
        Drops file in System32 directory
        
        PID:2104
        
        C:\Windows\SysWOW64\Caojnd32.exe
        
        C:\Windows\system32\Caojnd32.exe
        240⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\Ccmgjp32.exe
        
        C:\Windows\system32\Ccmgjp32.exe
        241⤵
        
        PID:988
        
        C:\Windows\SysWOW64\Cjgofjgg.exe
        
        C:\Windows\system32\Cjgofjgg.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1340
        
        C:\Windows\SysWOW64\Caagcd32.exe
        
        C:\Windows\system32\Caagcd32.exe
        243⤵
        Modifies registry class
        
        PID:1208
        
        C:\Windows\SysWOW64\Cgkppneq.exe
        
        C:\Windows\system32\Cgkppneq.exe
        244⤵
        
        PID:576
        
        C:\Windows\SysWOW64\Cjilli32.exe
        
        C:\Windows\system32\Cjilli32.exe
        245⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\Cmhhhe32.exe
        
        C:\Windows\system32\Cmhhhe32.exe
        246⤵
        Modifies registry class
        
        PID:2072
        
        C:\Windows\SysWOW64\Cpfddp32.exe
        
        C:\Windows\system32\Cpfddp32.exe
        247⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Cfplajjh.exe
        
        C:\Windows\system32\Cfplajjh.exe
        248⤵
        Drops file in System32 directory
        
        PID:2092
        
        C:\Windows\SysWOW64\Cioimfil.exe
        
        C:\Windows\system32\Cioimfil.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2644
        
        C:\Windows\SysWOW64\Fknneoff.exe
        
        C:\Windows\system32\Fknneoff.exe
        250⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\Fecbbh32.exe
        
        C:\Windows\system32\Fecbbh32.exe
        251⤵
        Drops file in System32 directory
        
        PID:2768
        
        C:\Windows\SysWOW64\Fdfbnelf.exe
        
        C:\Windows\system32\Fdfbnelf.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2804
        
        C:\Windows\SysWOW64\Fkpjjo32.exe
        
        C:\Windows\system32\Fkpjjo32.exe
        253⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\Folfknll.exe
        
        C:\Windows\system32\Folfknll.exe
        254⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2864
        
        C:\Windows\SysWOW64\Hpnlod32.exe
        
        C:\Windows\system32\Hpnlod32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2880
        
        C:\Windows\SysWOW64\Ifgdkn32.exe
        
        C:\Windows\system32\Ifgdkn32.exe
        256⤵
        Modifies registry class
        
        PID:2896
        
        C:\Windows\SysWOW64\Imalhhnj.exe
        
        C:\Windows\system32\Imalhhnj.exe
        257⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\Ickdeb32.exe
        
        C:\Windows\system32\Ickdeb32.exe
        258⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\Ifjqan32.exe
        
        C:\Windows\system32\Ifjqan32.exe
        259⤵
        Drops file in System32 directory
        
        PID:2944
        
        C:\Windows\SysWOW64\Iihmmi32.exe
        
        C:\Windows\system32\Iihmmi32.exe
        260⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\Ipbejckk.exe
        
        C:\Windows\system32\Ipbejckk.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:868
        
        C:\Windows\SysWOW64\Iflmfm32.exe
        
        C:\Windows\system32\Iflmfm32.exe
        262⤵
        Modifies registry class
        
        PID:2812
        
        C:\Windows\SysWOW64\Iikibial.exe
        
        C:\Windows\system32\Iikibial.exe
        263⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\Ihmjne32.exe
        
        C:\Windows\system32\Ihmjne32.exe
        264⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\Ingbkppc.exe
        
        C:\Windows\system32\Ingbkppc.exe
        265⤵
        Modifies registry class
        
        PID:2828
        
        C:\Windows\SysWOW64\Iafngkog.exe
        
        C:\Windows\system32\Iafngkog.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2736
        
        C:\Windows\SysWOW64\Iimfhhpi.exe
        
        C:\Windows\system32\Iimfhhpi.exe
        267⤵
        Modifies registry class
        
        PID:3080
        
        C:\Windows\SysWOW64\Ihpfce32.exe
        
        C:\Windows\system32\Ihpfce32.exe
        268⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Ijnbpq32.exe
        
        C:\Windows\system32\Ijnbpq32.exe
        269⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Injoponq.exe
        
        C:\Windows\system32\Injoponq.exe
        270⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\Iahklkmd.exe
        
        C:\Windows\system32\Iahklkmd.exe
        271⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Icfgiflh.exe
        
        C:\Windows\system32\Icfgiflh.exe
        272⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Ilnojc32.exe
        
        C:\Windows\system32\Ilnojc32.exe
        273⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\Ijqoeqce.exe
        
        C:\Windows\system32\Ijqoeqce.exe
        274⤵
        Drops file in System32 directory
        
        PID:3140
        
        C:\Windows\SysWOW64\Ldbcch32.exe
        
        C:\Windows\system32\Ldbcch32.exe
        275⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Deaabliq.exe
        
        C:\Windows\system32\Deaabliq.exe
        276⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Mmmebbjg.exe
        
        C:\Windows\system32\Mmmebbjg.exe
        277⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\Mbmjphfl.exe
        
        C:\Windows\system32\Mbmjphfl.exe
        278⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\Nifbmb32.exe
        
        C:\Windows\system32\Nifbmb32.exe
        279⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\Nbogeh32.exe
        
        C:\Windows\system32\Nbogeh32.exe
        280⤵
        Modifies registry class
        
        PID:3248
        
        C:\Windows\SysWOW64\Nbackh32.exe
        
        C:\Windows\system32\Nbackh32.exe
        281⤵
        Drops file in System32 directory
        
        PID:3256
        
        C:\Windows\SysWOW64\Neblmcph.exe
        
        C:\Windows\system32\Neblmcph.exe
        282⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\Nhqiinol.exe
        
        C:\Windows\system32\Nhqiinol.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3272
        
        C:\Windows\SysWOW64\Nkoeejno.exe
        
        C:\Windows\system32\Nkoeejno.exe
        284⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Odifcobm.exe
        
        C:\Windows\system32\Odifcobm.exe
        285⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\Okcnpi32.exe
        
        C:\Windows\system32\Okcnpi32.exe
        286⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\Okfkfi32.exe
        
        C:\Windows\system32\Okfkfi32.exe
        287⤵
        Modifies registry class
        
        PID:3304
        
        C:\Windows\SysWOW64\Ondgbd32.exe
        
        C:\Windows\system32\Ondgbd32.exe
        288⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\Oapcbc32.exe
        
        C:\Windows\system32\Oapcbc32.exe
        289⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Occmpkcp.exe
        
        C:\Windows\system32\Occmpkcp.exe
        290⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\Ogaefiif.exe
        
        C:\Windows\system32\Ogaefiif.exe
        291⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\Phbana32.exe
        
        C:\Windows\system32\Phbana32.exe
        292⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\Phenca32.exe
        
        C:\Windows\system32\Phenca32.exe
        293⤵
        Drops file in System32 directory
        
        PID:3352
        
        C:\Windows\SysWOW64\Pfiomelk.exe
        
        C:\Windows\system32\Pfiomelk.exe
        294⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Phgkiqko.exe
        
        C:\Windows\system32\Phgkiqko.exe
        295⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\Pocpkj32.exe
        
        C:\Windows\system32\Pocpkj32.exe
        296⤵
        Modifies registry class
        
        PID:3376
        
        C:\Windows\SysWOW64\Pbdimenj.exe
        
        C:\Windows\system32\Pbdimenj.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3384
        
        C:\Windows\SysWOW64\Qdbeiamn.exe
        
        C:\Windows\system32\Qdbeiamn.exe
        298⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\Qceedn32.exe
        
        C:\Windows\system32\Qceedn32.exe
        299⤵
        Modifies registry class
        
        PID:3424
        
        C:\Windows\SysWOW64\Qnkjaf32.exe
        
        C:\Windows\system32\Qnkjaf32.exe
        300⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Qnmfgfal.exe
        
        C:\Windows\system32\Qnmfgfal.exe
        301⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Aqlbcapp.exe
        
        C:\Windows\system32\Aqlbcapp.exe
        302⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\Acjoompc.exe
        
        C:\Windows\system32\Acjoompc.exe
        303⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\Ajdglg32.exe
        
        C:\Windows\system32\Ajdglg32.exe
        304⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Aqnoianm.exe
        
        C:\Windows\system32\Aqnoianm.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3552
        
        C:\Windows\SysWOW64\Acmlemmq.exe
        
        C:\Windows\system32\Acmlemmq.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3560
        
        C:\Windows\SysWOW64\Afkhah32.exe
        
        C:\Windows\system32\Afkhah32.exe
        307⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\Ajfdagem.exe
        
        C:\Windows\system32\Ajfdagem.exe
        308⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\Apcljnce.exe
        
        C:\Windows\system32\Apcljnce.exe
        309⤵
        Drops file in System32 directory
        
        PID:3584
        
        C:\Windows\SysWOW64\Acohjl32.exe
        
        C:\Windows\system32\Acohjl32.exe
        310⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Amgmcbbn.exe
        
        C:\Windows\system32\Amgmcbbn.exe
        311⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\Apfipmab.exe
        
        C:\Windows\system32\Apfipmab.exe
        312⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Anhikj32.exe
        
        C:\Windows\system32\Anhikj32.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3616
        
        C:\Windows\SysWOW64\Aebahdoi.exe
        
        C:\Windows\system32\Aebahdoi.exe
        314⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Alljdngf.exe
        
        C:\Windows\system32\Alljdngf.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3632
        
        C:\Windows\SysWOW64\Ankfqjfj.exe
        
        C:\Windows\system32\Ankfqjfj.exe
        316⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\Aeenmd32.exe
        
        C:\Windows\system32\Aeenmd32.exe
        317⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\Blofjnec.exe
        
        C:\Windows\system32\Blofjnec.exe
        318⤵
        Modifies registry class
        
        PID:3656
        
        C:\Windows\SysWOW64\Bnmbfidg.exe
        
        C:\Windows\system32\Bnmbfidg.exe
        319⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Begkcc32.exe
        
        C:\Windows\system32\Begkcc32.exe
        320⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Bdjknpbo.exe
        
        C:\Windows\system32\Bdjknpbo.exe
        321⤵
        Drops file in System32 directory
        
        PID:3680
        
        C:\Windows\SysWOW64\Bjdckjil.exe
        
        C:\Windows\system32\Bjdckjil.exe
        322⤵
        
        PID:3688
        
        C:\Windows\SysWOW64\Bmbpgfho.exe
        
        C:\Windows\system32\Bmbpgfho.exe
        323⤵
        Modifies registry class
        
        PID:3696
        
        C:\Windows\SysWOW64\Bdlhdp32.exe
        
        C:\Windows\system32\Bdlhdp32.exe
        324⤵
        Drops file in System32 directory
        
        PID:3704
        
        C:\Windows\SysWOW64\Bhhddohe.exe
        
        C:\Windows\system32\Bhhddohe.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3712
        
        C:\Windows\SysWOW64\Bjfpqjgi.exe
        
        C:\Windows\system32\Bjfpqjgi.exe
        326⤵
        Modifies registry class
        
        PID:3720
        
        C:\Windows\SysWOW64\Bmelmefm.exe
        
        C:\Windows\system32\Bmelmefm.exe
        327⤵
        Drops file in System32 directory
        
        PID:3728
        
        C:\Windows\SysWOW64\Baphmd32.exe
        
        C:\Windows\system32\Baphmd32.exe
        328⤵
        Modifies registry class
        
        PID:3736
        
        C:\Windows\SysWOW64\Bhjqjnfb.exe
        
        C:\Windows\system32\Bhjqjnfb.exe
        329⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\Bbdakl32.exe
        
        C:\Windows\system32\Bbdakl32.exe
        330⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\Bfpnkkkj.exe
        
        C:\Windows\system32\Bfpnkkkj.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3760
        
        C:\Windows\SysWOW64\Binjgfjn.exe
        
        C:\Windows\system32\Binjgfjn.exe
        332⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Bllfcaib.exe
        
        C:\Windows\system32\Bllfcaib.exe
        333⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\Cdcndojd.exe
        
        C:\Windows\system32\Cdcndojd.exe
        334⤵
        Drops file in System32 directory
        
        PID:3784
        
        C:\Windows\SysWOW64\Cedjlg32.exe
        
        C:\Windows\system32\Cedjlg32.exe
        335⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\Ceggbgnp.exe
        
        C:\Windows\system32\Ceggbgnp.exe
        336⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Checnbmc.exe
        
        C:\Windows\system32\Checnbmc.exe
        337⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3808
        
        C:\Windows\SysWOW64\Ceidgflm.exe
        
        C:\Windows\system32\Ceidgflm.exe
        338⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\Cbmdqk32.exe
        
        C:\Windows\system32\Cbmdqk32.exe
        339⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Cdoahcqe.exe
        
        C:\Windows\system32\Cdoahcqe.exe
        340⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\Clfijpag.exe
        
        C:\Windows\system32\Clfijpag.exe
        341⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Cdannbob.exe
        
        C:\Windows\system32\Cdannbob.exe
        342⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\Cgojjnnf.exe
        
        C:\Windows\system32\Cgojjnnf.exe
        343⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Dofbkk32.exe
        
        C:\Windows\system32\Dofbkk32.exe
        344⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Dipcli32.exe
        
        C:\Windows\system32\Dipcli32.exe
        345⤵
        Modifies registry class
        
        PID:4016
        
        C:\Windows\SysWOW64\Dchgdoag.exe
        
        C:\Windows\system32\Dchgdoag.exe
        346⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\Dkpoflbj.exe
        
        C:\Windows\system32\Dkpoflbj.exe
        347⤵
        Drops file in System32 directory
        
        PID:4052
        
        C:\Windows\SysWOW64\Dnnkbg32.exe
        
        C:\Windows\system32\Dnnkbg32.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4088
        
        C:\Windows\SysWOW64\Dgfpkmgn.exe
        
        C:\Windows\system32\Dgfpkmgn.exe
        349⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Dnphgg32.exe
        
        C:\Windows\system32\Dnphgg32.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3172
        
        C:\Windows\SysWOW64\Doadopei.exe
        
        C:\Windows\system32\Doadopei.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2400
        
        C:\Windows\SysWOW64\Dekmli32.exe
        
        C:\Windows\system32\Dekmli32.exe
        352⤵
        Drops file in System32 directory
        
        PID:2508
        
        C:\Windows\SysWOW64\Ejiebh32.exe
        
        C:\Windows\system32\Ejiebh32.exe
        353⤵
        Drops file in System32 directory
        
        PID:2544
        
        C:\Windows\SysWOW64\Elhbnc32.exe
        
        C:\Windows\system32\Elhbnc32.exe
        354⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\Fcafjq32.exe
        
        C:\Windows\system32\Fcafjq32.exe
        355⤵
        Modifies registry class
        
        PID:2600
        
        C:\Windows\SysWOW64\Fqegce32.exe
        
        C:\Windows\system32\Fqegce32.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2616
        
        C:\Windows\SysWOW64\Fbgckmqp.exe
        
        C:\Windows\system32\Fbgckmqp.exe
        357⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\Fiqlhg32.exe
        
        C:\Windows\system32\Fiqlhg32.exe
        358⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Fokddaoj.exe
        
        C:\Windows\system32\Fokddaoj.exe
        359⤵
        
        PID:2632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Lgfnjdaj.exe

Filesize
92KB

MD5
69021abe748bca529ebb8ad68c42ae27

SHA1
57eed47ca3823acc917def6f375393edcc3ed55e

SHA256
f895254f4e20bed10bafd459195a9100483f71788b400543df3a9e554541327f

SHA512
89eafaa292bd3798f0f559292183485100191e563cbfb68e3711f8fbd4a44cc69cfea7fd8c504f425334883082da91c6697169c4dc5926df2fc0cbc1dc33fdd8

Download Submit
C:\Windows\SysWOW64\Lgfnjdaj.exe

Filesize
92KB

MD5
69021abe748bca529ebb8ad68c42ae27

SHA1
57eed47ca3823acc917def6f375393edcc3ed55e

SHA256
f895254f4e20bed10bafd459195a9100483f71788b400543df3a9e554541327f

SHA512
89eafaa292bd3798f0f559292183485100191e563cbfb68e3711f8fbd4a44cc69cfea7fd8c504f425334883082da91c6697169c4dc5926df2fc0cbc1dc33fdd8

Download Submit
C:\Windows\SysWOW64\Loabofne.exe

Filesize
92KB

MD5
bef353e4aaf9634c04269404dae09fcd

SHA1
623731632b1cf6183c2ce5280601eee5addfb1f3

SHA256
512551ea568dc881932ae12a79811d7a0848780266baa8dbf2b0503c648e3ef5

SHA512
aeae51c3c58bea2b976f47003722c025560c018ad6a7daf3826f35acf46dc6a2948af5a9a6c8c973d17abdb7d31f84a4e4639314262eab271f41a263966f63b8

Download Submit
C:\Windows\SysWOW64\Loabofne.exe

Filesize
92KB

MD5
bef353e4aaf9634c04269404dae09fcd

SHA1
623731632b1cf6183c2ce5280601eee5addfb1f3

SHA256
512551ea568dc881932ae12a79811d7a0848780266baa8dbf2b0503c648e3ef5

SHA512
aeae51c3c58bea2b976f47003722c025560c018ad6a7daf3826f35acf46dc6a2948af5a9a6c8c973d17abdb7d31f84a4e4639314262eab271f41a263966f63b8

Download Submit
C:\Windows\SysWOW64\Mbddedlo.exe

Filesize
92KB

MD5
a714cca5429811f57c4142324bc1999e

SHA1
77e93bf649545630c4ca331ad0ee9ff402b16750

SHA256
c174de6a05e94f718e8d13df7b0b9737bc3315267286e89f63f8ef79ed736a76

SHA512
48491ad0d32bb5416c2078671fcd0fd43eeccbce41e0141f512b6dd0d2331a6394809077f9c73e08d9c5a42ae0146cb8d8bf47f33140a34d2d7fb659f1a7595f

Download Submit
C:\Windows\SysWOW64\Mbddedlo.exe

Filesize
92KB

MD5
a714cca5429811f57c4142324bc1999e

SHA1
77e93bf649545630c4ca331ad0ee9ff402b16750

SHA256
c174de6a05e94f718e8d13df7b0b9737bc3315267286e89f63f8ef79ed736a76

SHA512
48491ad0d32bb5416c2078671fcd0fd43eeccbce41e0141f512b6dd0d2331a6394809077f9c73e08d9c5a42ae0146cb8d8bf47f33140a34d2d7fb659f1a7595f

Download Submit
C:\Windows\SysWOW64\Mfkgjchn.exe

Filesize
92KB

MD5
3c797ba98308110514acd7cdae8392fe

SHA1
2d6d4a7044a1a1f95cf5bfbd670fbdbbb1d9e8fd

SHA256
7a8ed4f5e0d0d6ef7caf44524e4e959b54e0b87fed78d13cf27f01a61868a775

SHA512
0eda07bf8dd8c99f967edfd4f92f1d6d209ef0b0aff71908afde384f4ee3d0e3cea1296d35a9fed0fc9b172db6a4ecd9a6aa62abbce792397f926fb7e837ee87

Download Submit
C:\Windows\SysWOW64\Mfkgjchn.exe

Filesize
92KB

MD5
3c797ba98308110514acd7cdae8392fe

SHA1
2d6d4a7044a1a1f95cf5bfbd670fbdbbb1d9e8fd

SHA256
7a8ed4f5e0d0d6ef7caf44524e4e959b54e0b87fed78d13cf27f01a61868a775

SHA512
0eda07bf8dd8c99f967edfd4f92f1d6d209ef0b0aff71908afde384f4ee3d0e3cea1296d35a9fed0fc9b172db6a4ecd9a6aa62abbce792397f926fb7e837ee87

Download Submit
C:\Windows\SysWOW64\Mmglmm32.exe

Filesize
92KB

MD5
984ca7d2f42389cc3bd8a9b5e4cbb122

SHA1
cbd08ea2bf9d012e3ce66817c93e244648a9706d

SHA256
53213fc649986eacc4a90b28e4737c8703d91abdc78b7e976e853106ac6e34b7

SHA512
42fcc83cb6da5863fa2e36b4b30087bb36b04d7a477ea1113bb5accd6a8968d5f5927fe85de0bf56d01a9499e95f2afe820f992a7c85a362b99e94c2d1e427c4

Download Submit
C:\Windows\SysWOW64\Mmglmm32.exe

Filesize
92KB

MD5
984ca7d2f42389cc3bd8a9b5e4cbb122

SHA1
cbd08ea2bf9d012e3ce66817c93e244648a9706d

SHA256
53213fc649986eacc4a90b28e4737c8703d91abdc78b7e976e853106ac6e34b7

SHA512
42fcc83cb6da5863fa2e36b4b30087bb36b04d7a477ea1113bb5accd6a8968d5f5927fe85de0bf56d01a9499e95f2afe820f992a7c85a362b99e94c2d1e427c4

Download Submit
C:\Windows\SysWOW64\Mmihbmke.exe

Filesize
92KB

MD5
82df385ad4bdfee68b933869b9281c9e

SHA1
dad7da344fd508b0d55ad7d7d4c601001b808a66

SHA256
edf6e40e0f3932143b27bd9dd39891caea3af1d0b247f83e85fd7c2b44f79087

SHA512
a35cdd41c0ef8d0f426daa92b1b8f76aa86378984c46a0feebdcb95ca4e333aeb8f48d02f723154bdadf8ddb979c232611e6b5da16e094215c7344d4557dbef7

Download Submit
C:\Windows\SysWOW64\Mmihbmke.exe

Filesize
92KB

MD5
82df385ad4bdfee68b933869b9281c9e

SHA1
dad7da344fd508b0d55ad7d7d4c601001b808a66

SHA256
edf6e40e0f3932143b27bd9dd39891caea3af1d0b247f83e85fd7c2b44f79087

SHA512
a35cdd41c0ef8d0f426daa92b1b8f76aa86378984c46a0feebdcb95ca4e333aeb8f48d02f723154bdadf8ddb979c232611e6b5da16e094215c7344d4557dbef7

Download Submit
C:\Windows\SysWOW64\Nankaplb.exe

Filesize
92KB

MD5
5b0686f1793e1e7c6b1cb963a207f5ff

SHA1
a6e03fe352f640a1e191c206c871a2689c6d1c4c

SHA256
2f77d979469098735991d51fff53055ab53c87c9d70efa900c709e6006145c52

SHA512
db3f25deb83b0039f77610ec0a63c181e85695569cfee9b3bd8ab6b9177da0fd44b10103c4d6f9b061fec4d7377e4f949acc31f92f989b663dfc23d657159cb4

Download Submit
C:\Windows\SysWOW64\Nankaplb.exe

Filesize
92KB

MD5
5b0686f1793e1e7c6b1cb963a207f5ff

SHA1
a6e03fe352f640a1e191c206c871a2689c6d1c4c

SHA256
2f77d979469098735991d51fff53055ab53c87c9d70efa900c709e6006145c52

SHA512
db3f25deb83b0039f77610ec0a63c181e85695569cfee9b3bd8ab6b9177da0fd44b10103c4d6f9b061fec4d7377e4f949acc31f92f989b663dfc23d657159cb4

Download Submit
C:\Windows\SysWOW64\Nbmgkcce.exe

Filesize
92KB

MD5
7ef3418893613878047f0b3cb05316a8

SHA1
3f704c4269cddd2cf4226b4f5d8e3a15d66c65d3

SHA256
87a2a4bdcde049919032d0a940933c508a75dcd894676e66903da6eb8fb9cccc

SHA512
9497a291e4c0bd0ea9b7f5de20852ba9591f0b88792fbd182e4ef23aadb42fd5a0f073dbf66d64c96d9d021381f50cb79b644d441cd0e18381f9f3f636b4bf58

Download Submit
C:\Windows\SysWOW64\Nbmgkcce.exe

Filesize
92KB

MD5
7ef3418893613878047f0b3cb05316a8

SHA1
3f704c4269cddd2cf4226b4f5d8e3a15d66c65d3

SHA256
87a2a4bdcde049919032d0a940933c508a75dcd894676e66903da6eb8fb9cccc

SHA512
9497a291e4c0bd0ea9b7f5de20852ba9591f0b88792fbd182e4ef23aadb42fd5a0f073dbf66d64c96d9d021381f50cb79b644d441cd0e18381f9f3f636b4bf58

Download Submit
C:\Windows\SysWOW64\Nccqog32.exe

Filesize
92KB

MD5
2ff551a5ebb467eb9e6f5af9ecf1d0fc

SHA1
79c346f011075ae6c5b67f1bdb0da0a9a29cacb0

SHA256
8ee1c2d9a1c8a48335bb5bda0c68f74faf7d6fdd36184f8d04c811e6eff2845e

SHA512
c87858ce3fb4ef46c280e8e29e9bdc3b0bf36c88b68b6953dd3859a90a01f6a5005cc5fde0a5c4baaa3e0c5911e64984c87509691b180fcf326cf43bdcb3b67d

Download Submit
C:\Windows\SysWOW64\Nccqog32.exe

Filesize
92KB

MD5
2ff551a5ebb467eb9e6f5af9ecf1d0fc

SHA1
79c346f011075ae6c5b67f1bdb0da0a9a29cacb0

SHA256
8ee1c2d9a1c8a48335bb5bda0c68f74faf7d6fdd36184f8d04c811e6eff2845e

SHA512
c87858ce3fb4ef46c280e8e29e9bdc3b0bf36c88b68b6953dd3859a90a01f6a5005cc5fde0a5c4baaa3e0c5911e64984c87509691b180fcf326cf43bdcb3b67d

Download Submit
C:\Windows\SysWOW64\Nfdjqbpc.exe

Filesize
92KB

MD5
4aa6e59e1b66ea8cc6bbf7ab74927ab5

SHA1
17b9013fcb6d21d24727405caf7c65516c7e86b2

SHA256
5f92a987a9dbcd763053239715cd5862f7c99951a9c101179ec474c9e3e8b07e

SHA512
b44859fd9a58cc4de60f63eb2f5baec8344a41ded556e967d9de3ffd065a4ab6b685a5b8779583ef8d86cd1a952ffe4be75bbf15449736ac018eed419b580214

Download Submit
C:\Windows\SysWOW64\Nfdjqbpc.exe

Filesize
92KB

MD5
4aa6e59e1b66ea8cc6bbf7ab74927ab5

SHA1
17b9013fcb6d21d24727405caf7c65516c7e86b2

SHA256
5f92a987a9dbcd763053239715cd5862f7c99951a9c101179ec474c9e3e8b07e

SHA512
b44859fd9a58cc4de60f63eb2f5baec8344a41ded556e967d9de3ffd065a4ab6b685a5b8779583ef8d86cd1a952ffe4be75bbf15449736ac018eed419b580214

Download Submit
C:\Windows\SysWOW64\Nhhcnj32.exe

Filesize
92KB

MD5
9a5abc07863867eac7372b6cb28e55fa

SHA1
8d5509dab2568f262b1f516e71825552cf200746

SHA256
1c3434eabb9943cc63cd1d96b9a8913a4f1698bf19eb39bd9a3125c3c441e5b9

SHA512
41daffadb83e994415c461cab36fc539e50a90b0eff08de954f193e204dd03a175118b93eddb220be54f16e5ad96ee2a1c27d5340ed779f475b06d45ff8436a5

Download Submit
C:\Windows\SysWOW64\Nhhcnj32.exe

Filesize
92KB

MD5
9a5abc07863867eac7372b6cb28e55fa

SHA1
8d5509dab2568f262b1f516e71825552cf200746

SHA256
1c3434eabb9943cc63cd1d96b9a8913a4f1698bf19eb39bd9a3125c3c441e5b9

SHA512
41daffadb83e994415c461cab36fc539e50a90b0eff08de954f193e204dd03a175118b93eddb220be54f16e5ad96ee2a1c27d5340ed779f475b06d45ff8436a5

Download Submit
C:\Windows\SysWOW64\Nlabiink.exe

Filesize
92KB

MD5
8b16c65c0813bad864cca7f4c0aa00eb

SHA1
2dfaf573d9c4d9617a8c0049a66921b52fa5e62b

SHA256
f71075bc96531224db61aa451d9effbaccaaa39891fda81e0cc32fb5a8518994

SHA512
bab9b818595c1d1af2ba46d87571990cb07771b6626fa9a4ac0e4cb801fbccd4410e165c4db07d1e4c4861976d17e88bd2effd6e63be5efd27be3e0fc3d1ce33

Download Submit
C:\Windows\SysWOW64\Nlabiink.exe

Filesize
92KB

MD5
8b16c65c0813bad864cca7f4c0aa00eb

SHA1
2dfaf573d9c4d9617a8c0049a66921b52fa5e62b

SHA256
f71075bc96531224db61aa451d9effbaccaaa39891fda81e0cc32fb5a8518994

SHA512
bab9b818595c1d1af2ba46d87571990cb07771b6626fa9a4ac0e4cb801fbccd4410e165c4db07d1e4c4861976d17e88bd2effd6e63be5efd27be3e0fc3d1ce33

Download Submit
C:\Windows\SysWOW64\Nlfldh32.exe

Filesize
92KB

MD5
789340dd29d0ec5a6191b9c91ff1a7eb

SHA1
4b757cb320f2d524d142ab2208474f724e7cfdee

SHA256
49ca77fa21ec61424124eb6ac3756836759bb2c742f8fbc2c6f5fff400d1d0cb

SHA512
012be31459d652dceee518155cefe41381bbdd424bb79d3ed56cf02ac47091162b356dcafea56e3e6ce0edb9ba52ee993f3cea6b08bf57413a51071be5291b40

Download Submit
C:\Windows\SysWOW64\Nlfldh32.exe

Filesize
92KB

MD5
789340dd29d0ec5a6191b9c91ff1a7eb

SHA1
4b757cb320f2d524d142ab2208474f724e7cfdee

SHA256
49ca77fa21ec61424124eb6ac3756836759bb2c742f8fbc2c6f5fff400d1d0cb

SHA512
012be31459d652dceee518155cefe41381bbdd424bb79d3ed56cf02ac47091162b356dcafea56e3e6ce0edb9ba52ee993f3cea6b08bf57413a51071be5291b40

Download Submit
C:\Windows\SysWOW64\Nloeci32.exe

Filesize
92KB

MD5
74a654760f9057dbf1fea8a9ef615aaa

SHA1
31b93c2abe301f55a7acc9023703ed6d07055908

SHA256
4c690995b53e524b2793f7ff83651e21a046e2f73da4ba48216b55d74872617b

SHA512
2c658cb44ad4c9d2073fd5c8b06346679ecb44dc500132701fadf0c1a8e80b78ace359493a0eaef5c400088e742ef7b3655b72c0113d0fcfa4c53bb6c57e378b

Download Submit
C:\Windows\SysWOW64\Nloeci32.exe

Filesize
92KB

MD5
74a654760f9057dbf1fea8a9ef615aaa

SHA1
31b93c2abe301f55a7acc9023703ed6d07055908

SHA256
4c690995b53e524b2793f7ff83651e21a046e2f73da4ba48216b55d74872617b

SHA512
2c658cb44ad4c9d2073fd5c8b06346679ecb44dc500132701fadf0c1a8e80b78ace359493a0eaef5c400088e742ef7b3655b72c0113d0fcfa4c53bb6c57e378b

Download Submit
C:\Windows\SysWOW64\Penlla32.exe

Filesize
92KB

MD5
602436f5015368406f8683667aff0261

SHA1
6ad9df15ee224e9e43f2d330a39814243f8d2e68

SHA256
8494cac0ef6766ce2074a7cc227f7577dd7d3920c791ece556125ff1120dae66

SHA512
4d94e1cf8935c365e3bf6dcb55be15023ff6c8b6bfe7cd7aaa96307d98c064cc5b5a54b02fc3aa219993f0ae1266402921dd6e1fc219d6a4423fcd166d5012c5

Download Submit
C:\Windows\SysWOW64\Penlla32.exe

Filesize
92KB

MD5
602436f5015368406f8683667aff0261

SHA1
6ad9df15ee224e9e43f2d330a39814243f8d2e68

SHA256
8494cac0ef6766ce2074a7cc227f7577dd7d3920c791ece556125ff1120dae66

SHA512
4d94e1cf8935c365e3bf6dcb55be15023ff6c8b6bfe7cd7aaa96307d98c064cc5b5a54b02fc3aa219993f0ae1266402921dd6e1fc219d6a4423fcd166d5012c5

Download Submit
C:\Windows\SysWOW64\Plhdhkkn.exe

Filesize
92KB

MD5
ede74585fb8dff52ac8476f85bd8f052

SHA1
5592faf18ec614fa96326a256500d68e9c939768

SHA256
1f993b0796707dfe3e4574a3e8454951c4fb4313703933e5f133f0253a9164a2

SHA512
e0c3f8df47178c4e6da0a9bac9bba006386ad165280b01d2819408def1d0e70f35e457252725843bdac43559d5550ec3e8a33e271f8f000edbf8e900b30b0427

Download Submit
C:\Windows\SysWOW64\Plhdhkkn.exe

Filesize
92KB

MD5
ede74585fb8dff52ac8476f85bd8f052

SHA1
5592faf18ec614fa96326a256500d68e9c939768

SHA256
1f993b0796707dfe3e4574a3e8454951c4fb4313703933e5f133f0253a9164a2

SHA512
e0c3f8df47178c4e6da0a9bac9bba006386ad165280b01d2819408def1d0e70f35e457252725843bdac43559d5550ec3e8a33e271f8f000edbf8e900b30b0427

Download Submit
\Windows\SysWOW64\Lgfnjdaj.exe

Filesize
92KB

MD5
69021abe748bca529ebb8ad68c42ae27

SHA1
57eed47ca3823acc917def6f375393edcc3ed55e

SHA256
f895254f4e20bed10bafd459195a9100483f71788b400543df3a9e554541327f

SHA512
89eafaa292bd3798f0f559292183485100191e563cbfb68e3711f8fbd4a44cc69cfea7fd8c504f425334883082da91c6697169c4dc5926df2fc0cbc1dc33fdd8

Download Submit
\Windows\SysWOW64\Lgfnjdaj.exe

Filesize
92KB

MD5
69021abe748bca529ebb8ad68c42ae27

SHA1
57eed47ca3823acc917def6f375393edcc3ed55e

SHA256
f895254f4e20bed10bafd459195a9100483f71788b400543df3a9e554541327f

SHA512
89eafaa292bd3798f0f559292183485100191e563cbfb68e3711f8fbd4a44cc69cfea7fd8c504f425334883082da91c6697169c4dc5926df2fc0cbc1dc33fdd8

Download Submit
\Windows\SysWOW64\Loabofne.exe

Filesize
92KB

MD5
bef353e4aaf9634c04269404dae09fcd

SHA1
623731632b1cf6183c2ce5280601eee5addfb1f3

SHA256
512551ea568dc881932ae12a79811d7a0848780266baa8dbf2b0503c648e3ef5

SHA512
aeae51c3c58bea2b976f47003722c025560c018ad6a7daf3826f35acf46dc6a2948af5a9a6c8c973d17abdb7d31f84a4e4639314262eab271f41a263966f63b8

Download Submit
\Windows\SysWOW64\Loabofne.exe

Filesize
92KB

MD5
bef353e4aaf9634c04269404dae09fcd

SHA1
623731632b1cf6183c2ce5280601eee5addfb1f3

SHA256
512551ea568dc881932ae12a79811d7a0848780266baa8dbf2b0503c648e3ef5

SHA512
aeae51c3c58bea2b976f47003722c025560c018ad6a7daf3826f35acf46dc6a2948af5a9a6c8c973d17abdb7d31f84a4e4639314262eab271f41a263966f63b8

Download Submit
\Windows\SysWOW64\Mbddedlo.exe

Filesize
92KB

MD5
a714cca5429811f57c4142324bc1999e

SHA1
77e93bf649545630c4ca331ad0ee9ff402b16750

SHA256
c174de6a05e94f718e8d13df7b0b9737bc3315267286e89f63f8ef79ed736a76

SHA512
48491ad0d32bb5416c2078671fcd0fd43eeccbce41e0141f512b6dd0d2331a6394809077f9c73e08d9c5a42ae0146cb8d8bf47f33140a34d2d7fb659f1a7595f

Download Submit
\Windows\SysWOW64\Mbddedlo.exe

Filesize
92KB

MD5
a714cca5429811f57c4142324bc1999e

SHA1
77e93bf649545630c4ca331ad0ee9ff402b16750

SHA256
c174de6a05e94f718e8d13df7b0b9737bc3315267286e89f63f8ef79ed736a76

SHA512
48491ad0d32bb5416c2078671fcd0fd43eeccbce41e0141f512b6dd0d2331a6394809077f9c73e08d9c5a42ae0146cb8d8bf47f33140a34d2d7fb659f1a7595f

Download Submit
\Windows\SysWOW64\Mfkgjchn.exe

Filesize
92KB

MD5
3c797ba98308110514acd7cdae8392fe

SHA1
2d6d4a7044a1a1f95cf5bfbd670fbdbbb1d9e8fd

SHA256
7a8ed4f5e0d0d6ef7caf44524e4e959b54e0b87fed78d13cf27f01a61868a775

SHA512
0eda07bf8dd8c99f967edfd4f92f1d6d209ef0b0aff71908afde384f4ee3d0e3cea1296d35a9fed0fc9b172db6a4ecd9a6aa62abbce792397f926fb7e837ee87

Download Submit
\Windows\SysWOW64\Mfkgjchn.exe

Filesize
92KB

MD5
3c797ba98308110514acd7cdae8392fe

SHA1
2d6d4a7044a1a1f95cf5bfbd670fbdbbb1d9e8fd

SHA256
7a8ed4f5e0d0d6ef7caf44524e4e959b54e0b87fed78d13cf27f01a61868a775

SHA512
0eda07bf8dd8c99f967edfd4f92f1d6d209ef0b0aff71908afde384f4ee3d0e3cea1296d35a9fed0fc9b172db6a4ecd9a6aa62abbce792397f926fb7e837ee87

Download Submit
\Windows\SysWOW64\Mmglmm32.exe

Filesize
92KB

MD5
984ca7d2f42389cc3bd8a9b5e4cbb122

SHA1
cbd08ea2bf9d012e3ce66817c93e244648a9706d

SHA256
53213fc649986eacc4a90b28e4737c8703d91abdc78b7e976e853106ac6e34b7

SHA512
42fcc83cb6da5863fa2e36b4b30087bb36b04d7a477ea1113bb5accd6a8968d5f5927fe85de0bf56d01a9499e95f2afe820f992a7c85a362b99e94c2d1e427c4

Download Submit
\Windows\SysWOW64\Mmglmm32.exe

Filesize
92KB

MD5
984ca7d2f42389cc3bd8a9b5e4cbb122

SHA1
cbd08ea2bf9d012e3ce66817c93e244648a9706d

SHA256
53213fc649986eacc4a90b28e4737c8703d91abdc78b7e976e853106ac6e34b7

SHA512
42fcc83cb6da5863fa2e36b4b30087bb36b04d7a477ea1113bb5accd6a8968d5f5927fe85de0bf56d01a9499e95f2afe820f992a7c85a362b99e94c2d1e427c4

Download Submit
\Windows\SysWOW64\Mmihbmke.exe

Filesize
92KB

MD5
82df385ad4bdfee68b933869b9281c9e

SHA1
dad7da344fd508b0d55ad7d7d4c601001b808a66

SHA256
edf6e40e0f3932143b27bd9dd39891caea3af1d0b247f83e85fd7c2b44f79087

SHA512
a35cdd41c0ef8d0f426daa92b1b8f76aa86378984c46a0feebdcb95ca4e333aeb8f48d02f723154bdadf8ddb979c232611e6b5da16e094215c7344d4557dbef7

Download Submit
\Windows\SysWOW64\Mmihbmke.exe

Filesize
92KB

MD5
82df385ad4bdfee68b933869b9281c9e

SHA1
dad7da344fd508b0d55ad7d7d4c601001b808a66

SHA256
edf6e40e0f3932143b27bd9dd39891caea3af1d0b247f83e85fd7c2b44f79087

SHA512
a35cdd41c0ef8d0f426daa92b1b8f76aa86378984c46a0feebdcb95ca4e333aeb8f48d02f723154bdadf8ddb979c232611e6b5da16e094215c7344d4557dbef7

Download Submit
\Windows\SysWOW64\Nankaplb.exe

Filesize
92KB

MD5
5b0686f1793e1e7c6b1cb963a207f5ff

SHA1
a6e03fe352f640a1e191c206c871a2689c6d1c4c

SHA256
2f77d979469098735991d51fff53055ab53c87c9d70efa900c709e6006145c52

SHA512
db3f25deb83b0039f77610ec0a63c181e85695569cfee9b3bd8ab6b9177da0fd44b10103c4d6f9b061fec4d7377e4f949acc31f92f989b663dfc23d657159cb4

Download Submit
\Windows\SysWOW64\Nankaplb.exe

Filesize
92KB

MD5
5b0686f1793e1e7c6b1cb963a207f5ff

SHA1
a6e03fe352f640a1e191c206c871a2689c6d1c4c

SHA256
2f77d979469098735991d51fff53055ab53c87c9d70efa900c709e6006145c52

SHA512
db3f25deb83b0039f77610ec0a63c181e85695569cfee9b3bd8ab6b9177da0fd44b10103c4d6f9b061fec4d7377e4f949acc31f92f989b663dfc23d657159cb4

Download Submit
\Windows\SysWOW64\Nbmgkcce.exe

Filesize
92KB

MD5
7ef3418893613878047f0b3cb05316a8

SHA1
3f704c4269cddd2cf4226b4f5d8e3a15d66c65d3

SHA256
87a2a4bdcde049919032d0a940933c508a75dcd894676e66903da6eb8fb9cccc

SHA512
9497a291e4c0bd0ea9b7f5de20852ba9591f0b88792fbd182e4ef23aadb42fd5a0f073dbf66d64c96d9d021381f50cb79b644d441cd0e18381f9f3f636b4bf58

Download Submit
\Windows\SysWOW64\Nbmgkcce.exe

Filesize
92KB

MD5
7ef3418893613878047f0b3cb05316a8

SHA1
3f704c4269cddd2cf4226b4f5d8e3a15d66c65d3

SHA256
87a2a4bdcde049919032d0a940933c508a75dcd894676e66903da6eb8fb9cccc

SHA512
9497a291e4c0bd0ea9b7f5de20852ba9591f0b88792fbd182e4ef23aadb42fd5a0f073dbf66d64c96d9d021381f50cb79b644d441cd0e18381f9f3f636b4bf58

Download Submit
\Windows\SysWOW64\Nccqog32.exe

Filesize
92KB

MD5
2ff551a5ebb467eb9e6f5af9ecf1d0fc

SHA1
79c346f011075ae6c5b67f1bdb0da0a9a29cacb0

SHA256
8ee1c2d9a1c8a48335bb5bda0c68f74faf7d6fdd36184f8d04c811e6eff2845e

SHA512
c87858ce3fb4ef46c280e8e29e9bdc3b0bf36c88b68b6953dd3859a90a01f6a5005cc5fde0a5c4baaa3e0c5911e64984c87509691b180fcf326cf43bdcb3b67d

Download Submit
\Windows\SysWOW64\Nccqog32.exe

Filesize
92KB

MD5
2ff551a5ebb467eb9e6f5af9ecf1d0fc

SHA1
79c346f011075ae6c5b67f1bdb0da0a9a29cacb0

SHA256
8ee1c2d9a1c8a48335bb5bda0c68f74faf7d6fdd36184f8d04c811e6eff2845e

SHA512
c87858ce3fb4ef46c280e8e29e9bdc3b0bf36c88b68b6953dd3859a90a01f6a5005cc5fde0a5c4baaa3e0c5911e64984c87509691b180fcf326cf43bdcb3b67d

Download Submit
\Windows\SysWOW64\Nfdjqbpc.exe

Filesize
92KB

MD5
4aa6e59e1b66ea8cc6bbf7ab74927ab5

SHA1
17b9013fcb6d21d24727405caf7c65516c7e86b2

SHA256
5f92a987a9dbcd763053239715cd5862f7c99951a9c101179ec474c9e3e8b07e

SHA512
b44859fd9a58cc4de60f63eb2f5baec8344a41ded556e967d9de3ffd065a4ab6b685a5b8779583ef8d86cd1a952ffe4be75bbf15449736ac018eed419b580214

Download Submit
\Windows\SysWOW64\Nfdjqbpc.exe

Filesize
92KB

MD5
4aa6e59e1b66ea8cc6bbf7ab74927ab5

SHA1
17b9013fcb6d21d24727405caf7c65516c7e86b2

SHA256
5f92a987a9dbcd763053239715cd5862f7c99951a9c101179ec474c9e3e8b07e

SHA512
b44859fd9a58cc4de60f63eb2f5baec8344a41ded556e967d9de3ffd065a4ab6b685a5b8779583ef8d86cd1a952ffe4be75bbf15449736ac018eed419b580214

Download Submit
\Windows\SysWOW64\Nhhcnj32.exe

Filesize
92KB

MD5
9a5abc07863867eac7372b6cb28e55fa

SHA1
8d5509dab2568f262b1f516e71825552cf200746

SHA256
1c3434eabb9943cc63cd1d96b9a8913a4f1698bf19eb39bd9a3125c3c441e5b9

SHA512
41daffadb83e994415c461cab36fc539e50a90b0eff08de954f193e204dd03a175118b93eddb220be54f16e5ad96ee2a1c27d5340ed779f475b06d45ff8436a5

Download Submit
\Windows\SysWOW64\Nhhcnj32.exe

Filesize
92KB

MD5
9a5abc07863867eac7372b6cb28e55fa

SHA1
8d5509dab2568f262b1f516e71825552cf200746

SHA256
1c3434eabb9943cc63cd1d96b9a8913a4f1698bf19eb39bd9a3125c3c441e5b9

SHA512
41daffadb83e994415c461cab36fc539e50a90b0eff08de954f193e204dd03a175118b93eddb220be54f16e5ad96ee2a1c27d5340ed779f475b06d45ff8436a5

Download Submit
\Windows\SysWOW64\Nlabiink.exe

Filesize
92KB

MD5
8b16c65c0813bad864cca7f4c0aa00eb

SHA1
2dfaf573d9c4d9617a8c0049a66921b52fa5e62b

SHA256
f71075bc96531224db61aa451d9effbaccaaa39891fda81e0cc32fb5a8518994

SHA512
bab9b818595c1d1af2ba46d87571990cb07771b6626fa9a4ac0e4cb801fbccd4410e165c4db07d1e4c4861976d17e88bd2effd6e63be5efd27be3e0fc3d1ce33

Download Submit
\Windows\SysWOW64\Nlabiink.exe

Filesize
92KB

MD5
8b16c65c0813bad864cca7f4c0aa00eb

SHA1
2dfaf573d9c4d9617a8c0049a66921b52fa5e62b

SHA256
f71075bc96531224db61aa451d9effbaccaaa39891fda81e0cc32fb5a8518994

SHA512
bab9b818595c1d1af2ba46d87571990cb07771b6626fa9a4ac0e4cb801fbccd4410e165c4db07d1e4c4861976d17e88bd2effd6e63be5efd27be3e0fc3d1ce33

Download Submit
\Windows\SysWOW64\Nlfldh32.exe

Filesize
92KB

MD5
789340dd29d0ec5a6191b9c91ff1a7eb

SHA1
4b757cb320f2d524d142ab2208474f724e7cfdee

SHA256
49ca77fa21ec61424124eb6ac3756836759bb2c742f8fbc2c6f5fff400d1d0cb

SHA512
012be31459d652dceee518155cefe41381bbdd424bb79d3ed56cf02ac47091162b356dcafea56e3e6ce0edb9ba52ee993f3cea6b08bf57413a51071be5291b40

Download Submit
\Windows\SysWOW64\Nlfldh32.exe

Filesize
92KB

MD5
789340dd29d0ec5a6191b9c91ff1a7eb

SHA1
4b757cb320f2d524d142ab2208474f724e7cfdee

SHA256
49ca77fa21ec61424124eb6ac3756836759bb2c742f8fbc2c6f5fff400d1d0cb

SHA512
012be31459d652dceee518155cefe41381bbdd424bb79d3ed56cf02ac47091162b356dcafea56e3e6ce0edb9ba52ee993f3cea6b08bf57413a51071be5291b40

Download Submit
\Windows\SysWOW64\Nloeci32.exe

Filesize
92KB

MD5
74a654760f9057dbf1fea8a9ef615aaa

SHA1
31b93c2abe301f55a7acc9023703ed6d07055908

SHA256
4c690995b53e524b2793f7ff83651e21a046e2f73da4ba48216b55d74872617b

SHA512
2c658cb44ad4c9d2073fd5c8b06346679ecb44dc500132701fadf0c1a8e80b78ace359493a0eaef5c400088e742ef7b3655b72c0113d0fcfa4c53bb6c57e378b

Download Submit
\Windows\SysWOW64\Nloeci32.exe

Filesize
92KB

MD5
74a654760f9057dbf1fea8a9ef615aaa

SHA1
31b93c2abe301f55a7acc9023703ed6d07055908

SHA256
4c690995b53e524b2793f7ff83651e21a046e2f73da4ba48216b55d74872617b

SHA512
2c658cb44ad4c9d2073fd5c8b06346679ecb44dc500132701fadf0c1a8e80b78ace359493a0eaef5c400088e742ef7b3655b72c0113d0fcfa4c53bb6c57e378b

Download Submit
\Windows\SysWOW64\Penlla32.exe

Filesize
92KB

MD5
602436f5015368406f8683667aff0261

SHA1
6ad9df15ee224e9e43f2d330a39814243f8d2e68

SHA256
8494cac0ef6766ce2074a7cc227f7577dd7d3920c791ece556125ff1120dae66

SHA512
4d94e1cf8935c365e3bf6dcb55be15023ff6c8b6bfe7cd7aaa96307d98c064cc5b5a54b02fc3aa219993f0ae1266402921dd6e1fc219d6a4423fcd166d5012c5

Download Submit
\Windows\SysWOW64\Penlla32.exe

Filesize
92KB

MD5
602436f5015368406f8683667aff0261

SHA1
6ad9df15ee224e9e43f2d330a39814243f8d2e68

SHA256
8494cac0ef6766ce2074a7cc227f7577dd7d3920c791ece556125ff1120dae66

SHA512
4d94e1cf8935c365e3bf6dcb55be15023ff6c8b6bfe7cd7aaa96307d98c064cc5b5a54b02fc3aa219993f0ae1266402921dd6e1fc219d6a4423fcd166d5012c5

Download Submit
\Windows\SysWOW64\Plhdhkkn.exe

Filesize
92KB

MD5
ede74585fb8dff52ac8476f85bd8f052

SHA1
5592faf18ec614fa96326a256500d68e9c939768

SHA256
1f993b0796707dfe3e4574a3e8454951c4fb4313703933e5f133f0253a9164a2

SHA512
e0c3f8df47178c4e6da0a9bac9bba006386ad165280b01d2819408def1d0e70f35e457252725843bdac43559d5550ec3e8a33e271f8f000edbf8e900b30b0427

Download Submit
\Windows\SysWOW64\Plhdhkkn.exe

Filesize
92KB

MD5
ede74585fb8dff52ac8476f85bd8f052

SHA1
5592faf18ec614fa96326a256500d68e9c939768

SHA256
1f993b0796707dfe3e4574a3e8454951c4fb4313703933e5f133f0253a9164a2

SHA512
e0c3f8df47178c4e6da0a9bac9bba006386ad165280b01d2819408def1d0e70f35e457252725843bdac43559d5550ec3e8a33e271f8f000edbf8e900b30b0427

Download Submit
memory/320-89-0x0000000000000000-mapping.dmp

Download
memory/320-129-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/340-145-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/340-109-0x0000000000000000-mapping.dmp

Download
memory/388-243-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/388-215-0x0000000000000000-mapping.dmp

Download
memory/436-220-0x0000000000000000-mapping.dmp

Download
memory/544-119-0x0000000000000000-mapping.dmp

Download
memory/544-151-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/592-217-0x0000000000000000-mapping.dmp

Download
memory/600-218-0x0000000000000000-mapping.dmp

Download
memory/680-225-0x0000000000000000-mapping.dmp

Download
memory/704-238-0x0000000000000000-mapping.dmp

Download
memory/796-210-0x0000000000000000-mapping.dmp

Download
memory/796-232-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/860-240-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/860-214-0x0000000000000000-mapping.dmp

Download
memory/860-242-0x0000000000220000-0x0000000000252000-memory.dmp

Filesize
200KB

Download
memory/868-157-0x0000000000000000-mapping.dmp

Download
memory/868-174-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/908-209-0x0000000000000000-mapping.dmp

Download
memory/908-230-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/912-227-0x0000000000000000-mapping.dmp

Download
memory/932-221-0x0000000000000000-mapping.dmp

Download
memory/956-173-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/960-213-0x0000000000000000-mapping.dmp

Download
memory/960-237-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/960-239-0x0000000000220000-0x0000000000252000-memory.dmp

Filesize
200KB

Download
memory/988-170-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/988-171-0x0000000000220000-0x0000000000252000-memory.dmp

Filesize
200KB

Download
memory/988-155-0x0000000000000000-mapping.dmp

Download
memory/1016-156-0x0000000000000000-mapping.dmp

Download
memory/1016-172-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1068-216-0x0000000000000000-mapping.dmp

Download
memory/1104-168-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1104-253-0x0000000000000000-mapping.dmp

Download
memory/1104-153-0x0000000000000000-mapping.dmp

Download
memory/1108-152-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1108-138-0x0000000000000000-mapping.dmp

Download
memory/1116-183-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1116-184-0x0000000000440000-0x0000000000472000-memory.dmp

Filesize
200KB

Download
memory/1116-162-0x0000000000000000-mapping.dmp

Download
memory/1152-99-0x0000000000000000-mapping.dmp

Download
memory/1152-134-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1176-229-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1176-208-0x0000000000000000-mapping.dmp

Download
memory/1184-211-0x0000000000000000-mapping.dmp

Download
memory/1184-233-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1268-177-0x00000000002D0000-0x0000000000302000-memory.dmp

Filesize
200KB

Download
memory/1268-159-0x0000000000000000-mapping.dmp

Download
memory/1268-178-0x00000000002D0000-0x0000000000302000-memory.dmp

Filesize
200KB

Download
memory/1268-176-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1304-124-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1304-69-0x0000000000000000-mapping.dmp

Download
memory/1304-231-0x0000000000000000-mapping.dmp

Download
memory/1324-179-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1324-180-0x0000000000220000-0x0000000000252000-memory.dmp

Filesize
200KB

Download
memory/1324-160-0x0000000000000000-mapping.dmp

Download
memory/1336-125-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1336-74-0x0000000000000000-mapping.dmp

Download
memory/1340-175-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1340-158-0x0000000000000000-mapping.dmp

Download
memory/1360-224-0x0000000000000000-mapping.dmp

Download
memory/1480-205-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1480-197-0x0000000000000000-mapping.dmp

Download
memory/1484-164-0x0000000000000000-mapping.dmp

Download
memory/1484-188-0x00000000001C0000-0x00000000001F2000-memory.dmp

Filesize
200KB

Download
memory/1484-189-0x00000000001C0000-0x00000000001F2000-memory.dmp

Filesize
200KB

Download
memory/1484-186-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1488-149-0x00000000002A0000-0x00000000002D2000-memory.dmp

Filesize
200KB

Download
memory/1488-147-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1488-114-0x0000000000000000-mapping.dmp

Download
memory/1504-193-0x0000000000000000-mapping.dmp

Download
memory/1504-200-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1508-165-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1508-131-0x0000000000000000-mapping.dmp

Download
memory/1552-201-0x0000000000000000-mapping.dmp

Download
memory/1552-226-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1584-199-0x0000000001B60000-0x0000000001B92000-memory.dmp

Filesize
200KB

Download
memory/1584-192-0x0000000000000000-mapping.dmp

Download
memory/1584-198-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1592-104-0x0000000000000000-mapping.dmp

Download
memory/1592-141-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1620-191-0x0000000000000000-mapping.dmp

Download
memory/1620-206-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1656-202-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1656-194-0x0000000000000000-mapping.dmp

Download
memory/1664-212-0x0000000000000000-mapping.dmp

Download
memory/1664-236-0x00000000002A0000-0x00000000002D2000-memory.dmp

Filesize
200KB

Download
memory/1664-234-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1692-222-0x0000000000000000-mapping.dmp

Download
memory/1696-244-0x0000000000000000-mapping.dmp

Download
memory/1704-94-0x0000000000000000-mapping.dmp

Download
memory/1704-132-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1720-182-0x0000000000220000-0x0000000000252000-memory.dmp

Filesize
200KB

Download
memory/1720-161-0x0000000000000000-mapping.dmp

Download
memory/1720-181-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1724-223-0x0000000000000000-mapping.dmp

Download
memory/1728-59-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1728-60-0x0000000000440000-0x0000000000472000-memory.dmp

Filesize
200KB

Download
memory/1748-122-0x00000000003C0000-0x00000000003F2000-memory.dmp

Filesize
200KB

Download
memory/1748-56-0x0000000000000000-mapping.dmp

Download
memory/1748-61-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1752-204-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1752-196-0x0000000000000000-mapping.dmp

Download
memory/1772-235-0x0000000000000000-mapping.dmp

Download
memory/1772-84-0x0000000000000000-mapping.dmp

Download
memory/1772-127-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1780-241-0x0000000000000000-mapping.dmp

Download
memory/1804-228-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1804-207-0x0000000000000000-mapping.dmp

Download
memory/1828-154-0x0000000000000000-mapping.dmp

Download
memory/1828-169-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1860-190-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1860-187-0x0000000000000000-mapping.dmp

Download
memory/1912-219-0x0000000000000000-mapping.dmp

Download
memory/1952-163-0x0000000000000000-mapping.dmp

Download
memory/1952-185-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2000-79-0x0000000000000000-mapping.dmp

Download
memory/2000-126-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2012-123-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2012-64-0x0000000000000000-mapping.dmp

Download
memory/2024-166-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2024-144-0x0000000000000000-mapping.dmp

Download
memory/2032-195-0x0000000000000000-mapping.dmp

Download
memory/2032-203-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2044-150-0x0000000000000000-mapping.dmp

Download
memory/2044-167-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download